Written 26 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

Let the leftover box apply weekly fixes without you

After the weekly two-command habit is boring, you can let the leftover box apply those same fixes by itself. Skip this until that habit is boring. Do not let it reboot on its own.

unattended-upgrades is the leftover box applying the weekly fixes without you typing them. Same job as the weekly two commands. The leftover box does it in the background. A reboot is still yours.

Skip until the weekly habit is boring

Keep the leftover box updated should already be boring. If you have not run sudo apt update then sudo apt upgrade a couple of weeks in a row, stop. Come back when that habit is dull. A timer will not help a leftover box you never patch.

What this changes

The leftover box applies the same fixes as keep the leftover box updated, in the background, while SSH and Pi-hole stay up. You still look once a week if you want. You still reboot when a kernel line needs it. If the leftover box reboots itself at 3am, ads come back and SSH drops until it is up. Leave automatic reboot off.

Install the package

From your normal computer, SSH from the couch. Then install the package:

sudo apt install unattended-upgrades

Turn it on so it actually runs:

sudo dpkg-reconfigure --priority=low unattended-upgrades

Choose Yes. That writes the small on switch. If reconfigure is missing, sudo apt install apt-config-auto-update is not the path. Stay on the Debian or Ubuntu leftover box from what OS to put on the leftover box.

Keep automatic reboot off

Write a drop-in so you do not hunt comments. This is a small extra settings file, same idea as the SSH drop-in on turn off leftover-box password login once the key works.

echo 'Unattended-Upgrade::Automatic-Reboot "false";' | sudo tee /etc/apt/apt.conf.d/99-labthrift-no-reboot

The leftover box can apply the weekly fixes. It will not reboot itself at 3am.

Check it is on

Ask if the job is running:

systemctl is-active unattended-upgrades

It should say active. After a day, you can look quietly in /var/log/unattended-upgrades/. That folder is the log. You do not need a noisy test as the main path. If you want to watch it pretend, optional:

sudo unattended-upgrade --dry-run --debug

That prints a lot. Skip it unless something looks off.

Turn it off if you hate it

You can flip the same switch back. Choose No:

sudo dpkg-reconfigure --priority=low unattended-upgrades

Or stop it and keep it from starting:

sudo systemctl stop unattended-upgrades

sudo systemctl disable unattended-upgrades

The weekly two commands in keep the leftover box updated are still enough.

What next

The honest weekly look is still keep the leftover box updated. If the leftover box clock is wrong, the job runs at the wrong hour: set the leftover box clock to your house. If the firewall is not on yet, turn on a simple firewall without locking yourself out. Skip fail2ban. Skip a NAS. Skip opening SSH to the internet.

Skip

• Skip this note if weekly apt is still new.
• Skip automatic reboot.
• Skip fail2ban.
• Skip a new NAS, a new mini PC, and a new switch.
• Skip forwarding port 22 on the router.