With unattended-upgrades enabled and nothing open to the internet (I run Tailscale to be able to access it when I’m out of the house) I don’t worry too much about mine.

If you use something like Fedora CoreOS, the system keeps itself and all container images updated. And because system upgrades are also just a new immutable image, very little can go wrong.

I have a Nextcloud server running on it and the maintenance is negligible.

During the recent PHP-vulnerability I simply turned it off. The next day I booted it, and it automatically installed the new Nextcloud image with the vulnerability fixed.

Makes me wonder if I could have it check for CVEs and automatically shut down vulnerable containers until updated images are out.

I was just thinking last night about setting up an agent that would daily check in and do a full maintenance scan on a server or a home lab box. Check for operating system upgrades. Schedule them if needed to move from LTS to LTS. Check for CVEs against daemons you know you're running. Stuff like that. I've used agents and harnesses to set up machines before and do system administration tasks, but it feels like you could sort of set it up in a loop and just let it go forever.