3 ms·

fwiw, we do do https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades for the debian packages - I should have mentioned in the wr

fwiw, we do do https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades for the debian packages - I should have mentioned in the writeup. But it's there are still a few custom things running around which aren't covered by that (e.g. custom python builds with go-faster-stripe decals; security upgrades which require restarts etc), hence needing the manual discipline for checking too. But given we need manual discipline for running & checking vuln scans anyway, not to mention hunting security advisories for deps in synapse, riot, etc, i maintain one of the hardest things here is to have the discipline to keep doing that, especially if you're in a small team and you're stressing about writing software rather than doing sysadmin.

gnufx 8y ago
I wonder what's missing from Debian to automate such things since my automation experience is mainly with RHEL. (I realize it may be partly a question of effort for automation, but it sounds as if that's not the root of it.) Debian can restart processes dependent on updated packages and issue alerts about the need to, and you can automate checking for new releases of things for which you've done package backports. That doesn't finesse reboots for kernel updates and whatever systemd forces on you now, but I assume you can at least have live kernel patching as for the RHEL systems for which I used not to get system time.
marcobarco 8y ago
Why won't you use https://github.com/liske/needrestart https://github.com/liske/needrestart to automatically restart services that need restarting after security upgrades and unattendedupgrades or a cron job for rebooting the whole machine after kernel upgrades/periodically? Shouldn't ansible do all this for you? I heard it's the recommended way for automatic updates and service restarts. Please let me know about this as I'm interested myself.

gnufx 8y ago

I wonder what's missing from Debian to automate such things since my automation experience is mainly with RHEL. (I realize it may be partly a question of effort for automation, but it sounds as if that's not the root of it.) Debian can restart processes dependent on updated packages and issue alerts about the need to, and you can automate checking for new releases of things for which you've done package backports. That doesn't finesse reboots for kernel updates and whatever systemd forces on you now, but I assume you can at least have live kernel patching as for the RHEL systems for which I used not to get system time.

marcobarco 8y ago

Why won't you use https://github.com/liske/needrestart https://github.com/liske/needrestart to automatically restart services that need restarting after security upgrades and unattendedupgrades or a cron job for rebooting the whole machine after kernel upgrades/periodically? Shouldn't ansible do all this for you? I heard it's the recommended way for automatic updates and service restarts. Please let me know about this as I'm interested myself.