version: '3.8'

# Watchtower - Automatic Container Updates
# Phase 4: Optimization & Security
# Ports: None (runs as background service)
# GPU: No
# Storage: None (reads Docker socket)

services:
  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_CLEANUP=true  # Remove old images after update
      - WATCHTOWER_SCHEDULE=0 0 4 * * *  # Run at 4 AM daily (cron format)
      - TZ=Europe/Amsterdam
      # Optional: Enable notifications
      # - WATCHTOWER_NOTIFICATIONS=shoutrrr
      # - WATCHTOWER_NOTIFICATION_URL=  # Add notification URL (Discord, Slack, etc.)

      # Optional: Monitor only specific containers
      # - WATCHTOWER_LABEL_ENABLE=true  # Only update containers with label com.centurylinklabs.watchtower.enable=true
    networks:
      - docker-dataplane

networks:
  docker-dataplane:
    external: true
    name: docker-dataplane

# Schedule Format (cron):
# - 0 0 4 * * * = Daily at 4 AM
# - 0 0 4 * * SUN = Weekly on Sunday at 4 AM
# - 0 0 */6 * * * = Every 6 hours
#
# Manual Trigger:
# docker exec watchtower watchtower --run-once
#
# Exclude Specific Containers:
# Add label to container: com.centurylinklabs.watchtower.enable=false
#
# Monitor Watchtower Activity:
# docker logs watchtower
#
# Security Note:
# Watchtower has full Docker socket access. Review updates in logs.
# Consider excluding critical services and updating them manually.