initial commit, here be dragons

roles/watchtower/handlers/main.yml

@@ -0,0 +1,12 @@
+- name: "Stop {{ docker_compose.project_name }}"
+  community.general.docker_compose:
+    project_name: "{{ docker_compose.project_name }}"
+    project_src: "{{ docker_compose.path }}"
+    files: "{{ docker_compose.file }}"
+    state: absent
+
+- name: "Start {{ docker_compose.project_name }}"
+  community.general.docker_compose:
+    project_name: "{{ docker_compose.project_name }}"
+    project_src: "{{ docker_compose.path }}"
+    files: "{{ docker_compose.file }}"

roles/watchtower/tasks/main.yml

@@ -0,0 +1,11 @@
+---
+- name: Create service directory if needed
+  ansible.builtin.file: { path: "/opt/service/{{ docker_compose.project_name }}", state: directory, mode: '0700' }
+
+- name: Copy docker compose files
+  ansible.builtin.template:
+    src: "{{ docker_compose.file }}.j2"
+    dest: "{{ docker_compose.path }}/{{ docker_compose.file }}"
+    mode: "u=rw,go-rwx"
+    validate: docker-compose -f %s config
+  notify: [ "Stop {{ docker_compose.project_name }}", "Start {{ docker_compose.project_name }}" ]

roles/watchtower/templates/docker-compose.yml.j2

@@ -0,0 +1,12 @@
+---
+version: '3'
+
+# watchtower updates container images with mutable tags.
+services:
+  watchtower:
+    image: 'containrrr/watchtower:1.1.6'
+    # Use label `com.centurylinklabs.watchtower.enable="false"` to disable on container!
+    command: '--cleanup --schedule "0 0 4 * * *"' # UTC
+    restart: unless-stopped
+    volumes:
+      - '/var/run/docker.sock:/var/run/docker.sock'

roles/watchtower/vars/main.yml

@@ -0,0 +1,4 @@
+docker_compose:
+  path: "/opt/service/watchtower"
+  file: "docker-compose.yml"
+  project_name: "watchtower"