// Unattended-upgrades policy for NetBird nodes.
//
// Security updates are applied automatically, but the NetBird main packages
// are held back so version changes only happen through the operator's
// scheduled/manual update routine — never silently underneath a running
// service.

Unattended-Upgrade::Package-Blacklist {
    "netbird-server";
    "netbird-dashboard";
    "netbird-s6";
    "netbird-adl";
    "caddy";
};

// Apply security updates automatically.
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
