I prefer mostly Debian based platform, and while I prefer Ansible for most automation, some headless IoT devices that I maintain, I will prefer to have a pull based configuration rather than push based one for security updates. Thus another clear alternative is unattended-upgrades. To install it please go through