chore(infra): run watchtower via doppler for fresh secrets on restart

Mount the host doppler binary into the watchtower container and use it as
the entrypoint so WATCHTOWER_NOTIFICATION_URL and other secrets are fetched
from Doppler each time the container starts, rather than being baked in at
compose-up time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -401,15 +401,18 @@ services:
   # ─── Watchtower (auto-redeploy custom services on new images) ────────────────
   # Only watches services labelled com.centurylinklabs.watchtower.enable=true.
   # Third-party infra images (minio, pocketbase, meilisearch, etc.) are excluded.
+  # doppler binary is mounted from the host so watchtower fetches fresh secrets
+  # on every start (notification URL, credentials) without baking them in.
   watchtower:
     image: containrrr/watchtower:latest
     restart: unless-stopped
+    entrypoint: ["doppler", "run", "--"]
+    command: ["/watchtower", "--label-enable", "--interval", "300", "--cleanup"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    command: --label-enable --interval 300 --cleanup
+      - /usr/local/bin/doppler:/usr/local/bin/doppler:ro
     environment:
-      WATCHTOWER_NOTIFICATIONS: "${WATCHTOWER_NOTIFICATIONS}"
-      WATCHTOWER_NOTIFICATION_URL: "${WATCHTOWER_NOTIFICATION_URL}"
+      DOPPLER_TOKEN: "${DOPPLER_TOKEN}"
       DOCKER_API_VERSION: "1.44"
 
 volumes:

homelab/docker-compose.yml

@@ -443,15 +443,18 @@ services:
   # ── Watchtower ──────────────────────────────────────────────────────────────
   # Auto-updates runner image when CI pushes a new tag.
   # Only watches services with the watchtower label.
+  # doppler binary is mounted from the host so watchtower fetches fresh secrets
+  # on every start (notification URL, credentials) without baking them in.
   watchtower:
     image: containrrr/watchtower:latest
     restart: unless-stopped
+    entrypoint: ["doppler", "run", "--"]
+    command: ["/watchtower", "--label-enable", "--interval", "300", "--cleanup"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    command: --label-enable --interval 300 --cleanup
+      - /usr/local/bin/doppler:/usr/local/bin/doppler:ro
     environment:
-      WATCHTOWER_NOTIFICATIONS: "${WATCHTOWER_NOTIFICATIONS}"
-      WATCHTOWER_NOTIFICATION_URL: "${WATCHTOWER_NOTIFICATION_URL}"
+      DOPPLER_TOKEN: "${DOPPLER_TOKEN}"
       DOCKER_API_VERSION: "1.44"
 
 volumes: