I use one of the maintained forks of watchtower.

I use it to auto update within stable versions for things that are reputable enough to not make breaking changes, so nginx, apache, wireguard, traefik, etc. In over 10 years of running Plex I don’t think I’ve experienced a breaking update in the last 5-7 years at least, so I consider it safe enough. Any other software like Immich that I’m not sure if that’s safe, I keep it behind a vpn and update manually. But for things as big as nginx especially I feel very safe letting it auto update within a major version.

Yeah good call. I keep using an actively maintained fork because I can’t be bothered to switch to another project.

As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low