kamil/libnovel
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases 162 Wiki Activity

chore(infra): run watchtower via doppler for fresh secrets on restart
All checks were successful
CI / UI (pull_request) Successful in 39s
Details
CI / Backend (pull_request) Successful in 47s
Details

Browse Source 
Mount the host doppler binary into the watchtower container and use it as
the entrypoint so WATCHTOWER_NOTIFICATION_URL and other secrets are fetched
from Doppler each time the container starts, rather than being baked in at
compose-up time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Admin
2026-03-29 21:52:32 +05:00
parent 4b8104f087
commit dd35024d02
2 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docker-compose.yml
View File

@@ -401,15 +401,18 @@ services:
# ─── Watchtower (auto-redeploy custom services on new images) ──────────────── # ─── Watchtower (auto-redeploy custom services on new images) ────────────────
# Only watches services labelled com.centurylinklabs.watchtower.enable=true. # Only watches services labelled com.centurylinklabs.watchtower.enable=true.
# Third-party infra images (minio, pocketbase, meilisearch, etc.) are excluded. # Third-party infra images (minio, pocketbase, meilisearch, etc.) are excluded.
# doppler binary is mounted from the host so watchtower fetches fresh secrets
# on every start (notification URL, credentials) without baking them in.
watchtower: watchtower:
image: containrrr/watchtower:latest image: containrrr/watchtower:latest
restart: unless-stopped restart: unless-stopped
entrypoint: ["doppler", "run", "--"]
command: ["/watchtower", "--label-enable", "--interval", "300", "--cleanup"]
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
command: --label-enable --interval 300 --cleanup - /usr/local/bin/doppler:/usr/local/bin/doppler:ro
environment: environment:
WATCHTOWER_NOTIFICATIONS: "${WATCHTOWER_NOTIFICATIONS}" DOPPLER_TOKEN: "${DOPPLER_TOKEN}"
WATCHTOWER_NOTIFICATION_URL: "${WATCHTOWER_NOTIFICATION_URL}"
DOCKER_API_VERSION: "1.44" DOCKER_API_VERSION: "1.44"
volumes: volumes:

9
homelab/docker-compose.yml
View File

@@ -443,15 +443,18 @@ services:
# ── Watchtower ────────────────────────────────────────────────────────────── # ── Watchtower ──────────────────────────────────────────────────────────────
# Auto-updates runner image when CI pushes a new tag. # Auto-updates runner image when CI pushes a new tag.
# Only watches services with the watchtower label. # Only watches services with the watchtower label.
# doppler binary is mounted from the host so watchtower fetches fresh secrets
# on every start (notification URL, credentials) without baking them in.
watchtower: watchtower:
image: containrrr/watchtower:latest image: containrrr/watchtower:latest
restart: unless-stopped restart: unless-stopped
entrypoint: ["doppler", "run", "--"]
command: ["/watchtower", "--label-enable", "--interval", "300", "--cleanup"]
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
command: --label-enable --interval 300 --cleanup - /usr/local/bin/doppler:/usr/local/bin/doppler:ro
environment: environment:
WATCHTOWER_NOTIFICATIONS: "${WATCHTOWER_NOTIFICATIONS}" DOPPLER_TOKEN: "${DOPPLER_TOKEN}"
WATCHTOWER_NOTIFICATION_URL: "${WATCHTOWER_NOTIFICATION_URL}"
DOCKER_API_VERSION: "1.44" DOCKER_API_VERSION: "1.44"
volumes: volumes: