# ansible / maintenance / debian

Automate System Updates safely and cleanly

A streamlined playbook to keep your Debian/Ubuntu hosts patched. It updates the apt cache, performs a distribution upgrade, and automatically prunes orphaned dependencies.

Read the playbook →Jump to verification

$ apt list --upgradable✓

OutputListing... Done

StatusAll packages are up to date.

Autoremove0 to remove, 0 not upgraded.

dist-upgrade

strategy

apt

module

2 tasks

playbook

# overview

Why this playbook holds up

Routine maintenance shouldn't require logging into every server manually. By leveraging Ansible's native `apt` module, you ensure uniform patch levels across your entire fleet while keeping the disk clear of stale packages.

safe upgrades

Smart Dependency Handling

Using dist upgrade intelligently handles changing dependencies with new versions of packages, preventing held packages and broken states.

housekeeping

Built-in Autoremove

Automatically cleans up libraries and dependencies that were installed with previous software but are no longer needed, freeing up disk space.

# playbook

The full task list

update.ymlYAML

1 2 3 4 5 6 7 8 9 10 11 12 13

---
- name: System update and cleanup
  hosts: localhost
  become: yes
  tasks:
    - name: Update apt cache and upgrade all packages
      apt:
        upgrade: dist
        update_cache: yes

    - name: Remove unused dependencies
      apt:
        autoremove: yes

Run order

sync & patch
Refreshes the local repository cache and upgrades all installed packages to their latest versions.
apt, update_cache + dist
sweep
Identifies and removes orphaned dependencies left behind by the upgraded packages.
apt, autoremove

# verify

Confirm the host is clean

To verify the playbook did its job, you can run a dry-run check on the host to ensure no pending upgrades or leftover packages remain.

terminal

$ apt list --upgradable

Listing... Done

$ apt autoremove --dry-run

Reading package lists... Done

Building dependency tree... Done

Reading state information... Done

0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

# notes

Lessons from running this in production

WARN

This playbook does not check if a system reboot is required (e.g., after a kernel update). You may want to register a handler checking for /var/run/reboot-required.

INFO

Using upgrade: dist is safer for major patching than standard upgrade, as it resolves complex dependency changes natively.

This playbook is perfectly idempotent. Running it against an already-updated server will exit quickly with zero changes.