# Unattended security VPS updates for StartTunnel

**URL:** <https://community.start9.com/t/unattended-security-vps-updates-for-starttunnel/5815>\
**Category:** Discussion\
**Tags:** how-to\
**Created:** [October 6, 2026, 6:50pm UTC](https://community.start9.com/t/unattended-security-vps-updates-for-starttunnel/5815 "2026-10-06T18:50:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ruxal](https://community.start9.com/user_avatar/community.start9.com/ruxal/32/451_2.png) [@ruxal](https://community.start9.com/u/ruxal)\
**Post date:** [October 6, 2026, 6:50pm UTC](https://community.start9.com/t/unattended-security-vps-updates-for-starttunnel/5815/1 "2026-10-06T18:50:20Z")

</div>

Since i now need to maintain an additional VPS facing outbound traffic for Start9 i have been tinkering with automated updates, depending on the provider I noticed some have it included and others are not, what is your experience with this and how do you mitigate for example the latest critical update for **6.12.111-1 including reboot ?**

Below is what i have configured so far on my VPS but maybe others have some more better ideas…

Here’s the setup for a Debian VPS (works the same on bookworm and trixie). It’s the same configuration you put on VM1989.

**1. Install and enable**

```bash
sudo apt update
sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades # answer "Yes"

```

This creates `/etc/apt/apt.conf.d/20auto-upgrades`. Check that it contains:

```auto
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

```

**2. Add reboot settings in a local override file**

Use a separate file so package updates to `50unattended-upgrades` don’t overwrite your changes:

```bash
sudo tee /etc/apt/apt.conf.d/52unattended-upgrades-local >/dev/null <<'EOF'
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
EOF

```

Debian’s default `50unattended-upgrades` already limits updates to the `-security` origin, so you don’t need to change anything there.

**3. Make sure kernel updates actually trigger the reboot**

The reboot only happens if `/run/reboot-required` exists. Debian doesn’t create that file as reliably as Ubuntu does, so add a small hook:

```bash
sudo tee /etc/kernel/postinst.d/zz-reboot-required >/dev/null <<'EOF'
#!/bin/sh
touch /run/reboot-required
EOF
sudo chmod +x /etc/kernel/postinst.d/zz-reboot-required

```

**4. Test it**

```bash
sudo unattended-upgrade --dry-run --debug 2>&1 | tail -30
systemctl list-timers apt-daily*

```

Logs are in `/var/log/unattended-upgrades/`.

**Timing:** `apt-daily-upgrade.timer` runs around 06:00 by default. A kernel installed then will reboot at 02:00 the next night, so expect up to about 20 hours with the new kernel installed but not yet running.

**If this is skhron:** the reboot will briefly take down all the tunneled `*.ruxit.tech` services. Before relying on this, confirm StartTunnel and WireGuard come back up on their own with `systemctl is-enabled <service>`. It’s also worth testing one manual reboot first.

EG [Bitcoin Lightning VPS Hosting | LNVPS](https://lnvps.net/?ref=aO3PILfg) this LNVPS provider comes with Unmetered bandwidth but requires some additional consideration for example regarding above topic.

---

<div class="post-metadata">

**Author:** ![ruxal](https://community.start9.com/user_avatar/community.start9.com/ruxal/32/451_2.png) [@ruxal](https://community.start9.com/u/ruxal)\
**Post date:** [October 19, 2026, 5:21am UTC](https://community.start9.com/t/unattended-security-vps-updates-for-starttunnel/5815/2 "2026-10-19T05:21:08Z")

</div>

also noticed that the recent kernel updates also require a manuel intervention regarding reboot of the system anyhow if anyone has there some feedback pls let me know