docs: webhook contract, auto mode and phase 3 plan (#8)

deploy/master.stack.yml

@@ -1,4 +1,4 @@
-# Example Swarm stack for the package-updater master (phase 2: inventory and manual updates).
+# Example Swarm stack for the package-updater master (phase 3: inventory, updates and the CI webhook).
 # Deploy on the manager: docker stack deploy -c master.stack.yml package-updater-master
 #
 # Before deploying:
@@ -6,19 +6,24 @@
 #   2. In Authentik: create an OAuth2/OpenID provider + application with redirect URI
 #      https://updater.example.com/auth/callback, and a group "updater-admins".
 #   3. docker secret create pu_oidc_client_secret - ; docker secret create pu_database_url -
+#   4. Optional, enables POST /update (without it the endpoint answers 503):
+#      docker secret create pu_updater_api_key -
+#      The reverse proxy must allow a read timeout longer than UPDATE_TIMEOUT (default 5m).
 services:
   master:
     image: gitea.shcizo.se/shcizo/package-updater:latest
-    entrypoint: ["/bin/sh", "-c", "DATABASE_URL=$$(cat /run/secrets/pu_database_url) OIDC_CLIENT_SECRET=$$(cat /run/secrets/pu_oidc_client_secret) exec /usr/local/bin/updater-master"]
+    entrypoint: ["/bin/sh", "-c", "DATABASE_URL=$$(cat /run/secrets/pu_database_url) OIDC_CLIENT_SECRET=$$(cat /run/secrets/pu_oidc_client_secret) UPDATER_API_KEY=$$(cat /run/secrets/pu_updater_api_key) exec /usr/local/bin/updater-master"]
     environment:
       PUBLIC_URL: https://updater.example.com
       AGENT_URL: wss://10.0.0.5:8090/agent
       OIDC_ISSUER: https://auth.example.com/application/o/package-updater/
       OIDC_CLIENT_ID: package-updater
       ALLOWED_GROUP: updater-admins
+      # UPDATE_TIMEOUT: 5m
     secrets:
       - pu_database_url
       - pu_oidc_client_secret
+      - pu_updater_api_key
     ports:
       # Agents connect here directly over the internal network, not via the proxy.
       - target: 8090
@@ -35,6 +40,8 @@ secrets:
     external: true
   pu_oidc_client_secret:
     external: true
+  pu_updater_api_key:
+    external: true
 
 networks:
   proxy: