Part 3: Make it a real server
11. Automatic updates#
What you'll do: let the server install security fixes by itself every day. Time: 5 minutes.
Step 1: Install and switch on#
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
A blue window asks "Automatically download and install stable updates?". Choose Yes.
Step 2: Check it's on#
cat /etc/apt/apt.conf.d/20auto-upgrades
You should see both lines ending in "1":
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
systemctl list-timers apt-daily*
You should see two timers with a time in the NEXT column.
Step 3: Make sure it never restarts by itself#
echo 'Unattended-Upgrade::Automatic-Reboot "false";' | sudo tee /etc/apt/apt.conf.d/99-homeserver
sudo unattended-upgrade --dry-run --debug 2>&1 | tail -5
The dry run pretends to update and shows what it would do. It must finish without errors.
Not everything updates itself
This covers Debian's own packages only. Tailscale updates itself once you run sudo tailscale set --auto-update (after Chapter 14). The AI engine (llama.cpp) and model files from Part 5 never update automatically. Check those yourself every few months.
Step 4: Restart once in a while#
Updates to the kernel (the core of Linux) only take effect after a restart. The server does not restart by itself. Once a month, as part of the health check:
ls /var/run/reboot-required
No such file or directory: nothing to do.- The file exists: restart when convenient with
sudo reboot, wait 2 minutes, then reconnect withssh homeserver.
Seeing what was updated
sudo less /var/log/unattended-upgrades/unattended-upgrades.log (press Q to quit).
Done when: both lines show "1" and the timers are listed.
Next: 12. Firewall