dpkg-reconfigure unattended-upgrades
will create a minimal config file, '/etc/apt/apt.conf.d/20auto-upgrades' that may be all you need. But, you might consider adding something like below to cleanup downloaded package files: // Auto cleanup archives
APT::Periodic::MaxAge "10";
// Setting minage too is a good idea to prevent race conditions
APT::Periodic::MinAge "8";
Or, if you prefer (but, this will delete all archives present when it triggers and not just old ones like above): APT::Periodic::AutocleanInterval "10";
(Note: I'm assuming Raspbian is the same as the upstream Debian; I've never used Raspbian)> We build packages in package groups, to take into account separate packages that need to be upgraded together. Once the whole group has been built, we run a virtualized test suite to make sure none of our core components and developer workflows are broken. Each group is tested separately with a full system installation, boot and local test suite run on that version of the operating system.
> We then proceed to carefully guide this release to the fleet utilizing SRE principles like incremental canarying and monitoring the fleet health.
But if your using it for server tasks, your probably better off actually running Debian. Although if your looking for something that is closer to a rolling release, you could just pick one of the distro's that have a release policy that strikes your fancy WRT how they roll out new packages/etc. Most distro's have rpi specific images, or you just install their generic arm64 images on top of something like the PFTF firmware.
Put another way, raspberry pi os, has a fairly dated kernel/etc but works well with all the hardware on the machine for desktop purposes. If your using it as a server, its not a good choice because they frequently don't have useful things turned on (various filesystems, networking options, RAID levels, etc). The core storage/networking/cpu/etc type of things have been working quite well in mainline/etc for a couple years now, so that has trickled down into all these distros.
I have configured unattended-upgrades (the package from apt) on a Raspberry Pi on Raspbian 10, but no security updates seem to ever be released. Is there a gotcha Iām missing resp. is there a better way of configuring an always-on computer and keep it secure?