The base line i've did this with is ERPNext 12 on Debian 9 with Python 3.5. We use nginx as a reverse proxy frontend with letsencrypt certificates.
We need to upgrade this to ERPNext 12 on Debian 10 with Python 3.7.
First make a snapshot if you are running it in a VM. This makes it much easier to rollback after it fails.
apt-get update apt-get upgrade apt-get dist-upgrade
Do not do an apt-get autoremove because this will remove python 3.5 and this will make the next step hell.