Feature RequestsVivid Hawk·1 month agoBright Stork·1 month ago
<h1>helloome</h1>·2 months agoWise Snipe·2 months ago
New / Open / Unreviewed
Automatic patching with patch severity filters
It would also be great, if a patch policy would be able to filter for specific patch severity levels. In general I would like to e.g. apply security patches automatically immedeatly while regular updates/bugfixes can go in weekly after review. I think this is a fairly common use-case. And while the later can be done with the current patching mechanic, the automatic security only patching would be a big plus.
5 Comments
VH
Yes! This is what I was after also
BS
please
H
hiii
WS
yes, would also be nice
AI Conversation I had about this:
I want to automate this update process as much as possible/safe. Honestly, I have no clue what causes update problems because I am so new to Linux. A solid set of update rules in Patchmon would be safer as demonstrated by my last update conflicts/failure today. I was thinking we should do it around 10am on Wednesdays and Saturdays so if something breaks I am available to troubleshoot but we should do required restarts late at night (3-4am) when people are sleeping. We could do both late at night but I am concerned my users will wake up before me and the network will be down. I look forward to your thoughts on this process for sure GOAL: Updates done automatically/safely along with reporting, checks and restarts. Write me a plan to do the lower value stuff for sure and possibly the high value stuff.
Searched code, read CUSTOM-ALERT-HUB_AI_ran a command
Short version: a PatchMon policy can’t do this on its own. I read its policy fields live, and they only cover when a patch runs after approval: immediate, a delay in minutes, or a fixed time of day with a time zone. There’s no day of the week, no ordering, no stop-on-failure, no package rules. There are 0 policies today.
What I’d build
Rules for every automatic run
Patch one host at a time, in your group order (apps, Frigate, media, core, hypervisors). Stop everything on the first failure and send one push with the reason.
Run the readiness check first. Anything other than GO means skip that host and say so.
If apt-get update fails, wait 5 minutes and retry up to 3 times before calling it failed. That alone would have saved the pve2 “failure.”
A sweeper marks any run still running after 30 minutes and checks the host with apt-get -s upgrade, so no false “stuck” alarms.
Verify each host after its run, as the 90-second check does today. One summary push goes out when the whole run ends.
A “never automatic” list: Proxmox and kernel packages, docker-ce on the media VM until the gluetun fix is automated, and database major versions. Those wait for you.