50unattended-upgrades.Debian.bookworm 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990
  1. //
  2. // Unattended Upgrades Configuration (Salt managed)
  3. //
  4. // Unattended-Upgrade::Origins-Pattern controls which packages are
  5. // upgraded.
  6. //
  7. // Lines below have the format "keyword=value,...". A
  8. // package will be upgraded only if the values in its metadata match
  9. // all the supplied keywords in a line. (In other words, omitted
  10. // keywords are wild cards.) The keywords originate from the Release
  11. // file, but several aliases are accepted. The accepted keywords are:
  12. // a,archive,suite (eg, "stable")
  13. // c,component (eg, "main", "contrib", "non-free")
  14. // l,label (eg, "Debian", "Debian-Security")
  15. // o,origin (eg, "Debian", "Unofficial Multimedia Packages")
  16. // n,codename (eg, "jessie", "jessie-updates")
  17. // site (eg, "http.debian.net")
  18. // The available values on the system are printed by the command
  19. // "apt-cache policy", and can be debugged by running
  20. // "unattended-upgrades -d" and looking at the log file.
  21. //
  22. // Within lines unattended-upgrades allows 2 macros whose values are
  23. // derived from /etc/debian_version:
  24. // ${distro_id} Installed origin.
  25. // ${distro_codename} Installed codename (eg, "buster")
  26. Unattended-Upgrade::Origins-Pattern {
  27. // Codename based matching:
  28. // This will follow the migration of a release through different
  29. // archives (e.g. from testing to stable and later oldstable).
  30. // Software will be the latest available for the named release,
  31. // but the Debian release itself will not be automatically upgraded.
  32. "origin=Debian,codename=${distro_codename}-updates";
  33. "origin=Debian,codename=${distro_codename}-proposed-updates";
  34. "origin=Debian,codename=${distro_codename},label=Debian";
  35. "origin=Debian,codename=${distro_codename},label=Debian-Security";
  36. "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
  37. // Icigna2
  38. "o=debian icinga-${distro_codename},a=icinga-${distro_codename}";
  39. // SaltStack
  40. "o=SaltStack,a=stable,n=${distro_codename}";
  41. };
  42. // List of packages to not update
  43. Unattended-Upgrade::Package-Blacklist {
  44. "libc6";
  45. "libc6-dev";
  46. "libc6-i686";
  47. "bird";
  48. "fastd";
  49. "batman-adv-dkms";
  50. "ifupdown2";
  51. };
  52. // Send email to this address for problems or packages upgrades
  53. // If empty or unset then no email is sent, make sure that you
  54. // have a working mail setup on your system. A package that provides
  55. // 'mailx' must be installed. E.g. "user@example.com"
  56. Unattended-Upgrade::Mail "root";
  57. // Set this value to "true" to get emails only on errors. Default
  58. // is to always send a mail if Unattended-Upgrade::Mail is set
  59. Unattended-Upgrade::MailOnlyOnError "true";
  60. // Remove unused automatically installed kernel-related packages
  61. // (kernel images, kernel headers and kernel version locked tools).
  62. Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
  63. // Do automatic removal of unused packages after the upgrade
  64. // (equivalent to apt-get autoremove)
  65. Unattended-Upgrade::Remove-Unused-Dependencies "true";
  66. // Do automatic removal of newly unused dependencies after the upgrade
  67. Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
  68. // Automatically reboot *WITHOUT CONFIRMATION* if
  69. // the file /var/run/reboot-required is found after the upgrade
  70. Unattended-Upgrade::Automatic-Reboot "false";
  71. // Enable logging to syslog. Default is False
  72. Unattended-Upgrade::SyslogEnable "true";
  73. // Specify syslog facility. Default is daemon
  74. Unattended-Upgrade::SyslogFacility "daemon";
  75. // Force dpkg to keep any existing configuration file regardless of
  76. // what the package might bring
  77. DPkg::Options:: "--force-confold";