From dd35024d02e1428cc2b9ab6dc9ece07efcf841a9 Mon Sep 17 00:00:00 2001
From: Admin <admin@kalekber.cc>
Date: Sun, 29 Mar 2026 21:52:32 +0500
Subject: [PATCH] chore(infra): run watchtower via doppler for fresh secrets on
 restart

Mount the host doppler binary into the watchtower container and use it as
the entrypoint so WATCHTOWER_NOTIFICATION_URL and other secrets are fetched
from Doppler each time the container starts, rather than being baked in at
compose-up time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 docker-compose.yml         | 9 ++++++---
 homelab/docker-compose.yml | 9 ++++++---
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 30daad3..66fe6a8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -401,15 +401,18 @@ services:
   # ─── Watchtower (auto-redeploy custom services on new images) ────────────────
   # Only watches services labelled com.centurylinklabs.watchtower.enable=true.
   # Third-party infra images (minio, pocketbase, meilisearch, etc.) are excluded.
+  # doppler binary is mounted from the host so watchtower fetches fresh secrets
+  # on every start (notification URL, credentials) without baking them in.
   watchtower:
     image: containrrr/watchtower:latest
     restart: unless-stopped
+    entrypoint: ["doppler", "run", "--"]
+    command: ["/watchtower", "--label-enable", "--interval", "300", "--cleanup"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    command: --label-enable --interval 300 --cleanup
+      - /usr/local/bin/doppler:/usr/local/bin/doppler:ro
     environment:
-      WATCHTOWER_NOTIFICATIONS: "${WATCHTOWER_NOTIFICATIONS}"
-      WATCHTOWER_NOTIFICATION_URL: "${WATCHTOWER_NOTIFICATION_URL}"
+      DOPPLER_TOKEN: "${DOPPLER_TOKEN}"
       DOCKER_API_VERSION: "1.44"
 
 volumes:
diff --git a/homelab/docker-compose.yml b/homelab/docker-compose.yml
index 7b323ad..c70d3c7 100644
--- a/homelab/docker-compose.yml
+++ b/homelab/docker-compose.yml
@@ -443,15 +443,18 @@ services:
   # ── Watchtower ──────────────────────────────────────────────────────────────
   # Auto-updates runner image when CI pushes a new tag.
   # Only watches services with the watchtower label.
+  # doppler binary is mounted from the host so watchtower fetches fresh secrets
+  # on every start (notification URL, credentials) without baking them in.
   watchtower:
     image: containrrr/watchtower:latest
     restart: unless-stopped
+    entrypoint: ["doppler", "run", "--"]
+    command: ["/watchtower", "--label-enable", "--interval", "300", "--cleanup"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    command: --label-enable --interval 300 --cleanup
+      - /usr/local/bin/doppler:/usr/local/bin/doppler:ro
     environment:
-      WATCHTOWER_NOTIFICATIONS: "${WATCHTOWER_NOTIFICATIONS}"
-      WATCHTOWER_NOTIFICATION_URL: "${WATCHTOWER_NOTIFICATION_URL}"
+      DOPPLER_TOKEN: "${DOPPLER_TOKEN}"
       DOCKER_API_VERSION: "1.44"
 
 volumes: