Check out https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/

You can have a small rpi or similar on your WiFi in a hidden location on a UPS, so the main computer can’t boot without the tang server accessible.

Did you know that you’re allowed to write all the letters in the word F-U-C-K on the internet?

Aren’t the defaults set by your distro?

That’s a good way to think about it, actually. Thanks for sharing

It does make establishing a critical mass of comments to make a good discussion difficult. I’ve had it once or twice where I discovered a post in one community commented and didn’t get any replies, only to discover some other discussion on the same content happened elsewhere on the fediverse that I wasn’t subscribed to.

To actually answer your question, you need some kind of job scheduling service that manages the whole operation. Whether that’s SSM or Ansible or something else. With Ansible, you can set a parallel parameter that will say that you only update 3 or so at a time until they are all done. If one of those upgrades fails, then it will abort the process. There’s a parameter to make it die if any host fails, but I don’t recall it right now.