feat: enable Watchtower HTTP API and use internal registry

- Add HTTP API to Watchtower for CI/CD triggered updates
- Update custom container images to use git.schweitz.internal
- Add GITEA_TOKEN env var to scheduler for release cleanup task

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

stacks/core-api.yml

@@ -5,11 +5,11 @@ version: '3.8'
 # Port: 8083 (HTTP API)
 # Network: docker-dataplane (shared infrastructure network)
 #
-# Container image built from: tower-of-joy:3002/jpmschweitzer/core-api (internal registry)
+# Container image built from: git.schweitz.internal/jpmschweitzer/core-api (internal registry)
 
 services:
   core-api:
-    image: tower-of-joy:3002/jpmschweitzer/core-api:latest
+    image: git.schweitz.internal/jpmschweitzer/core-api:latest
     container_name: core-api
     restart: unless-stopped
 

stacks/library-desk.yml

@@ -4,11 +4,11 @@ version: '3.8'
 # Application Layer
 # Port: 8089 (HTTP)
 # GPU: No
-# Source: tower-of-joy:3002/jpmschweitzer/library-desk (internal registry)
+# Source: git.schweitz.internal/jpmschweitzer/library-desk (internal registry)
 
 services:
   library-desk:
-    image: tower-of-joy:3002/jpmschweitzer/library-desk:latest
+    image: git.schweitz.internal/jpmschweitzer/library-desk:latest
     container_name: library-desk
     restart: unless-stopped
     ports:

stacks/scheduler.yml

@@ -4,11 +4,11 @@ version: '3.8'
 # Purpose: System-wide maintenance orchestration - backups, doc mirroring, cleanup, task automation
 # Port: 8090 (API + UI)
 # Network: docker-dataplane
-# Image: tower-of-joy:3002/jpmschweitzer/scheduler (internal registry)
+# Image: git.schweitz.internal/jpmschweitzer/scheduler (internal registry)
 
 services:
   scheduler:
-    image: tower-of-joy:3002/jpmschweitzer/scheduler:latest
+    image: git.schweitz.internal/jpmschweitzer/scheduler:latest
     container_name: scheduler
     restart: unless-stopped
 
@@ -35,6 +35,7 @@ services:
       - GITEA_PASSWORD=${GITEA_LIBRARY_PASSWORD}
       - GITEA_SSH_HOST=gitea
       - GITEA_SSH_PORT=22
+      - GITEA_TOKEN=${GITEA_TOKEN}
       - BACKUP_RETENTION_DAILY=7
       - BACKUP_RETENTION_WEEKLY=4
       - BACKUP_RETENTION_MONTHLY=12

stacks/tatlock.yml

@@ -4,11 +4,11 @@ version: '3.8'
 # Purpose: OpenAI-compatible API server with LLM agent orchestration
 # Port: 8000 (API)
 # Network: docker-dataplane
-# Image: tower-of-joy:3002/jpmschweitzer/tatlock (internal registry)
+# Image: git.schweitz.internal/jpmschweitzer/tatlock (internal registry)
 
 services:
   tatlock:
-    image: tower-of-joy:3002/jpmschweitzer/tatlock:latest
+    image: git.schweitz.internal/jpmschweitzer/tatlock:latest
     container_name: tatlock
     restart: unless-stopped
 

stacks/watchtower.yml

@@ -11,12 +11,20 @@ services:
     image: containrrr/watchtower:latest
     container_name: watchtower
     restart: unless-stopped
+    ports:
+      - "8070:8080"  # HTTP API for triggering updates
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
     environment:
       - WATCHTOWER_CLEANUP=true  # Remove old images after update
       - WATCHTOWER_SCHEDULE=0 0 4 * * *  # Run at 4 AM daily (cron format)
       - TZ=Europe/Amsterdam
+
+      # HTTP API for CI/CD triggered updates
+      - WATCHTOWER_HTTP_API_UPDATE=true
+      - WATCHTOWER_HTTP_API_TOKEN=${WATCHTOWER_API_TOKEN}
+      - WATCHTOWER_HTTP_API_PERIODIC_POLLS=true  # Allow triggering periodic poll via API
+
       # Optional: Enable notifications
       # - WATCHTOWER_NOTIFICATIONS=shoutrrr
       # - WATCHTOWER_NOTIFICATION_URL=  # Add notification URL (Discord, Slack, etc.)
@@ -45,6 +53,9 @@ networks:
 # Manual Trigger:
 # docker exec watchtower watchtower --run-once
 #
+# HTTP API Trigger (for CI/CD):
+# curl -H "Authorization: Bearer $WATCHTOWER_API_TOKEN" http://localhost:8070/v1/update
+#
 # Exclude Specific Containers:
 # Add label to container: com.centurylinklabs.watchtower.enable=false
 #
@@ -54,3 +65,6 @@ networks:
 # Security Note:
 # Watchtower has full Docker socket access. Review updates in logs.
 # Consider excluding critical services and updating them manually.
+#
+# Environment Variables (set in Portainer):
+# - WATCHTOWER_API_TOKEN: Secret token for HTTP API authentication