Unattended upgrades that actually reboot at night
Every Debian box I run has unattended-upgrades. Half of them had been waiting for a reboot for months, because the default is to install the kernel and then politely do nothing.
The two lines that matter in /etc/apt/apt.conf.d/50unattended-upgrades:
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:30";On the NAS I leave the reboot off, because a reboot in the middle of a backup is worse than an old kernel for a week. There I get an email instead and do it by hand on a Sunday.
Check that the systemd timer is really on: systemctl list-timers apt-daily-upgrade. On one cloud image it was masked and nothing had been updated since the image was built. That was an unpleasant afternoon.