Archiwa Uncategorized

Debian 13 (Trixie) → Proxmox VE 9 – Installation simplifiée sur un Debian pur

Posted on février 23, 2026février 24, 2026 by soban

Proxmox VE 9 est basé sur Debian 13 (Trixie) et introduit un noyau plus récent, des versions mises à jour de LXC et QEMU ainsi qu’une pile de virtualisation améliorée. Ce guide présente une méthode simplifiée et automatisée pour installer Proxmox VE 9 sur un système Debian 13 propre à l’aide de deux scripts d’installation.

La méthode suit la même approche que mon précédent guide Proxmox 8 sur Debian 12, mais adaptée à Debian 13 et Proxmox VE 9.

Prérequis

Installation fraîche de Debian 13 (Trixie)
Accès root
Connexion Internet

Toutes les commandes doivent être exécutées en tant que root.

Partie 1 – Préparation du système & installation du noyau Proxmox

Téléchargez le premier script :

wget http://soban.pl/bash/install-proxmox9-part1.sh
chmod +x install-proxmox9-part1.sh
./install-proxmox9-part1.sh

wget http://soban.pl/bash/install-proxmox9-part1.sh

chmod +x install-proxmox9-part1.sh

./install-proxmox9-part1.sh

Ce script :

Définit le nom d’hôte et met à jour le fichier /etc/hosts
Installe le trousseau (keyring) d’archives Proxmox (vérifié via SHA512)
Ajoute le dépôt Proxmox VE 9 pour Debian 13
Effectue une mise à niveau complète du système
Installe proxmox-default-kernel
Redémarre le système

Contenu de install-proxmox9-part1.sh

#!/usr/bin/env bash
set -euo pipefail
# Part 1/2: Debian 13 (Trixie) -> Proxmox VE 9
# - sets /etc/hosts
# - adds PVE repo + installs Proxmox archive keyring (verified by SHA512)
# - full-upgrade
# - installs proxmox-default-kernel
# - reboots
log() { echo "[$(date '+%F %T')] $*"; }
die() { echo "ERROR: $*" >&2; exit 1; }
if [[ "$(id -u)" -ne 0 ]]; then
die "Run as root."
fi
log "=== Proxmox VE 9 install (part 1/2) on Debian 13 Trixie ==="
if ! grep -qi 'trixie' /etc/os-release; then
log "WARNING: This does not look like Debian 13 (Trixie). Continue at your own risk."
fi
log "Network interfaces (for reference):"
ip -br -c a || true
CURRENT_HOSTNAME="$(hostname)"
CURRENT_IP="$(hostname -I | awk '{print $1}')"
read -r -p "Hostname for this node [${CURRENT_HOSTNAME}]: " HOSTNAME
HOSTNAME="${HOSTNAME:-$CURRENT_HOSTNAME}"
read -r -p "Primary IP for /etc/hosts [${CURRENT_IP}]: " IPADDR
IPADDR="${IPADDR:-$CURRENT_IP}"
if [[ -z "${HOSTNAME}" || -z "${IPADDR}" ]]; then
die "Hostname/IP cannot be empty."
fi
log "Setting hostname to: ${HOSTNAME}"
hostnamectl set-hostname "${HOSTNAME}"
log "Backing up /etc/hosts -> /etc/hosts.backup"
cp -a /etc/hosts /etc/hosts.backup
log "Writing /etc/hosts (makes hostname resolvable locally)"
cat > /etc/hosts <<EOT
127.0.0.1       localhost
${IPADDR}       ${HOSTNAME}
# IPv6
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
EOT
log "Installing prerequisites"
apt update
apt install -y wget ca-certificates gnupg
log "Installing Proxmox archive keyring to /usr/share/keyrings/proxmox-archive-keyring.gpg"
KEYRING="/usr/share/keyrings/proxmox-archive-keyring.gpg"
wget -q https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg -O "${KEYRING}"
log "Verifying SHA512 of keyring"
EXPECTED_SHA512="8678f2327c49276615288d7ca11e7d296bc8a2b96946fe565a9c81e533f9b15a5dbbad210a0ad5cd46d361ff1d3c4bac55844bc296beefa4f88b86e44e69fa51"
ACTUAL_SHA512="$(sha512sum "${KEYRING}" | awk '{print $1}')"
if [[ "${ACTUAL_SHA512}" != "${EXPECTED_SHA512}" ]]; then
die "Keyring SHA512 mismatch!
Expected: ${EXPECTED_SHA512}
Actual:   ${ACTUAL_SHA512}"
fi
log "Adding Proxmox VE 9 no-subscription repo (Trixie)"
cat > /etc/apt/sources.list.d/pve-install-repo.list <<EOT
deb [arch=amd64 signed-by=/usr/share/keyrings/proxmox-archive-keyring.gpg] http://download.proxmox.com/debian/pve trixie pve-no-subscription
EOT
log "Updating + full-upgrade"
apt update
apt full-upgrade -y
log "Installing Proxmox kernel meta-package: proxmox-default-kernel"
apt install -y proxmox-default-kernel
log "Part 1 done. Rebooting now. After reboot run: ./install-proxmox9-part2.sh"
reboot

#!/usr/bin/env bash

set -euo pipefail

# Part 1/2: Debian 13 (Trixie) -> Proxmox VE 9

# - sets /etc/hosts

# - adds PVE repo + installs Proxmox archive keyring (verified by SHA512)

# - full-upgrade

# - installs proxmox-default-kernel

# - reboots

log() { echo "[$(date '+%F %T')] $*"; }

die() { echo "ERROR: $*" >&2; exit 1; }

if [[ "$(id -u)" -ne 0 ]]; then

die "Run as root."

log "=== Proxmox VE 9 install (part 1/2) on Debian 13 Trixie ==="

if ! grep -qi 'trixie' /etc/os-release; then

log "WARNING: This does not look like Debian 13 (Trixie). Continue at your own risk."

log "Network interfaces (for reference):"

ip -br -c a || true

CURRENT_HOSTNAME="$(hostname)"

CURRENT_IP="$(hostname -I | awk '{print $1}')"

read -r -p "Hostname for this node [${CURRENT_HOSTNAME}]: " HOSTNAME

HOSTNAME="${HOSTNAME:-$CURRENT_HOSTNAME}"

read -r -p "Primary IP for /etc/hosts [${CURRENT_IP}]: " IPADDR

IPADDR="${IPADDR:-$CURRENT_IP}"

if [[ -z "${HOSTNAME}" || -z "${IPADDR}" ]]; then

die "Hostname/IP cannot be empty."

log "Setting hostname to: ${HOSTNAME}"

hostnamectl set-hostname "${HOSTNAME}"

log "Backing up /etc/hosts -> /etc/hosts.backup"

cp -a /etc/hosts /etc/hosts.backup

log "Writing /etc/hosts (makes hostname resolvable locally)"

cat > /etc/hosts <<EOT

127.0.0.1 localhost

${IPADDR} ${HOSTNAME}

# IPv6

::1 localhost ip6-localhost ip6-loopback

ff02::1 ip6-allnodes

ff02::2 ip6-allrouters

EOT

log "Installing prerequisites"

apt update

apt install -y wget ca-certificates gnupg

log "Installing Proxmox archive keyring to /usr/share/keyrings/proxmox-archive-keyring.gpg"

KEYRING="/usr/share/keyrings/proxmox-archive-keyring.gpg"

wget -q https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg -O "${KEYRING}"

log "Verifying SHA512 of keyring"

EXPECTED_SHA512="8678f2327c49276615288d7ca11e7d296bc8a2b96946fe565a9c81e533f9b15a5dbbad210a0ad5cd46d361ff1d3c4bac55844bc296beefa4f88b86e44e69fa51"

ACTUAL_SHA512="$(sha512sum "${KEYRING}" | awk '{print $1}')"

if [[ "${ACTUAL_SHA512}" != "${EXPECTED_SHA512}" ]]; then

die "Keyring SHA512 mismatch!

Expected: ${EXPECTED_SHA512}

Actual: ${ACTUAL_SHA512}"

log "Adding Proxmox VE 9 no-subscription repo (Trixie)"

cat > /etc/apt/sources.list.d/pve-install-repo.list <<EOT

deb [arch=amd64 signed-by=/usr/share/keyrings/proxmox-archive-keyring.gpg] http://download.proxmox.com/debian/pve trixie pve-no-subscription

EOT

log "Updating + full-upgrade"

apt update

apt full-upgrade -y

log "Installing Proxmox kernel meta-package: proxmox-default-kernel"

apt install -y proxmox-default-kernel

log "Part 1 done. Rebooting now. After reboot run: ./install-proxmox9-part2.sh"

reboot

Partie 2 – Installation de Proxmox VE 9

Après le redémarrage, téléchargez et exécutez :

wget http://soban.pl/bash/install-proxmox9-part2.sh
chmod +x install-proxmox9-part2.sh
./install-proxmox9-part2.sh

wget http://soban.pl/bash/install-proxmox9-part2.sh

chmod +x install-proxmox9-part2.sh

./install-proxmox9-part2.sh

Contenu de install-proxmox9-part2.sh

#!/usr/bin/env bash
set -euo pipefail
# Part 2/2: Debian 13 (Trixie) -> Proxmox VE 9
# - verifies running PVE kernel (unless FORCE=1)
# - installs proxmox-ve + required packages
# - removes Debian kernel packages (keeps pve)
# - updates grub
# - removes os-prober
# - prints URL to GUI
log() { echo "[$(date '+%F %T')] $*"; }
die() { echo "ERROR: $*" >&2; exit 1; }
FORCE="${FORCE:-0}"
if [[ "$(id -u)" -ne 0 ]]; then
die "Run as root."
fi
log "=== Proxmox VE 9 install (part 2/2) ==="
KERNEL="$(uname -r || true)"
if ! echo "${KERNEL}" | grep -qi 'pve'; then
if [[ "${FORCE}" != "1" ]]; then
die "You are NOT running a PVE kernel (uname -r: ${KERNEL}).
Reboot and select the Proxmox kernel first.
If you really want to continue anyway: FORCE=1 ./install-proxmox9-part2.sh"
else
log "WARNING: Continuing despite not running PVE kernel because FORCE=1"
fi
else
log "OK: running PVE kernel: ${KERNEL}"
fi
log "Update package lists"
apt update
log "Install Proxmox VE packages"
# postfix is optional but commonly installed by docs; choose config during prompts
DEBIAN_FRONTEND=readline apt install -y proxmox-ve postfix open-iscsi chrony
log "Upgrade remaining packages"
apt full-upgrade -y
log "Removing Debian kernel meta-package and non-PVE kernels (best-effort)"
# Remove Debian meta kernel (keeps proxmox kernel)
apt remove -y linux-image-amd64 || true
# Purge any installed linux-image-* that is NOT a pve kernel
mapfile -t KPKGS < <(dpkg -l | awk '/^ii  linux-image-/{print $2}' | grep -vE 'pve|proxmox' || true)
if (( ${#KPKGS[@]} > 0 )); then
log "Purging non-PVE kernel packages: ${KPKGS[*]}"
apt purge -y "${KPKGS[@]}" || true
fi
log "Update grub"
update-grub || true
log "Remove os-prober (recommended for servers; avoids odd grub side effects)"
apt remove -y os-prober || true
log "Done. Proxmox UI should be available at:"
IP="$(hostname -I | awk '{print $1}')"
echo "https://${IP}:8006"
log "Login: root + your root password"

#!/usr/bin/env bash

set -euo pipefail

# Part 2/2: Debian 13 (Trixie) -> Proxmox VE 9

# - verifies running PVE kernel (unless FORCE=1)

# - installs proxmox-ve + required packages

# - removes Debian kernel packages (keeps pve)

# - updates grub

# - removes os-prober

# - prints URL to GUI

log() { echo "[$(date '+%F %T')] $*"; }

die() { echo "ERROR: $*" >&2; exit 1; }

FORCE="${FORCE:-0}"

if [[ "$(id -u)" -ne 0 ]]; then

die "Run as root."

log "=== Proxmox VE 9 install (part 2/2) ==="

KERNEL="$(uname -r || true)"

if ! echo "${KERNEL}" | grep -qi 'pve'; then

if [[ "${FORCE}" != "1" ]]; then

die "You are NOT running a PVE kernel (uname -r: ${KERNEL}).

Reboot and select the Proxmox kernel first.

If you really want to continue anyway: FORCE=1 ./install-proxmox9-part2.sh"

else

log "WARNING: Continuing despite not running PVE kernel because FORCE=1"

else

log "OK: running PVE kernel: ${KERNEL}"

log "Update package lists"

apt update

log "Install Proxmox VE packages"

# postfix is optional but commonly installed by docs; choose config during prompts

DEBIAN_FRONTEND=readline apt install -y proxmox-ve postfix open-iscsi chrony

log "Upgrade remaining packages"

apt full-upgrade -y

log "Removing Debian kernel meta-package and non-PVE kernels (best-effort)"

# Remove Debian meta kernel (keeps proxmox kernel)

apt remove -y linux-image-amd64 || true

# Purge any installed linux-image-* that is NOT a pve kernel

mapfile -t KPKGS < <(dpkg -l | awk '/^ii linux-image-/{print $2}' | grep -vE 'pve|proxmox' || true)

if (( ${#KPKGS[@]} > 0 )); then

log "Purging non-PVE kernel packages: ${KPKGS[*]}"

apt purge -y "${KPKGS[@]}" || true

log "Update grub"

update-grub || true

log "Remove os-prober (recommended for servers; avoids odd grub side effects)"

apt remove -y os-prober || true

log "Done. Proxmox UI should be available at:"

IP="$(hostname -I | awk '{print $1}')"

echo "https://${IP}:8006"

log "Login: root + your root password"

Accès à l’interface Web

Après avoir terminé le second script, ouvrez :

https://YOUR_SERVER_IP:8006

1	https://YOUR_SERVER_IP:8006

Connectez-vous avec l’utilisateur root et votre mot de passe root. Vous pouvez voir un avertissement de certificat — c’est normal pour une installation récente.

Dépannage – erreur 401 Unauthorized (dépôt pve-enterprise)

Si après l’installation ou lors de l’exécution de apt update vous obtenez l’erreur suivante :

Err:8 https://enterprise.proxmox.com/debian/pve trixie InRelease
401  Unauthorized [IP: 2001:41d0:b00:5900::34 443]
Error: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/trixie/InRelease  401  Unauthorized
Error: The repository 'https://enterprise.proxmox.com/debian/pve trixie InRelease' is not signed.
Notice: Updating from such a repository can't be done securely, and is therefore disabled by default.

Err:8 https://enterprise.proxmox.com/debian/pve trixie InRelease

401 Unauthorized [IP: 2001:41d0:b00:5900::34 443]

Error: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/trixie/InRelease 401 Unauthorized

Error: The repository 'https://enterprise.proxmox.com/debian/pve trixie InRelease' is not signed.

Notice: Updating from such a repository can't be done securely, and is therefore disabled by default.

Cela signifie que le dépôt enterprise est activé, mais que votre système ne dispose pas d’un abonnement Proxmox valide. Dans ce guide, nous utilisons le dépôt pve-no-subscription, il est donc nécessaire de désactiver le dépôt enterprise.

Corrigez le problème en exécutant :

mv /etc/apt/sources.list.d/pve-enterprise.sources \
/etc/apt/sources.list.d/pve-enterprise.sources.disabled
apt update

mv /etc/apt/sources.list.d/pve-enterprise.sources \

/etc/apt/sources.list.d/pve-enterprise.sources.disabled

apt update

Après cela, la mise à jour devrait s’exécuter correctement :

apt update && apt dist-upgrade -y && apt autoremove -y

1	apt update && apt dist-upgrade -y && apt autoremove -y

Si tout est correctement configuré, vous verrez le message :

All packages are up to date.

Conclusion

Cette méthode offre une manière propre et contrôlée de déployer Proxmox VE 9 directement sur Debian 13 sans utiliser l’installateur ISO. Elle est particulièrement utile pour les environnements automatisés, les laboratoires et les configurations d’infrastructure personnalisées.

Proxmox Mises à jour automatiques des VM (qm + vzdump) avec tests réseau et restauration automatique

Posted on janvier 23, 2026janvier 23, 2026 by soban

Dans cet article, je présente un script simple (mais très efficace) pour automatiser les mises à jour des machines virtuelles sur Proxmox VE. Le script peut :

créer une sauvegarde de la VM (optionnel),
démarrer la VM si elle était arrêtée au départ,
effectuer une mise à niveau complète via apt et redémarrer la VM,
lancer des tests réseau avant et après la mise à jour,
restaurer automatiquement depuis la sauvegarde en cas de problème (optionnel),
éteindre la VM à la fin si elle était initialement arrêtée.

Où télécharger le script

Vous pouvez télécharger le script directement depuis mon site :

soban.pl/bash/upgrade_proxmox_qm.sh

Dossiers requis

Avant de lancer l’automatisation, créez deux dossiers : un pour les scripts et un pour les logs :

mkdir -p /root/automate_scripts /root/logs

1	mkdir -p /root/automate_scripts /root/logs

Installer le script

Téléchargez le script dans /root/automate_scripts/ et rendez-le exécutable :

cd /root/automate_scripts
curl -fsSL -o upgrade_proxmox_qm.sh "https://soban.pl/bash/upgrade_proxmox_qm.sh"
chmod +x /root/automate_scripts/upgrade_proxmox_qm.sh

cd /root/automate_scripts

curl -fsSL -o upgrade_proxmox_qm.sh "https://soban.pl/bash/upgrade_proxmox_qm.sh"

chmod +x /root/automate_scripts/upgrade_proxmox_qm.sh

Comment ça marche (version courte)

D’abord, une sauvegarde est créée (vzdump snapshot + zstd) si l’option est activée.
Si la VM était en état stopped, le script la démarre et attend WAIT_TIME secondes.
Ensuite, le script exécute des tests réseau AVANT la mise à jour :
Le script exécute apt update/upgrade/dist-upgrade/autoremove/clean puis redémarre la VM (reboot).
Après le redémarrage, il attend à nouveau (WAIT_TIME) et relance les tests APRÈS la mise à jour.
Si les tests échouent et qu’une sauvegarde est disponible, la VM est restaurée automatiquement via qmrestore.
Enfin, la VM est arrêtée si elle était initialement arrêtée.

Lancer le script manuellement

Le script attend exactement deux arguments :

VMID – l’ID de la VM dans Proxmox
TIME_SEC – le temps d’attente après démarrage/redémarrage (en secondes)

/root/automate_scripts/upgrade_proxmox_qm.sh 901 500

1	/root/automate_scripts/upgrade_proxmox_qm.sh 901 500

Astuce : adaptez WAIT_TIME au temps réel de démarrage de la VM et à la durée de la mise à jour. En pratique, 300 à 1000 secondes fonctionnent très bien selon la VM.

Script complet (référence)

Ci-dessous, le script complet (code et commentaires restent en anglais) :

#!/bin/bash
WAIT_TIME=$2  # wait time for VM start/restart (in seconds)
DO_BACKUP="y" # 'y' - create backup, 'n' - skip backup
DO_UPDATE="y" # 'y' - run system update, 'n' - skip update
echo "---------------START---------------"
date
echo "-----------------------------------"
# Argument check
if [ "$#" -ne 2 ]; then
echo "Usage: $0 <VMID> <TIME_SEC>"
exit 1
fi
VMID="$1"
TARGET_HOSTNAME=$(/usr/sbin/qm list | grep -w "$VMID" | awk '{print $2}')
VM_STATUS=$(/usr/sbin/qm status "$VMID" | awk '{print $2}')
HOST_MACHINE=$(hostname)
WAS_STOPPED=0
if [ "$VM_STATUS" = "stopped" ]; then
WAS_STOPPED=1
else
WAS_STOPPED=0
fi
# Create backup if DO_BACKUP is set to 'y'
backup_result="Backup not attempted"
if [ "$DO_BACKUP" = "y" ]; then
echo "Creating backup for VM $VMID..."
BACKUP_OUTPUT=$(/usr/bin/vzdump "$VMID" --storage local --mode snapshot --compress zstd)
BACKUP_FILE=$(echo "$BACKUP_OUTPUT" | grep -oP 'vzdump-qemu-[^\s]+' | tr -d "'")
if [ -z "$BACKUP_FILE" ]; then
echo "Backup failed: No backup file created."
backup_result="Backup created: NOK"
exit 1
else
echo "Backup created successfully: $BACKUP_FILE"
backup_result="Backup created: OK"
fi
else
echo "Backup not attempted (backup is disabled)."
fi
# Start VM if it was originally stopped
if [ "$WAS_STOPPED" -eq 1 ]; then
echo "Starting VM $VMID for update..."
/usr/sbin/qm start "$VMID"
echo "Waiting $WAIT_TIME seconds for VM to start..."
sleep "$WAIT_TIME"
fi
# Test functions
perform_ping_test() {
source="$1"
target="$2"
if ssh root@"$source" "ping -c 3 -W 2 $target" >/dev/null 2>&1; then
echo "Ping from $source to $target: OK"
return 0
else
echo "Ping from $source to $target: NOK"
return 1
fi
}
test_curl() {
source="$1"
target="$2"
if ssh root@"$source" "curl -s --head --connect-timeout 5 $target" >/dev/null 2>&1; then
echo "Curl from $source to $target: OK"
return 0
else
echo "Curl from $source to $target: NOK"
return 1
fi
}
perform_local_ping_test() {
source="$1"
target="$2"
if ping -c 3 -W 2 "$target" >/dev/null 2>&1; then
echo "Ping from $source to $target: OK"
return 0
else
echo "Ping from $source to $target: NOK"
return 1
fi
}
DEFAULT_GW=$(/sbin/ip route | grep default | awk '{print $3}')
perform_tests() {
status=0
perform_local_ping_test "$HOST_MACHINE" "$TARGET_HOSTNAME" || status=1
perform_ping_test "$TARGET_HOSTNAME" "8.8.8.8" || status=1
perform_ping_test "$TARGET_HOSTNAME" "$DEFAULT_GW" || status=1
test_curl "$TARGET_HOSTNAME" "http://google.com" || status=1
return ${status:-0}
}
# General tests before update
echo "--- General tests BEFORE update ---"
if perform_tests; then
echo "All network tests before update: OK"
echo "$backup_result"
if [ "$backup_result" == "Backup created: OK" ] || [ "$backup_result" == "Backup not attempted" ]; then
echo "BEFORE status: OK"
else
echo "BEFORE status: NOK"
fi
else
echo "Some network tests before update: NOK"
echo "$backup_result"
echo "BEFORE status: NOK"
[ "$WAS_STOPPED" -eq 1 ] && /usr/sbin/qm shutdown "$VMID"
exit 1
fi
echo "-----------------------------------"
# System update and reboot
update_result="Upgrade system: NOK"
if [ "$DO_UPDATE" = "y" ]; then
echo "--- Updating VM $VMID ---"
if ssh root@"$TARGET_HOSTNAME" "/usr/bin/apt update && \
/usr/bin/apt upgrade -y && \
/usr/bin/apt dist-upgrade -y && \
/usr/bin/apt autoremove -y && \
/usr/bin/apt autoclean && \
/usr/bin/apt clean && \
/usr/bin/apt --purge autoremove && \
/sbin/reboot"; then
echo "---END Updating VM $VMID ---"
echo "Upgrade system: OK"
update_result="Upgrade system: OK"
else
echo "Upgrade system: NOK"
update_result="Upgrade system: NOK"
[ "$WAS_STOPPED" -eq 1 ] && /usr/sbin/qm shutdown "$VMID"
echo "Update failed. Exiting."
exit 1
fi
fi
# Wait for VM reboot if update was performed
if [ "$DO_UPDATE" = "y" ]; then
echo "Waiting $WAIT_TIME seconds for VM to reboot..."
sleep "$WAIT_TIME"
fi
# Tests after reboot if update was performed
if [ "$DO_UPDATE" = "y" ]; then
echo "--- Network tests AFTER update ---"
if perform_tests; then
echo "All network tests after update: OK"
echo "$update_result"
echo "AFTER status: OK"
else
echo "Some network tests after update: NOK"
echo "$update_result"
echo "Attempting to restore from backup..."
if [ "$DO_BACKUP" = "y" ]; then
/usr/sbin/qm stop "$VMID"
/usr/sbin/qmrestore "/var/lib/vz/dump/$BACKUP_FILE" "$VMID" --force
if [ "$WAS_STOPPED" -eq 1 ]; then
/usr/sbin/qm shutdown "$VMID"
fi
echo "Restore attempt finished. Please check VM status."
echo "AFTER status: NOK"
else
echo "No backup available for restoration. The VM might not function properly after failed update."
echo "AFTER status: NOK"
fi
fi
echo "-----------------------------------"
fi
# Shut down VM if it was originally stopped
if [ "$WAS_STOPPED" -eq 1 ]; then
echo "Shutting down VM $VMID (originally stopped)."
/usr/sbin/qm shutdown "$VMID"
fi
echo "---------------END---------------"
date
echo "-----------------------------------"

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

#!/bin/bash

WAIT_TIME=$2 # wait time for VM start/restart (in seconds)

DO_BACKUP="y" # 'y' - create backup, 'n' - skip backup

DO_UPDATE="y" # 'y' - run system update, 'n' - skip update

echo "---------------START---------------"

date

echo "-----------------------------------"

# Argument check

if [ "$#" -ne 2 ]; then

echo "Usage: $0 <VMID> <TIME_SEC>"

exit 1

VMID="$1"

TARGET_HOSTNAME=$(/usr/sbin/qm list | grep -w "$VMID" | awk '{print $2}')

VM_STATUS=$(/usr/sbin/qm status "$VMID" | awk '{print $2}')

HOST_MACHINE=$(hostname)

WAS_STOPPED=0

if [ "$VM_STATUS" = "stopped" ]; then

WAS_STOPPED=1

else

WAS_STOPPED=0

# Create backup if DO_BACKUP is set to 'y'

backup_result="Backup not attempted"

if [ "$DO_BACKUP" = "y" ]; then

echo "Creating backup for VM $VMID..."

BACKUP_OUTPUT=$(/usr/bin/vzdump "$VMID" --storage local --mode snapshot --compress zstd)

BACKUP_FILE=$(echo "$BACKUP_OUTPUT" | grep -oP 'vzdump-qemu-[^\s]+' | tr -d "'")

if [ -z "$BACKUP_FILE" ]; then

echo "Backup failed: No backup file created."

backup_result="Backup created: NOK"

exit 1

else

echo "Backup created successfully: $BACKUP_FILE"

backup_result="Backup created: OK"

else

echo "Backup not attempted (backup is disabled)."

# Start VM if it was originally stopped

if [ "$WAS_STOPPED" -eq 1 ]; then

echo "Starting VM $VMID for update..."

/usr/sbin/qm start "$VMID"

echo "Waiting $WAIT_TIME seconds for VM to start..."

sleep "$WAIT_TIME"

# Test functions

perform_ping_test() {

source="$1"

target="$2"

if ssh root@"$source" "ping -c 3 -W 2 $target" >/dev/null 2>&1; then

echo "Ping from $source to $target: OK"

return 0

else

echo "Ping from $source to $target: NOK"

return 1

}

test_curl() {

source="$1"

target="$2"

if ssh root@"$source" "curl -s --head --connect-timeout 5 $target" >/dev/null 2>&1; then

echo "Curl from $source to $target: OK"

return 0

else

echo "Curl from $source to $target: NOK"

return 1

}

perform_local_ping_test() {

source="$1"

target="$2"

if ping -c 3 -W 2 "$target" >/dev/null 2>&1; then

echo "Ping from $source to $target: OK"

return 0

else

echo "Ping from $source to $target: NOK"

return 1

}

DEFAULT_GW=$(/sbin/ip route | grep default | awk '{print $3}')

perform_tests() {

status=0

perform_local_ping_test "$HOST_MACHINE" "$TARGET_HOSTNAME" || status=1

perform_ping_test "$TARGET_HOSTNAME" "8.8.8.8" || status=1

perform_ping_test "$TARGET_HOSTNAME" "$DEFAULT_GW" || status=1

test_curl "$TARGET_HOSTNAME" "http://google.com" || status=1

return ${status:-0}

}

# General tests before update

echo "--- General tests BEFORE update ---"

if perform_tests; then

echo "All network tests before update: OK"

echo "$backup_result"

if [ "$backup_result" == "Backup created: OK" ] || [ "$backup_result" == "Backup not attempted" ]; then

echo "BEFORE status: OK"

else

echo "BEFORE status: NOK"

else

echo "Some network tests before update: NOK"

echo "$backup_result"

echo "BEFORE status: NOK"

[ "$WAS_STOPPED" -eq 1 ] && /usr/sbin/qm shutdown "$VMID"

exit 1

echo "-----------------------------------"

# System update and reboot

update_result="Upgrade system: NOK"

if [ "$DO_UPDATE" = "y" ]; then

echo "--- Updating VM $VMID ---"

if ssh root@"$TARGET_HOSTNAME" "/usr/bin/apt update && \

/usr/bin/apt upgrade -y && \

/usr/bin/apt dist-upgrade -y && \

/usr/bin/apt autoremove -y && \

/usr/bin/apt autoclean && \

/usr/bin/apt clean && \

/usr/bin/apt --purge autoremove && \

/sbin/reboot"; then

echo "---END Updating VM $VMID ---"

echo "Upgrade system: OK"

update_result="Upgrade system: OK"

else

echo "Upgrade system: NOK"

update_result="Upgrade system: NOK"

[ "$WAS_STOPPED" -eq 1 ] && /usr/sbin/qm shutdown "$VMID"

echo "Update failed. Exiting."

exit 1

# Wait for VM reboot if update was performed

if [ "$DO_UPDATE" = "y" ]; then

echo "Waiting $WAIT_TIME seconds for VM to reboot..."

sleep "$WAIT_TIME"

# Tests after reboot if update was performed

if [ "$DO_UPDATE" = "y" ]; then

echo "--- Network tests AFTER update ---"

if perform_tests; then

echo "All network tests after update: OK"

echo "$update_result"

echo "AFTER status: OK"

else

echo "Some network tests after update: NOK"

echo "$update_result"

echo "Attempting to restore from backup..."

if [ "$DO_BACKUP" = "y" ]; then

/usr/sbin/qm stop "$VMID"

/usr/sbin/qmrestore "/var/lib/vz/dump/$BACKUP_FILE" "$VMID" --force

if [ "$WAS_STOPPED" -eq 1 ]; then

/usr/sbin/qm shutdown "$VMID"

echo "Restore attempt finished. Please check VM status."

echo "AFTER status: NOK"

else

echo "No backup available for restoration. The VM might not function properly after failed update."

echo "AFTER status: NOK"

echo "-----------------------------------"

# Shut down VM if it was originally stopped

if [ "$WAS_STOPPED" -eq 1 ]; then

echo "Shutting down VM $VMID (originally stopped)."

/usr/sbin/qm shutdown "$VMID"

echo "---------------END---------------"

date

echo "-----------------------------------"

Cron (planning hebdomadaire + logs séparés par VM)

Voici un exemple de crontab : une VM différente est mise à jour chaque jour de la semaine, et les logs sont enregistrés dans des fichiers séparés sous /root/logs/.

Modifier le crontab root :

crontab -e

1	crontab -e

Collez les règles ci-dessous (les commentaires restent en anglais) :

15 0 * * 1 /root/automate_scripts/upgrade_proxmox_qm.sh 901 500 > /root/logs/kali.log 2>&1                 # Monday: upgrade Kali Linux (VMID 901)
15 0 * * 2 /root/automate_scripts/upgrade_proxmox_qm.sh 903 500 > /root/logs/proxmox-test-01.log 2>&1      # Tuesday: upgrade proxmox-test-01 (VMID 903)
15 0 * * 3 /root/automate_scripts/upgrade_proxmox_qm.sh 904 500 > /root/logs/ubuntu-lte.log 2>&1           # Wednesday: upgrade ubuntu-lte (VMID 904)
15 0 * * 4 /root/automate_scripts/upgrade_proxmox_qm.sh 905 1000 > /root/logs/backup-machine.log 2>&1      # Thursday: upgrade backup-machine (VMID 905)

15 0 * * 1 /root/automate_scripts/upgrade_proxmox_qm.sh 901 500 > /root/logs/kali.log 2>&1 # Monday: upgrade Kali Linux (VMID 901)

15 0 * * 2 /root/automate_scripts/upgrade_proxmox_qm.sh 903 500 > /root/logs/proxmox-test-01.log 2>&1 # Tuesday: upgrade proxmox-test-01 (VMID 903)

15 0 * * 3 /root/automate_scripts/upgrade_proxmox_qm.sh 904 500 > /root/logs/ubuntu-lte.log 2>&1 # Wednesday: upgrade ubuntu-lte (VMID 904)

15 0 * * 4 /root/automate_scripts/upgrade_proxmox_qm.sh 905 1000 > /root/logs/backup-machine.log 2>&1 # Thursday: upgrade backup-machine (VMID 905)

Vérifications rapides / Dépannage

Assurez-vous que root peut se connecter en SSH depuis l’hôte Proxmox vers la VM (le script utilise ssh root@<vm-hostname>).
Vérifiez que DNS (ou /etc/hosts) résout correctement le hostname de la VM sur l’hôte Proxmox.
Si apt demande des confirmations, configurez des mises à niveau non interactives ou bloquez les paquets problématiques.

Voilà ! Déposez le script dans /root/automate_scripts/, envoyez les journaux dans /root/logs/, et la maintenance hebdomadaire de votre machine virtuelle devient quasiment automatique.

Dell WD19/WD19S : mise à jour du firmware sur Proxmox/Debian sans timeouts USB (fwupd + correctif autosuspend)

Posted on janvier 18, 2026janvier 18, 2026 by soban

Si vous essayez de mettre à jour le firmware d’une station d’accueil Dell WD19/WD19S sur Proxmox (ou Debian) via fwupdmgr, vous pouvez tomber sur l’erreur classique Operation timed out pendant l’étape Erasing…. En pratique, la mise à jour échoue à cause de la gestion d’énergie USB (autosuspend). Ci-dessous, vous trouverez un correctif simple et efficace, ainsi qu’un script prêt à l’emploi à lancer sur un serveur ou un ordinateur portable.

Symptômes

Le plus souvent, pendant la mise à jour du firmware du dock (WD19/WD19S), vous verrez une erreur similaire à :

failed to write-firmware: failed to erase bank: failed after 5 retries: failed to SetReport: USB error: Operation timed out [-7]

1	failed to write-firmware: failed to erase bank: failed after 5 retries: failed to SetReport: USB error: Operation timed out [-7]

À ce stade, fwupdmgr peut afficher le périphérique WD19S en Update State: Failed ou continuer à indiquer pending activation, mais le flash ne se termine jamais complètement.

Pourquoi cela arrive-t-il ?

Pendant le flash, le dock effectue des opérations longues. Si le système tente d’économiser de l’énergie sur l’USB (autosuspend), les transferts de contrôle USB peuvent échouer. Résultat : un timeout exactement lors de l’effacement de la banque de firmware (erase bank).

Correctif rapide : désactiver l’autosuspend USB pendant la mise à jour

La solution la plus simple consiste à définir temporairement l’autosuspend à -1 (désactivé). Ce paramètre reste actif jusqu’au redémarrage (sauf si vous le rendez permanent via la cmdline du noyau), mais cela suffit largement le temps de la mise à jour.

echo -1 > /sys/module/usbcore/parameters/autosuspend

1	echo -1 > /sys/module/usbcore/parameters/autosuspend

Ensuite, lancez la mise à jour :

fwupdmgr refresh --force
fwupdmgr update

1 2	fwupdmgr refresh --force fwupdmgr update

Après la mise à jour : “pending activation” et nécessité de débrancher le câble

Après une installation réussie du firmware pour WD19/WD19S, fwupdmgr affiche souvent le message suivant :

The update will continue when the device USB cable has been unplugged.
WD19S is pending activation; use fwupdmgr activate to complete the update.

1 2	The update will continue when the device USB cable has been unplugged. WD19S is pending activation; use fwupdmgr activate to complete the update.

Procédez dans cet ordre précis :

Débranchez le câble USB-C du dock (côté ordinateur).
(Optionnel) Débranchez l’alimentation du dock pendant 10–15 secondes, puis rebranchez-la.
Rebranchez le câble USB-C.
Lancez l’activation :

fwupdmgr activate

1	fwupdmgr activate

Enfin, vérifiez le statut :

fwupdmgr get-updates
fwupdmgr get-devices | less

1 2	fwupdmgr get-updates fwupdmgr get-devices \| less

Script prêt à l’emploi : installation + mise à jour + désactivation autosuspend (avec restauration)

Ci-dessous, un script prêt à l’emploi qui :

installe fwupd
rafraîchit les métadonnées LVFS
désactive temporairement l’autosuspend USB (pour éviter les timeouts sur WD19S)
lance les mises à jour du firmware
restaure ensuite la valeur précédente d’autosuspend (même en cas d’échec)

Vous pouvez copier le script directement depuis cet article, mais si vous préférez aller plus vite, vous pouvez le télécharger ici :

https://soban.pl/bash/dell_updage.sh

Exemple de téléchargement et d’exécution :

cd /root/scripts
curl -fsSL https://soban.pl/bash/dell_updage.sh -o dell_updage.sh
chmod +x dell_updage.sh
./dell_updage.sh

cd /root/scripts

curl -fsSL https://soban.pl/bash/dell_updage.sh -o dell_updage.sh

chmod +x dell_updage.sh

./dell_updage.sh

Si vous voulez prévisualiser le script avant de l’exécuter :

curl -fsSL https://soban.pl/bash/dell_updage.sh | less

1	curl -fsSL https://soban.pl/bash/dell_updage.sh \| less

Si less n’est pas installé :

apt update
apt install -y less

1 2	apt update apt install -y less

Script (contenu complet)

#!/bin/bash
set -euo pipefail
# dell upgrade:
# - installs fwupd
# - refreshes metadata
# - runs fwupdmgr update
# - TEMPORARILY disables USB autosuspend to avoid WD19/WD19S timeouts
# - restores autosuspend setting after update
echo "[INFO] Installing fwupd..."
apt update
apt install -y fwupd
echo "[INFO] Refreshing firmware metadata..."
fwupdmgr refresh --force
fwupdmgr get-updates || true
# Save current autosuspend value (if exists)
AUTOSUSPEND_PATH="/sys/module/usbcore/parameters/autosuspend"
OLD_AUTOSUSPEND=""
if [[ -f "$AUTOSUSPEND_PATH" ]]; then
OLD_AUTOSUSPEND="$(cat "$AUTOSUSPEND_PATH" || true)"
echo "[INFO] Current usbcore autosuspend: ${OLD_AUTOSUSPEND}"
else
echo "[WARN] autosuspend sysfs file not found: $AUTOSUSPEND_PATH"
fi
restore_autosuspend() {
if [[ -f "$AUTOSUSPEND_PATH" && -n "${OLD_AUTOSUSPEND}" ]]; then
echo "[INFO] Restoring usbcore autosuspend back to: ${OLD_AUTOSUSPEND}"
echo "${OLD_AUTOSUSPEND}" > "$AUTOSUSPEND_PATH" || true
fi
}
trap restore_autosuspend EXIT
# Disable autosuspend to prevent USB timeout during dock firmware erase/write
if [[ -f "$AUTOSUSPEND_PATH" ]]; then
echo "[INFO] Disabling USB autosuspend (set to -1) to avoid dock update timeouts..."
echo -1 > "$AUTOSUSPEND_PATH"
fi
read -p ""Do you want to update the entire device? (y/n): " answer
if [[ "$answer" == "y" || "$answer" == "Y" ]]; then
echo "[INFO] Running fwupdmgr update..."
fwupdmgr update || {
echo "[ERROR] fwupdmgr update failed."
echo "[HINT] If this is Dell dock (WD19/WD19S), try: unplug USB-C, replug, then run: fwupdmgr activate"
exit 1
}
echo "[INFO] Update finished."
echo "[INFO] If you updated a Dell dock and it says 'pending activation':"
echo "       1) Unplug USB-C cable from the dock"
echo "       2) (Optional) Unplug dock power for 10 seconds, plug back"
echo "       3) Run: fwupdmgr activate"
else
echo "[INFO] Skipping firmware update."
fi
echo "[INFO] Done."

#!/bin/bash

set -euo pipefail

# dell upgrade:

# - installs fwupd

# - refreshes metadata

# - runs fwupdmgr update

# - TEMPORARILY disables USB autosuspend to avoid WD19/WD19S timeouts

# - restores autosuspend setting after update

echo "[INFO] Installing fwupd..."

apt update

apt install -y fwupd

echo "[INFO] Refreshing firmware metadata..."

fwupdmgr refresh --force

fwupdmgr get-updates || true

# Save current autosuspend value (if exists)

AUTOSUSPEND_PATH="/sys/module/usbcore/parameters/autosuspend"

OLD_AUTOSUSPEND=""

if [[ -f "$AUTOSUSPEND_PATH" ]]; then

OLD_AUTOSUSPEND="$(cat "$AUTOSUSPEND_PATH" || true)"

echo "[INFO] Current usbcore autosuspend: ${OLD_AUTOSUSPEND}"

else

echo "[WARN] autosuspend sysfs file not found: $AUTOSUSPEND_PATH"

restore_autosuspend() {

if [[ -f "$AUTOSUSPEND_PATH" && -n "${OLD_AUTOSUSPEND}" ]]; then

echo "[INFO] Restoring usbcore autosuspend back to: ${OLD_AUTOSUSPEND}"

echo "${OLD_AUTOSUSPEND}" > "$AUTOSUSPEND_PATH" || true

}

trap restore_autosuspend EXIT

# Disable autosuspend to prevent USB timeout during dock firmware erase/write

if [[ -f "$AUTOSUSPEND_PATH" ]]; then

echo "[INFO] Disabling USB autosuspend (set to -1) to avoid dock update timeouts..."

echo -1 > "$AUTOSUSPEND_PATH"

read -p ""Do you want to update the entire device? (y/n): " answer

if [[ "$answer" == "y" || "$answer" == "Y" ]]; then

echo "[INFO] Running fwupdmgr update..."

fwupdmgr update || {

echo "[ERROR] fwupdmgr update failed."

echo "[HINT] If this is Dell dock (WD19/WD19S), try: unplug USB-C, replug, then run: fwupdmgr activate"

exit 1

}

echo "[INFO] Update finished."

echo "[INFO] If you updated a Dell dock and it says 'pending activation':"

echo " 1) Unplug USB-C cable from the dock"

echo " 2) (Optional) Unplug dock power for 10 seconds, plug back"

echo " 3) Run: fwupdmgr activate"

else

echo "[INFO] Skipping firmware update."

echo "[INFO] Done."

Exécuter le script

Le plus simple :

chmod +x dell_updage.sh
./dell_updage.sh

1 2	chmod +x dell_updage.sh ./dell_updage.sh

FAQ & conseils

La mise à jour échoue encore ? Débranchez tous les périphériques du dock (écrans/LAN/USB), ne laissez que l’alimentation et l’USB-C, faites un hard reset (débranchez l’alimentation 30s), puis réessayez.
“pending activation” après la mise à jour – c’est normal pour WD19/WD19S. Vous devez débrancher l’USB-C, rebrancher, puis exécuter fwupdmgr activate.
Est-ce que ça met à jour le BIOS du laptop ? Pas forcément. fwupdmgr liste séparément “System Firmware” (BIOS/UEFI) et le dock. Cet article se concentre sur le dock et le problème de timeout USB.

Résumé

Si la mise à jour du firmware Dell WD19/WD19S échoue sur Proxmox/Debian pendant l’étape Erasing…, il suffit dans la plupart des cas de désactiver temporairement l’autosuspend USB. Le script ci-dessus le fait automatiquement, puis restaure le réglage précédent afin que le système continue de fonctionner normalement.