How to Update Debian Automatically: No Muss, No Fuss, Not At All Sus

Recently there was a thread on LowEndTalk asking about automatic updates using something like Ansible.

Ansible is a fine tool and can certainly be used for fine-grained control of upgrades.  But you can also setup Debian to upgrade itself automatically.

In fact, you’re probably already probably doing it to an extent.

Here we’re using Debian 12 “bookworm”.  I bet if you run this command, you’ll find you have the unattended-upgrades package installed:

# dpkg -l | grep -i unatten
ii  unattended-upgrades             2.9.1+nmu3                           all          automatic installation of security upgrades

If not:

apt update
apt -y install unattended-upgrades

If unattended-upgrades was installed and you haven’t touched the config, or you just installed it, it’s setup to apply security updates only.  You can easily change it to perform all updates.

You want to edit the file

/etc/apt/apt.conf.d/50unattended-upgrades

By default, it looks like this (among other lines):

Unattended-Upgrade::Origins-Pattern {
  // Codename based matching:
  // This will follow the migration of a release through different
  // archives (e.g. from testing to stable and later oldstable).
  // Software will be the latest available for the named release,
  // but the Debian release itself will not be automatically upgraded.
  // "origin=Debian,codename=${distro_codename}-updates";
  // "origin=Debian,codename=${distro_codename}-proposed-updates";
  "origin=Debian,codename=${distro_codename},label=Debian";
  "origin=Debian,codename=${distro_codename},label=Debian-Security";
  "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";

If you uncomment (by removing the leading //) the two lines in bold, you’ll get all upgrades and not just security updates.

The upgrade cycle will fire daily due to these services:

/usr/lib/systemd/system/apt-daily.service
/usr/lib/systemd/system/apt-daily-upgrade.service

Need more info?

man unattended-upgrade