How often should you reboot a production webserver?
Specifically, a dedicated server running Debian 12.
After a monthly sudo apt upgrade? (Is a monthly upgrade even necessary?)
Never? (unless there is a security update?)
Edit: I may be missing kernel upgrades. Those are probably good... I can't remember if I installed a LTS kernel. I imagine it would be unsecure to post an exact kernel version, however.
If this is a big site that experiences a lot of traffic, You should already have more than a single Web server anyway. If this is a website for a school or an organization, You really should have a load balancer and a couple web notes. In that situation upgrading and rebooting, draining traffic and bringing it back in, is fairly trivial.
If this is a home server, where you're the only real user, just reboot it.
Some distros like Ubuntu are better about fixing the security issues without requiring rebooting, but if it's a home web server the uptime is really not important.