infrastructure/coreos-config/plays/services/watchtower/docker-compose.yaml

---
services:
  update:
    image: containrrr/watchtower:latest
    container_name: Watchtower
    privileged: true
    environment:
      DOCKER_CONFIG: /config
      WATCHTOWER_SCHEDULE: 0 42 * * * *
      WATCHTOWER_CLEANUP: 1
      WATCHTOWER_ROLLING_RESTART: 1
      WATCHTOWER_NOTIFICATION_URL: "matrix://{{ watchtower.matrix.user }}:{{ watchtower.matrix.password }}@pantalaimon:8008/?disableTLS=yes{% if watchtower.matrix.options is defined %}&{{ watchtower.matrix.options | join('&') }}{% endif%}"
      WATCHTOWER_NOTIFICATION_REPORT: "true"
      WATCHTOWER_NOTIFICATION_TEMPLATE: |
        {% raw %}
        {{- if .Report -}}
          {{- with .Report -}}
        {{- if ( or .Updated .Failed .Skipped ) -}}
        {% endraw %}
        Updates on {{ inventory_hostname }}{% raw %}
        {{len .Scanned}} Scanned, {{len .Updated}} Updated, {{len .Failed}} Failed
              {{- range .Updated}}
        - {{.Name}} ({{.ImageName}}): {{.CurrentImageID.ShortID}} updated to {{.LatestImageID.ShortID}}
              {{- end -}}
            {{- range .Skipped}}
        - {{.Name}} ({{.ImageName}}): {{.State}}: {{.Error}}
            {{- end -}}
            {{- range .Failed}}
        - {{.Name}} ({{.ImageName}}): {{.State}}: {{.Error}}
            {{- end -}}
          {{- end -}}
          {{- end -}}
        {{- else -}}
          {% endraw %}
        Updates on {{ inventory_hostname }}{% raw %}
        {{range .Entries -}}{{.Message}}{{"\n"}}{{- end -}}
        {{- end -}}{% endraw %}

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /home/core/.docker:/config
    restart: always
    networks:
      - default
      - pantalaimon

networks:
  pantalaimon:
    external: true
...