From b3ab94cd13c2756f6c1fab23c2a43af35c2a807d Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Sun, 5 Jul 2026 17:39:59 -0400
Subject: [PATCH] watchtower: add WATCHTOWER_COOLDOWN_DELAY=24h (v-next
 supply-chain guard)

Image must exist in the registry >=24h before Watchtower adopts it, so a
compromised/broken just-pushed :latest isn't pulled instantly. Per-container
override via com.centurylinklabs.watchtower.cooldown-delay. Fleet-wide.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 roles/dawarich/templates/docker-compose.yml.j2 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/dawarich/templates/docker-compose.yml.j2 b/roles/dawarich/templates/docker-compose.yml.j2
index 5105bae..d7f0092 100644
--- a/roles/dawarich/templates/docker-compose.yml.j2
+++ b/roles/dawarich/templates/docker-compose.yml.j2
@@ -172,6 +172,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
     environment:
       - WATCHTOWER_HTTP_API_UPDATE=true
+      - WATCHTOWER_COOLDOWN_DELAY=24h
       - WATCHTOWER_HTTP_API_TOKEN={{ watchtower_api_token }}
       - TZ={{ timezone }}
       - WATCHTOWER_CLEANUP=true