Drop bundled Watchtower; rely on the host's global Watchtower

ripper already runs a single global nickfedor/watchtower (label-enabled) that watches every stack; the bundled containrrr/watchtower was redundant and crash-looped (its Docker API client is too old for Docker 29). Keep the watchtower.enable labels on backend/frontend so the host instance auto-deploys them; remove the per-stack service and profile.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

deploy/.env.example

@@ -30,9 +30,10 @@ S3_REGION=us-east-1
 # tunnel forwards plain HTTP to caddy:80.
 PROVENANCE_SITE_ADDRESS=:80
 
-# --- Cloudflare Tunnel (optional) ---
+# --- Deploy-host services (optional, selected via COMPOSE_PROFILES) ---
-# Enable by setting COMPOSE_PROFILES=tunnel and supplying the connector token
+# 'tunnel' -> cloudflared connector (needs CLOUDFLARE_TUNNEL_TOKEN; public hostname -> http://caddy:80)
-# from the Cloudflare dashboard. Public hostname -> http://caddy:80.
+# Auto-deploy is handled by the host's global Watchtower (watches the
+# watchtower-enabled backend/frontend labels) — no profile needed here.
 CLOUDFLARE_TUNNEL_TOKEN=
 COMPOSE_PROFILES=
 

deploy/docker-compose.yml

@@ -42,6 +42,8 @@ services:
 
   backend:
     image: git.jpaul.io/justin/provenance-backend:${IMAGE_TAG:-test-main}
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
     environment:
       APP_ENV: ${APP_ENV:-development}
       DATABASE_URL: ${DATABASE_URL:-postgresql+asyncpg://provenance:provenance@postgres:5432/provenance}
@@ -62,6 +64,8 @@ services:
 
   frontend:
     image: git.jpaul.io/justin/provenance-frontend:${IMAGE_TAG:-test-main}
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
     environment:
       NODE_ENV: production
     depends_on:
@@ -104,6 +108,12 @@ services:
     profiles:
       - tunnel
 
+# Auto-deploy is handled by the host's global Watchtower (a single
+# nickfedor/watchtower instance watches every container labelled
+# `com.centurylinklabs.watchtower.enable=true` across all stacks). The backend
+# and frontend carry that label above, so a new :test-main image is pulled and
+# the container recreated automatically — no per-stack Watchtower needed.
+
 volumes:
   pgdata:
   miniodata: