Following on from this discussion about automatically updating operating systems...
I've now had chance to review unattended-upgrades after being suggested by @Colin, and after first installing it on a friends Pi, followed by my own, and it seems to work well, with no major issues.
It's applied numerous updates (it's surprising how many there are!) over the past week or so, and I've been comparing the updates with the default dpkg and they have been identical so far (sudo apt list --upgradable).
Installation on a Pi running Buster was quick & easy - apt-get install unattended-upgrades which installed the package, set up logrotate & also created systemd triggers to run the package twice daily to check for updates.
There are 2 main config files which determine how unattended-upgrades functions. I found them a little complicated to set up at first, but it eventually sort of made sense;
/etc/apt/apt.conf.d/20auto-upgrades which is the apt configuration stub, I've edited mine to be -
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";
and the second, /etc/apt/apt.conf.d/50unattended-upgrades which determines which update origins to apply. My config is -
Unattended-Upgrade::Origins-Pattern {
"origin=Raspbian,codename=${distro_codename},label=Raspbian";
"origin=Raspberry Pi Foundation,codename=${distro_codename},label=Raspber$
"origin=Node Source,codename=${distro_codename},label=Node Source";
};
Unattended-Upgrade::Automatic-Reboot True;
..so that I allow updates from the origins 'Raspbian', 'Raspberry Pi Foundation' & 'Node Source' (to update node), which match the sources included in 'Buster's' apt-cache policy.
I picked up a tip to rename this config file to something like /etc/apt/apt.conf.d/52unattended-upgrades to prevent it being overwritten when the package is updated.
You will note that I've set Automatic-Reboot True, this will automatically reboot the pi if any of the updates have set the 'reboot' flag. If you don't want to do this, then set it to False. I've only had 1 auto-reboot so far.
I haven't set up the email reporting (as I don't want to be bothered with emails every few days), but there are 2 logs to view to see what's been happening;
/var/log/unattended-upgrades/unattended-upgrades.log to see what update checks have been made, and;
/var/log/unattended-upgrades/unattended-upgrades-dpkg.log to see the actual updates applied and any error messages.
Definitely worth a look!
