docs: registry polling, version history and phase 4 plan (#9)

deploy/master.stack.yml

@@ -10,6 +10,9 @@
 #      To run without the webhook, remove the pu_updater_api_key lines (the UPDATER_API_KEY
 #      part of the entrypoint, the service secret and the secrets entry); the endpoint then answers 503.
 #      The reverse proxy must allow a read timeout longer than UPDATE_TIMEOUT (default 5m).
+#   5. Optional, for registry polling of private images: put a config.json written by
+#      `docker login` (inline "auths" only; no credsStore) in /path/to/docker-config on the
+#      manager and keep the volumes entry below. Without it registries are accessed anonymously.
 services:
   master:
     image: gitea.shcizo.se/shcizo/package-updater:latest
@@ -21,10 +24,14 @@ services:
       OIDC_CLIENT_ID: package-updater
       ALLOWED_GROUP: updater-admins
       # UPDATE_TIMEOUT: 5m
+      # POLL_INTERVAL: 6h
+      DOCKER_CONFIG: /docker-config
     secrets:
       - pu_database_url
       - pu_oidc_client_secret
       - pu_updater_api_key
+    volumes:
+      - /path/to/docker-config:/docker-config:ro
     ports:
       # Agents connect here directly over the internal network, not via the proxy.
       - target: 8090