We have roughly 20 Windows and Linux servers, and weekend patching is taking too much manual work. OS updates seem manageable, but keeping server applications current is harder.
Would Ansible plus an internal software repository be overkill? We prefer not to depend on community-managed package sources, but that still leaves us finding and packaging updates ourselves.
Ansible sounds reasonable at this size, especially if you already know it. I'd use it to schedule and monitor the work across both platforms, without insisting that Windows and Linux use the same package source.
For Linux, that could mean the distribution's package manager and a controlled repository. For Windows, look at an internal winget source or a commercial package manager. You can start with a few applications rather than building a complete catalog before automating anything.
Separate OS patching from application patching in the plan. Azure Update Manager is one option for the OS side, while applications may need a different process entirely.
The awkward cases are vendor installers that need someone to click through them or don't have a usable silent install option. Allow time to test those rather than assuming every update can go through the same unattended pipeline.
WaffleHouseWindow:
Azure Update Manager is already under consideration for OS updates. The application side is the bigger gap.
Before committing to an internal repository, account for who will find new releases, check them, package them and keep the repository tidy. Hosting the binaries gives you more control, but it doesn't automatically give you an update catalog.
Version pinning and checksum verification can help control downloads, though they don't replace deciding whether you trust the source and its contents. If supply chain risk is the reason for avoiding community packages, write down what checks you need before choosing the tooling.
A dedicated patch management product is worth comparing against the Ansible build. Action1 and Automox were both suggested for mixed Windows and Linux environments, while Chocolatey for Business is an option for the Windows application side.
Check server and application coverage, hosting requirements and renewal pricing before choosing. A cloud-managed tool may not fit your server policy, and a Windows-only package manager still leaves you with a separate Linux solution.
For a small estate, Ansible and a PowerShell Windows Update module are another practical starting point. On Linux, use the native package manager. That lets you automate OS patching without first taking on a full internal application catalog.
Answers are reviewed before publication.
lavender_librarian:
That also keeps the repository choice separate from the orchestration choice. You can change one later without necessarily replacing the other.