Hello,
Merci de ton soutien, il m'aide à avancer, je pense que j'approche de mon objectif.
Les meilleurs explications sur unattended-upgrades que j'ai trouvé sont
là, on trouve aussi une explication sur le
site, mais elle est moins complètes. Si je trouve le temps, je le compléterais.
Ma solution idéale :
Faire automatiquement les mises à jour la nuit.
Pour les upgrate, ne surtout pas changer sauvagement de distribution, pour le reste c'est OK.
Je pense que la configuration que j'ai mise là, fait ce que je cherche.
Si tu veux voir, un second avis m’intéresse beaucoup
EM
PS : Rassures-toi, je fait des backups quotidiens, et j'ai fait celui que tu demandes.
cat /etc/apt/apt.conf.d/10periodic
// Enable the update/upgrade script (0=disable)
APT::Periodic::Enable "1";
// Do "apt-get update" automatically every n-days (0=disable)
APT::Periodic::Update-Package-Lists "1";
// Do "apt-get upgrade --download-only" every n-days (0=disable)
APT::Periodic::Download-Upgradeable-Packages "1";
// Run the "unattended-upgrade" security upgrade script
// every n-days (0=disabled)
// Requires the package "unattended-upgrades" and will write
// a log in /var/log/unattended-upgrades
APT::Periodic::Unattended-Upgrade "1";
// Do "apt-get autoclean" every n-days (0=disable)
APT::Periodic::AutocleanInterval "7";
// - Send report mail to root
// 0: no report (or null string)
// 1: progress report (actually any string)
// 2: + command outputs (remove -qq, remove 2>/dev/null, add -d)
// 3: + trace on
APT::Periodic::Verbose "2";
// sleep for a random interval of time (default 30min)
// paramétré pour se relancer spontanement toutes les 24,1 heures
// il est lancé automatiquement par crontab toutes les 24 heures (pour ne le faire que de nuit )
// voir https://phil.writesthisblog.com/debian-maj-automatique/
APT::Periodic::RandomSleep "90000";
// Automatically upgrade packages from these (origin:archive) pairs
//
// Note that in Ubuntu security updates may pull in new dependencies
// from non-security sources (e.g. chromium). By allowing the release
// pocket these get automatically pulled in.
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}";
"${distro_id}:${distro_codename}-security";
// Extended Security Maintenance; doesn't necessarily exist for
// every release and this system may not have it installed, but if
// available, the policy for updates is such that unattended-upgrades
// should also install from here by default.
"${distro_id}ESMApps:${distro_codename}-apps-security";
"${distro_id}ESM:${distro_codename}-infra-security";
"${distro_id}:${distro_codename}-updates";
// "${distro_id}:${distro_codename}-proposed";
// "${distro_id}:${distro_codename}-backports";
};
// List of packages to not update (regexp are supported)
Unattended-Upgrade::Package-Blacklist {
// "vim";
// "libc6";
// "libc6-dev";
// "libc6-i686";
};
// This option will controls whether the development release of Ubuntu will be
// upgraded automatically.
// ---- Bien sur, surtout pas
Unattended-Upgrade::DevRelease "false";
// This option allows you to control if on a unclean dpkg exit
// unattended-upgrades will automatically run
// dpkg --force-confold --configure -a
// The default is true, to ensure updates keep getting installed
// ---- C'est important d'avoir des versions cohérentes
//Unattended-Upgrade::AutoFixInterruptedDpkg "false";
// Split the upgrade into the smallest possible chunks so that
// they can be interrupted with SIGTERM. This makes the upgrade
// a bit slower but it has the benefit that shutdown while a upgrade
// is running is possible (with a small delay)
// ---- J'en ai pas besoin, mais laissons le défaut
//Unattended-Upgrade::MinimalSteps "false";
// Install all unattended-upgrades when the machine is shutting down
// instead of doing it in the background while the machine is running
// This will (obviously) make shutdown slower
// --- Je choisi de le faire de nuit, donc inutil
//Unattended-Upgrade::InstallOnShutdown "true";
// Send email to this address for problems or packages upgrades
// If empty or unset then no email is sent, make sure that you
// have a working mail setup on your system. A package that provides
// 'mailx' must be installed. E.g. "user@example.com"
Unattended-Upgrade::Mail "log@mail.com";
// Set this value to "true" to get emails only on errors. Default
// is to always send a mail if Unattended-Upgrade::Mail is set
// ---- Laissons le défaut, il est adapté
//Unattended-Upgrade::MailOnlyOnError "true";
// Remove unused automatically installed kernel-related packages
// (kernel images, kernel headers and kernel version locked tools).
//Unattended-Upgrade::Remove-Unused-Kernel-Packages "false";
// Do automatic removal of new unused dependencies after the upgrade
// (equivalent to apt-get autoremove)sites
// ---- Laissons le défaut, il est adapté
//Unattended-Upgrade::Remove-Unused-Dependencies "false";
// Automatically reboot *WITHOUT CONFIRMATION*
// if the file /var/run/reboot-required is found after the upgrade
// ---- Il faudra y penser
Unattended-Upgrade::Automatic-Reboot "false";
// If automatic reboot is enabled and needed, reboot at the specific
// time instead of immediately
// Default: "now"
//Unattended-Upgrade::Automatic-Reboot-Time "04:00";
// Use apt bandwidth limit feature, this example limits the download
// speed to 70kb/sec
// ---- Pas la nuit
//Acquire::http::Dl-Limit "70";
// Enable logging to syslog. Default is False
// ---- un fichier dédié c'est plus facile à vérifier
// Unattended-Upgrade::SyslogEnable "false";
// Specify syslog facility. Default is daemon
// Unattended-Upgrade::SyslogFacility "daemon";
// Download and install upgrades only on AC power
// (i.e. skip or gracefully stop updates on battery)
// Unattended-Upgrade::OnlyOnACPower "true";
// Download and install upgrades only on non-metered connection
// (i.e. skip or gracefully stop updates on a metered connection)
// Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true";
