ok... ok... I'll add it to git...

stacks/watchtower.yml

@@ -0,0 +1,43 @@
+version: '3.8'
+
+# Watchtower - Automatic Container Updates
+# Phase 4: Optimization & Security
+# Ports: None (runs as background service)
+# GPU: No
+# Storage: None (reads Docker socket)
+
+services:
+  watchtower:
+    image: containrrr/watchtower:latest
+    container_name: watchtower
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - WATCHTOWER_CLEANUP=true  # Remove old images after update
+      - WATCHTOWER_SCHEDULE=0 0 4 * * *  # Run at 4 AM daily (cron format)
+      - TZ=Europe/Amsterdam
+      # Optional: Enable notifications
+      # - WATCHTOWER_NOTIFICATIONS=shoutrrr
+      # - WATCHTOWER_NOTIFICATION_URL=  # Add notification URL (Discord, Slack, etc.)
+
+      # Optional: Monitor only specific containers
+      # - WATCHTOWER_LABEL_ENABLE=true  # Only update containers with label com.centurylinklabs.watchtower.enable=true
+
+# Schedule Format (cron):
+# - 0 0 4 * * * = Daily at 4 AM
+# - 0 0 4 * * SUN = Weekly on Sunday at 4 AM
+# - 0 0 */6 * * * = Every 6 hours
+#
+# Manual Trigger:
+# docker exec watchtower watchtower --run-once
+#
+# Exclude Specific Containers:
+# Add label to container: com.centurylinklabs.watchtower.enable=false
+#
+# Monitor Watchtower Activity:
+# docker logs watchtower
+#
+# Security Note:
+# Watchtower has full Docker socket access. Review updates in logs.
+# Consider excluding critical services and updating them manually.