Patching a Homelab: Security Updates Automatic, Everything Else on Purpose
A patch policy for ten Debian machines: unattended-upgrades limited to Debian-Security on the containers, an Ansible playbook for the hosts that need a human, and Prometheus metrics that make a missed update visible.