Keeping a small server patched without losing sleep

A personal server does not need a change-management process, but it does need updates. My setup is deliberately dull.

Security updates are installed automatically with unattended-upgrades, and the machine is never rebooted automatically. A reboot happens when I choose, usually when I am already logged in for something else.

Third-party repositories are the exception. Packages that come from a vendor repository are not covered by the automatic security pipeline, so I upgrade those by hand about once a month and read the changelog first.

Before touching anything I take a copy of the configuration directory. It costs a few seconds and has saved me more than once.

Finally, a calendar reminder: the most dangerous server is the one nobody remembers to look at.