unbuntu unattended upgrades

unattended-upgrades.sh

#!/bin/bash
# ============================================================
# Ubuntu Automatic Updates Setup
# Configures unattended-upgrades for homelab use
# Run as root or with sudo: sudo bash setup-auto-updates.sh
# 
# Copyright 2026 https://github.com/kking124 All Rights Reserved
# WARNING: BUILT USING AI
# ============================================================

set -e

# --- Configurable options ---
REBOOT_TIME="04:00"          # Time to auto-reboot if needed (24h format)
AUTOCLEAN_INTERVAL="7"       # Days between apt cache cleans

# ============================================================

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
info()    { echo -e "${GREEN}[INFO]${NC} $1"; }
warn()    { echo -e "${YELLOW}[WARN]${NC} $1"; }
error()   { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

# Must be root
[[ $EUID -ne 0 ]] && error "Please run as root: sudo bash $0"

info "Starting Ubuntu auto-update configuration on $(hostname)..."
echo ""

# ============================================================
# 1. Install packages
# ============================================================
info "Installing unattended-upgrades and update-notifier-common..."
apt-get update -qq
apt-get install -y unattended-upgrades update-notifier-common apt-listchanges > /dev/null
info "Packages installed."
echo ""

# ============================================================
# 2. Enable auto-updates (20auto-upgrades)
# ============================================================
info "Writing /etc/apt/apt.conf.d/20auto-upgrades..."
cat > /etc/apt/apt.conf.d/20auto-upgrades <<EOF
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "${AUTOCLEAN_INTERVAL}";
EOF
info "Done."
echo ""

# ============================================================
# 3. Main unattended-upgrades config (50unattended-upgrades)
# ============================================================
info "Writing /etc/apt/apt.conf.d/50unattended-upgrades..."
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<EOF
// Automatically upgrade packages from these origins
Unattended-Upgrade::Allowed-Origins {
    "\${distro_id}:\${distro_codename}";
    "\${distro_id}:\${distro_codename}-security";
    "\${distro_id}ESMApps:\${distro_codename}-apps-security";
    "\${distro_id}ESM:\${distro_codename}-infra-security";
    // Regular (non-security) updates -- enabled for homelab set-and-forget
    "\${distro_id}:\${distro_codename}-updates";
};

// Never auto-update these packages (add more as needed)
Unattended-Upgrade::Package-Blacklist {
    // "docker-ce";
    // "docker-ce-cli";
};

// Remove unused dependencies after upgrade (like apt autoremove)
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";

// Remove old kernel packages that are no longer needed
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

// Automatically reboot if required after an update
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
Unattended-Upgrade::Automatic-Reboot-Time "${REBOOT_TIME}";

// Send email on errors (leave empty to disable)
// Unattended-Upgrade::Mail "you@example.com";
// Unattended-Upgrade::MailReport "on-change";

// Enable verbose logging
Unattended-Upgrade::Verbose "false";
Unattended-Upgrade::Debug "false";
EOF
info "Done."
echo ""

# ============================================================
# 4. Enable and restart the service
# ============================================================
info "Enabling and starting unattended-upgrades service..."
systemctl enable unattended-upgrades > /dev/null
systemctl restart unattended-upgrades
info "Service running."
echo ""

# ============================================================
# 5. Verify timers are active
# ============================================================
info "Checking APT timers..."
echo ""
systemctl list-timers apt-daily.timer apt-daily-upgrade.timer --no-pager 2>/dev/null || \
    warn "Could not list timers — check manually with: systemctl list-timers"
echo ""

# ============================================================
# 6. Do a dry run to confirm everything works
# ============================================================
info "Running a dry-run to verify configuration (no changes will be made)..."
echo ""
unattended-upgrade --dry-run --verbose 2>&1 | tail -20
echo ""

# ============================================================
# Done
# ============================================================
echo "============================================================"
echo -e "${GREEN}Setup complete on $(hostname)!${NC}"
echo ""
echo "Key settings applied:"
echo "  - Security + regular updates:  ENABLED"
echo "  - Auto-reboot if required:     ENABLED at ${REBOOT_TIME}"
echo "  - Remove unused dependencies:  ENABLED"
echo "  - Remove old kernels:          ENABLED"
echo "  - Cache autoclean every:       ${AUTOCLEAN_INTERVAL} days"
echo ""
echo "Useful commands:"
echo "  Check logs:    tail -f /var/log/unattended-upgrades/unattended-upgrades.log"
echo "  Manual run:    sudo unattended-upgrade --verbose"
echo "  Dry run:       sudo unattended-upgrade --dry-run --verbose"
echo "  Check timers:  systemctl list-timers apt-daily.timer apt-daily-upgrade.timer"
echo "============================================================"