jpmschweitzerandClaude Opus 4.5
bde4386b90
- Add HTTP API to Watchtower for CI/CD triggered updates - Update custom container images to use git.schweitz.internal - Add GITEA_TOKEN env var to scheduler for release cleanup task 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
71 lines
2.2 KiB
YAML
71 lines
2.2 KiB
YAML
version: '3.8'
|
|
|
|
# Watchtower - Automatic Container Updates
|
|
# Phase 4: Optimization & Security
|
|
# Ports: None (runs as background service)
|
|
# GPU: No
|
|
# Storage: None (reads Docker socket)
|
|
|
|
services:
|
|
watchtower:
|
|
image: containrrr/watchtower:latest
|
|
container_name: watchtower
|
|
restart: unless-stopped
|
|
ports:
|
|
- "8070:8080" # HTTP API for triggering updates
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
environment:
|
|
- WATCHTOWER_CLEANUP=true # Remove old images after update
|
|
- WATCHTOWER_SCHEDULE=0 0 4 * * * # Run at 4 AM daily (cron format)
|
|
- TZ=Europe/Amsterdam
|
|
|
|
# HTTP API for CI/CD triggered updates
|
|
- WATCHTOWER_HTTP_API_UPDATE=true
|
|
- WATCHTOWER_HTTP_API_TOKEN=${WATCHTOWER_API_TOKEN}
|
|
- WATCHTOWER_HTTP_API_PERIODIC_POLLS=true # Allow triggering periodic poll via API
|
|
|
|
# Optional: Enable notifications
|
|
# - WATCHTOWER_NOTIFICATIONS=shoutrrr
|
|
# - WATCHTOWER_NOTIFICATION_URL= # Add notification URL (Discord, Slack, etc.)
|
|
|
|
# Optional: Monitor only specific containers
|
|
# - WATCHTOWER_LABEL_ENABLE=true # Only update containers with label com.centurylinklabs.watchtower.enable=true
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pgrep watchtower || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 30s
|
|
networks:
|
|
- docker-dataplane
|
|
|
|
networks:
|
|
docker-dataplane:
|
|
external: true
|
|
name: docker-dataplane
|
|
|
|
# Schedule Format (cron):
|
|
# - 0 0 4 * * * = Daily at 4 AM
|
|
# - 0 0 4 * * SUN = Weekly on Sunday at 4 AM
|
|
# - 0 0 */6 * * * = Every 6 hours
|
|
#
|
|
# Manual Trigger:
|
|
# docker exec watchtower watchtower --run-once
|
|
#
|
|
# HTTP API Trigger (for CI/CD):
|
|
# curl -H "Authorization: Bearer $WATCHTOWER_API_TOKEN" http://localhost:8070/v1/update
|
|
#
|
|
# Exclude Specific Containers:
|
|
# Add label to container: com.centurylinklabs.watchtower.enable=false
|
|
#
|
|
# Monitor Watchtower Activity:
|
|
# docker logs watchtower
|
|
#
|
|
# Security Note:
|
|
# Watchtower has full Docker socket access. Review updates in logs.
|
|
# Consider excluding critical services and updating them manually.
|
|
#
|
|
# Environment Variables (set in Portainer):
|
|
# - WATCHTOWER_API_TOKEN: Secret token for HTTP API authentication
|