Updated: 3 November 2026 · Applies to: ansible-core, tested with the apt, stat and reboot modules
Ansible's built in apt module updates the package cache and upgrades every package on a Debian or Ubuntu host, and the built in reboot module can reboot that host afterward and wait for it to come back, so you can automate a full patch and reboot cycle across many servers at once.
Update the apt cache
Running apt-get update by hand on one server looks like this:
apt-get update
The same thing as an Ansible task, refreshing the cache only if it is older than one hour:
- name: Update apt cache
apt:
update_cache: true
cache_valid_time: 3600
cache_valid_time is in seconds, so 3600 means one hour. Setting it already implies update_cache: true since Ansible 2.4, but it is still clearer to write both.
Upgrade every installed package
- name: Upgrade all apt packages
apt:
upgrade: dist
force_apt_get: true
upgrade: dist is the equivalent of apt-get dist-upgrade: every package is brought up to its latest available version, including ones that need other packages installed or removed to satisfy new dependencies. force_apt_get: true tells the module to use apt-get directly rather than aptitude, even if aptitude happens to be installed on the target.
Check whether the host needs a reboot
On Debian and Ubuntu, the file /var/run/reboot-required exists only when a package update, usually a kernel update, needs a reboot to take effect. Check for it and save the result in a variable:
- name: Check if a reboot is needed
stat:
path: /var/run/reboot-required
register: reboot_required_file
Reboot only when needed
Use the saved variable as a condition on the reboot module, so a host that does not need rebooting is simply skipped:
- name: Reboot if required
reboot:
msg: "Reboot triggered by Ansible after a package update"
connect_timeout: 5
reboot_timeout: 300
pre_reboot_delay: 0
post_reboot_delay: 30
test_command: uptime
when: reboot_required_file.stat.exists
Ansible stops and waits here: it disconnects, waits up to reboot_timeout seconds for the host to come back, then runs test_command and only continues once that command succeeds, so the next task in your playbook never runs against a host that has not finished rebooting.
A minimal inventory for this playbook
Create a hosts file:
vi hosts
With content similar to this, naming your own servers under [servers]:
[all:vars] ansible_user=ubuntu ansible_become=yes ansible_become_method=sudo ansible_python_interpreter=/usr/bin/env python3 [servers] web1.example.com web2.example.com web3.example.com
Run the playbook against every host in that group the normal way:
ansible-playbook -i hosts update-and-reboot.yml
Having trouble keeping Ubuntu or Debian servers patched and rebooted with Ansible? Our experts can help, available 24/7.
