Written 26 Aug 2026. This is a how-to, not a product card.

Let the computer apply weekly fixes without you

After the weekly two-command habit is boring, you can let the computer apply those same fixes by itself. Skip this until that habit is boring. Don't let it reboot on its own.

unattended-upgrades is the computer applying the weekly fixes without you typing them. Same job as the weekly two commands. The computer does it in the background. A reboot is still yours.

Skip until the weekly habit is boring

Keep the computer updated should already be boring. If you have not run sudo apt update then sudo apt upgrade a couple of weeks in a row, stop. Come back when that habit is dull. A timer will not help a computer you never patch.

What this changes

The computer applies the same fixes as keep the computer updated, in the background, while SSH and Pi-hole stay up. You still look once a week if you want. You still reboot when see if a reboot is needed says yes, or when a kernel line needs it. If the computer reboots itself at 3am, ads come back and SSH drops until it is up. Leave automatic reboot off.

Install the package

From your normal computer, SSH from the couch. Then install the package:

sudo apt install unattended-upgrades

Turn it on so it actually runs:

sudo dpkg-reconfigure --priority=low unattended-upgrades

Choose Yes. That writes the small on switch. If reconfigure is missing, sudo apt install apt-config-auto-update is not the path. Stay on Debian or Ubuntu from what OS to put on the computer.

Keep automatic reboot off

Write a drop-in so you don't hunt comments. This is a small extra settings file, same idea as the SSH drop-in on turn off password login once the key works.

echo 'Unattended-Upgrade::Automatic-Reboot "false";' | sudo tee /etc/apt/apt.conf.d/99-labthrift-no-reboot

The computer can apply the weekly fixes. It will not reboot itself at 3am.

Check it is on

Ask if the job is running:

systemctl is-active unattended-upgrades

It should say active. After a day, you can look quietly in /var/log/unattended-upgrades/. That folder is the log. You don't need a noisy test as the main path. If you want to watch it pretend, optional:

sudo unattended-upgrade --dry-run --debug

That prints a lot. Skip it unless something looks off.

Turn it off if you hate it

You can flip the same switch back. Choose No:

sudo dpkg-reconfigure --priority=low unattended-upgrades

Or stop it and keep it from starting:

sudo systemctl stop unattended-upgrades

sudo systemctl disable unattended-upgrades

The weekly two commands in keep the computer updated are still enough.

What next

The honest weekly look is still keep the computer updated. After a reboot, confirm SSH, ads, and the share: after a reboot, check the computer still does its jobs. If the computer clock is wrong, the job runs at the wrong hour: set the computer clock to your house. If the firewall is not on yet, turn on a simple firewall without locking yourself out. Skip fail2ban. Later is slow down password guesses on SSH. Skip a NAS. Skip opening SSH to the internet.

Skip

• Skip this note if weekly apt is still new.
• Skip automatic reboot.
• Skip fail2ban. Later is slow down password guesses on SSH.
• Skip a new NAS, a new mini PC, and a new switch.
• Skip forwarding port 22 on the router.