aptmatic 🤖📦

Because SSHing into 40 servers one by one to run apt-get upgrade is a cry for help.

A snappy terminal UI for wrangling apt across a fleet of Debian/Ubuntu hosts — written in Rust, because I don't know how to code in OCaml.

╭─ aptmatic ──────────────────────────────────────────────────────╮
│ Hosts          │Detail                                          │
│ ▸ webservers   │web1.example.com                                │
│    ● web1  [2] │user: ubuntu  port: 22  sudo: true              │
│    ● web2      │                                                │
│ ▸ databases    │Status: 2 upgrade(s) available (1 security)     │
│    ⠼ db1       │                                                │
│    ● db2       │Kernel                                          │
│                │Running: 6.1.0-28-amd64                         │
│                │Latest:  linux-image-6.1.0-32-amd64 ← reboot    │
│                │                                                │
│                │Upgradable                                      │
│                │[sec] curl (7.88.1-10 → 7.88.1-10+deb12u8)      │
│                │      libcurl4 (7.88.1-10 → 7.88.1-10+deb12u8)  │
╰─────────────────────────────────────────────────────────────────╯
 r:update+refresh  R:refresh all  u:upgrade  U:upgrade all
 f:full-upgrade  F:full-upgrade all  s:sec-upgrade  S:sec-upgrade all
 a:autoremove  A:autoremove all  p:purge-rc  c:config files  b:reboot
 t:task output  z:zoom  /:search  q:quit

Features

• 🖥️ Multi-host dashboard — see every host's status at a glance
• 👥 Groups — organise hosts and trigger actions on a whole group at once
• 🔑 SSH native — talks directly to each host over SSH, no agents or daemons required
• 🌀 Live task output — watch apt-get upgrade scroll by in real time
• 🐧 Kernel tracking — know which hosts are silently waiting for a reboot
• 📦 Held/kept-back packages — spot the stragglers and why they're stuck
• 🛡️ Security-update badge — upgradable packages from a security suite are called out separately, with a key to upgrade just those
• 🔍 Sidebar search — / to filter hosts/groups by name in a big fleet
• 💾 Cached last-known state — the dashboard isn't blank on startup while it reconnects
• 🚦 Bounded connection concurrency — "all hosts" actions queue instead of opening a connection per host at once
• 🧹 RC package purging — one key to purge all those half-removed ghosts
• 📝 Pending config files — upgrades never stop to ask about a changed conffile; the new version is counted per host and reviewed later, with a diff, on your schedule
• ⬆️ Full-upgrade & autoremove — apt-get full-upgrade and apt-get autoremove --purge, on selected hosts or the whole fleet
• 🔁 Confirmed reboot — type the hostname to confirm before a host goes down
• 🖱️ Draggable divider — because you deserve to customise your own TUI
• 🦀 Written in Rust — guaranteed* to have no bugs

* guarantee void where prohibited by logic

Installation

cargo install aptmatic

Or build from source:

cargo build --release
# binary at ./target/release/aptmatic

Configuration

aptmatic looks for its config at ~/.config/aptmatic.toml by default. Pass -c /path/to/config.toml to override.

[defaults]
user = "ubuntu"
port = 22
use_sudo = true

[[groups]]
name = "webservers"

[[groups.hosts]]
hostname = "web1.example.com"

[[groups.hosts]]
hostname = "web2.example.com"
user = "admin"   # override per-host

[[groups]]
name = "databases"

[[groups.hosts]]
hostname = "db1.example.com"

Keybindings

The sidebar divider is also mouse-draggable if you're feeling fancy.

Pending config files

Upgrades run with --force-confdef --force-confold, so dpkg never stops to ask what to do about a config file you've edited — it keeps yours and drops the maintainer's version next to it as .dpkg-dist. Hosts carrying unresolved files show a [n cfg] badge in the sidebar; c opens a review pane listing them with a diff against the live file. Mark each file with a decision, then execute the whole batch in one go:

Marking is free — nothing happens on the host until you confirm with Enter then y. Unmarked files are left pending for a later review, and a failure on one file doesn't stop the rest of the batch. Applying a config file does not restart anything — restart the affected service yourself once you're happy with it.

While searching, type to filter, ↑/↓ to jump between matches, Enter/Esc to stop editing (the filter stays applied — clear it by backspacing to empty).

Actions on a whole group or "all hosts" are queued through a small connection pool (8 at a time) rather than opening an SSH connection per host simultaneously.

Development

just build   # build
just fmt     # format
just lint    # fmt check + clippy

Why?

Managing a modest fleet of Linux boxes with apt should not require an orchestration platform, a PhD in Ansible, or accepting a cookie banner. aptmatic is a single binary, a TOML file, and a spare SSH key away from a good time.