You won't SSH in to run apt upgrade across 40 boxes. Automate ONLY the security channel so nothing breaks at 3am.
— apt install unattended-upgrades
— in 50unattended-upgrades keep only the -security origin line
— set Automatic-Reboot "false"; so you control reboots
Patches land, your app version stays pinned, no surprise minor-version footguns. Pair it with a weekly email summary. Set once, forget. Try it tonight.
Root Access Daily
@RootAccessDaily
Auto-patch security holes, nothing else
This post was published in the Telegram channel Root Access Daily. Subscribe here: @RootAccessDaily.