Re: pg on Debian servers

On 11/11/17 13:45, Christoph Berg wrote:
> Re: Magnus Hagander 2017-11-11 <CABUevExt7aLarQ2RE5KP9rRUTQSioAxi5FMq=JJ9neBTbC++OA@mail.gmail.com>
>>> Is there any way that either the package maintainer or a site
>>> administrator/programmer such as myself can mark the Postgres server
>>> packages as "manual upgrade only" or similar? Or since I'm almost certainly
>>> not the first person to be bitten by this, is there a preferred hack in
>>> mitigation?
>>
>>
>> Certainly. Unrelated to PostgreSQL, this is a standard feature in Debian.
>> Commonly used to prevent things like kernel upgrades from happening on the
>> same schedule as others.
>>
>> Basically, you put the package "on hold". See the debian administratino
>> guide at
>> https://debian-administration.org/article/67/Preventing_Debian_Package_Upgrades
> 
> Another thing you can do is preventing package upgrades from
> stopping/starting services by using a policy-rc.d:
> 
> https://jpetazzo.github.io/2013/10/06/policy-rc-d-do-not-start-services-automatically/
> https://people.debian.org/~hmh/invokerc.d-policyrc.d-specification.txt
> 
> However, if you do that, you need to take measures to actually restart
> into the new version manually later.

Thanks Christoph, Magnus and Rob (and anybody else whose contribution 
I've not seen yet :-)

I think that the "preventing upgrades" route is the one to follow, since 
inhibiting the restart would obviously present a risk that something 
loaded dynamically could get out of step. As an at least temporary hack 
I've disabled unattended updates using

# systemctl disable unattended-upgrades.service

This is obviously a system which is deeply isolated from public exposure.

In the general case I'd caution against any attempt to edit the content 
of /etc/init.d on recent versions of Debian, since I've come across at 
least one package that puts a file in there and then ignores both it and 
the associated control in /etc/default.

-- 
Mark Morgan Lloyd
markMLl .AT. telemetry.co .DOT. uk

[Opinions above are the author's, not those of his employers or colleagues]