Everything I run, I deploy and manage with ansible.

When I'm building out the role/playbook for a new service, I make sure to build in any special upgrade tasks it might have and tag them. When it's time to run infrastructure-wide updates, I can run my single upgrade playbook and pull in the upgrade tasks for everything everywhere - new packages, container images, git releases, and all the service restart steps to load them.

It's more work at the beginning to set the role/playbook up properly, but it makes maintaining everything so much nicer (which I think is vital to keep it all fun and manageable).

Renovate + GitOps. Check out https://github.com/onedr0p/cluster-template

If you don't like Kubernetes, you can get a similar setup with doco-CD. Only limitation is that dococd can't update itself, but you can use SOPS and Renovate all the same for the other services.

• use APT repositories when possible -> then unattended-upgrades
• For OCI images that do not provide tagged releases (looking at you searxng...), podman auto-update
• for everything else, subscribe to releases RSS feed, read release notes when they come out, check for breaking changes and possibly interesting stuff, update version in ansible playbook, deploy ansible playbook

Since all my services are dockerized I just pull new images sporadically. But I think I should invest some time into finding automatic update reminders, especially when I have to hear about critical security updates from some random person on mastodon.

Wow, that sounds like a nightmare. Here's my workflow:

nix flake update
nixos-rebuild switch

That gives me an atomic, rollbackable update of every service running on the machine.

It’s just a hobby so i know I have room for improvement, but the bigger my environment gets the more difficult it is to keep everything completely up to date, like you said. Given that, my main priorities are:

• have as few internet facing services as possible
• use a reverse proxy
• separate external and internal servers with a dmz
• use fail2ban or crowsec on servers that have ports forwarded
• firewall geoblocking
• BACKUPS, local and remote

Now that being said, I’ve started to use ansible playbooks for deploying OS updates. I have a playbook that uses default options when doing an apt upgrade and it also works for the docker engine user prompt.

About 75% of my services are native installs in LXCs and I try to always install by including the app repo so that apt can update it and the other 25% are in docker. I used to use watchtower but that’s no longer maintained, so I do container updates manually as needed.

It’s not perfect, but it’s just for fun so 🤷

Kubernetes + helm charts

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #233 for this comm, first seen 12th Apr 2026, 05:50] [FAQ] [Full list] [Contact] [Source code]

Proxmox helper scripts - at least the ones i use - come with a tag updateable. Those tagged have a command update that runs everything necessary on containers, VMs whatever.

Makes life simple, mostly.

The only manual interaction I’ve had was upgrading some VMs Debian from 12 to 13.

# nix flake update
# nixos-rebuild switch

Podman automatically updates my containers for me.

Unattended upgrades 11 months out of the year.

Very attended apt upgrades 2 weeks out of the year.

1. Avoid anything with bad supply chains that fail iso27002
2. Yum via cron
3. Huh. That's all of it.