deploy/master.stack.yml

@@ -11,8 +11,10 @@
 #      part of the entrypoint, the service secret and the secrets entry); the endpoint then answers 503.
 #      The reverse proxy must allow a read timeout longer than UPDATE_TIMEOUT (default 5m).
 #   5. Optional, for registry polling of private images: put a config.json written by
-#      `docker login` (inline "auths" only; no credsStore) in /path/to/docker-config on the
-#      manager and keep the volumes entry below. Without it registries are accessed anonymously.
+#      `docker login` (inline "auths" only; no credsStore) in /path/to/docker-config and
+#      uncomment DOCKER_CONFIG and the volumes entry below. The directory must exist on every
+#      manager node (the master is placed on a manager), or Swarm rejects the task. Without
+#      it registries are accessed anonymously.
 services:
   master:
     image: gitea.shcizo.se/shcizo/package-updater:latest
@@ -25,13 +27,13 @@ services:
       ALLOWED_GROUP: updater-admins
       # UPDATE_TIMEOUT: 5m
       # POLL_INTERVAL: 6h
-      DOCKER_CONFIG: /docker-config
+      # DOCKER_CONFIG: /docker-config   # step 5
     secrets:
       - pu_database_url
       - pu_oidc_client_secret
       - pu_updater_api_key
-    volumes:
-      - /path/to/docker-config:/docker-config:ro
+    # volumes:                        # step 5
+    #   - /path/to/docker-config:/docker-config:ro
     ports:
       # Agents connect here directly over the internal network, not via the proxy.
       - target: 8090