Updates Pipeline

Updates Pipeline

A scheduled workflow that keeps the NAS operating system patched and handles safe reboots.

Trigger

on:
  schedule:
    - cron: '0 2 * * 2'   # Every Tuesday at 02:00 UTC
  workflow_dispatch:        # Manual trigger available

Runs automatically every Tuesday at 2am UTC. Can also be triggered manually from the Actions tab.

What It Does

The workflow connects to the NAS (same Azure → KeyVault → WireGuard → SSH pattern as Provisioning) and runs the updates.yml playbook:

Step	Action
1	apt upgrade — full package upgrade
2	Check /var/run/reboot-required — does the kernel need a reboot?
3	If yes → safe reboot (waits 5 min for completion, 30 sec post-reboot delay)

Safe Reboot Logic

The reboot is conditional — it only happens if the system signals that a reboot is required (typically after kernel or systemd updates):

- name: Check if reboot is needed
  stat:
    path: /var/run/reboot-required
  register: reboot_required

- name: Reboot if required
  reboot:
    reboot_timeout: 300
    post_reboot_delay: 30
  when: reboot_required.stat.exists

The 5-minute timeout ensures the workflow doesn't hang forever if the NAS fails to come back. The 30-second post-reboot delay gives services time to fully start before Ansible declares success.

Current Scope

The updates workflow currently only targets the test environment:

matrix:
  environment: [test]

💡 This is intentional — I validate updates on test before manually running against production. The manual workflow_dispatch trigger lets me deploy to production on my terms after confirming test is stable.

Why Tuesday?

No particular reason other than mid-week means:

• Most upstream security patches from the weekend are available
• I have time to notice if something breaks before the weekend
• It avoids Monday (when I might be making other changes)

🔗 Ansible reboot module | Ubuntu unattended-upgrades