Since i now need to maintain an additional VPS facing outbound traffic for Start9 i have been tinkering with automated updates, depending on the provider I noticed some have it included and others are not, what is your experience with this and how do you mitigate for example the latest critical update for 6.12.111-1 including reboot ?
Below is what i have configured so far on my VPS but maybe others have some more better ideas…
Here’s the setup for a Debian VPS (works the same on bookworm and trixie). It’s the same configuration you put on VM1989.
1. Install and enable
sudo apt update
sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades # answer "Yes"
This creates /etc/apt/apt.conf.d/20auto-upgrades. Check that it contains:
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
2. Add reboot settings in a local override file
Use a separate file so package updates to 50unattended-upgrades don’t overwrite your changes:
sudo tee /etc/apt/apt.conf.d/52unattended-upgrades-local >/dev/null <<'EOF'
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
EOF
Debian’s default 50unattended-upgrades already limits updates to the -security origin, so you don’t need to change anything there.
3. Make sure kernel updates actually trigger the reboot
The reboot only happens if /run/reboot-required exists. Debian doesn’t create that file as reliably as Ubuntu does, so add a small hook:
sudo tee /etc/kernel/postinst.d/zz-reboot-required >/dev/null <<'EOF'
#!/bin/sh
touch /run/reboot-required
EOF
sudo chmod +x /etc/kernel/postinst.d/zz-reboot-required
4. Test it
sudo unattended-upgrade --dry-run --debug 2>&1 | tail -30
systemctl list-timers apt-daily*
Logs are in /var/log/unattended-upgrades/.
Timing: apt-daily-upgrade.timer runs around 06:00 by default. A kernel installed then will reboot at 02:00 the next night, so expect up to about 20 hours with the new kernel installed but not yet running.
If this is skhron: the reboot will briefly take down all the tunneled *.ruxit.tech services. Before relying on this, confirm StartTunnel and WireGuard come back up on their own with systemctl is-enabled <service>. It’s also worth testing one manual reboot first.
EG Bitcoin Lightning VPS Hosting | LNVPS this LNVPS provider comes with Unmetered bandwidth but requires some additional consideration for example regarding above topic.