Thank you for unattended-upgrades!  Something like it has been my main
concern preventing deploying Guix on Internet-facing production
machines.

After using it for a while two things strikes me as useful improvements:

1) Automatically restarting all services.

I manually specified mcron, ntpd and ssh-daemon as the services to
restart, but this is not user friendly.  I just noticed I forgot
syslogd, nscd, guix-daemon and a bunch of others.

Two ideas for improvements, mostly intended as food for discussion:

1.a) Have an option that run 'herd restart X' for all of the running
services, probably except for some well-known system services that do
not have running processes related to them anyway.

I experimented with restarting all services mentioned by 'herd status',
but some do not like to be restarted (maybe this is a separate issue?):

root@hamster ~# herd restart device-mapping-/dev/md1
Service device-mapping-/dev/md1 has been stopped.
Service device-mapping-/dev/md1 could not be started.
root@hamster ~# herd start device-mapping-/dev/md1
Service device-mapping-/dev/md1 could not be started.
herd: failed to start service device-mapping-/dev/md1
root@hamster ~# 

The device was still present and the filesystem on it was mounted.

Further experimentation suggests the following should be excluded:
device-mapping* file-system* root*.

However, restarting some of others (including 'udev' and 'urandom-seed')
restarts almost everything else so it is a bit wasteful.

What do you think of this approach?  It would be a loop doing 'herd
restart X' on the service mentioned by 'herd status' except for some
well-known services.  Naturally, this should not be the default for now,
but require a new unattended-upgrades variable,
e.g. 'services-restart-all' set to true.

1.b)

Look at te running processes on the system, and figure out which
services started each, and restart each such service.  I don't know if
this is easily done.

2) Some upgrades requires a reboot for the effects to take place.  At
least this appears to includes the kernel and the transitive closure of
all libraries and binaries involved in shepherd (pid 1).  Libc upgrades
are probably possible to handle in user-space (except for sheperd) but I
believe other distributions reboot the machine on libc upgrades too.

Unattended-upgrades could be extended with a list of packages that it
should trigger a reboot for when they are upgraded.  Probably this
should also not be the default for now, but require another variable,
e.g., 'reboot-when-needed' set to true.

Btw, Happy holidays!

/Simon