fix: use nicholas-fedor watchtower image, update docs

Switch from containrrr/watchtower to ghcr.io/nicholas-fedor/watchtower
to fix Docker API version mismatch crashloop. Update README with pds.env
management, new variables, and S3/SMTP config instructions.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

README.md

@@ -47,9 +47,9 @@ ansible-playbook playbook.yml
 
 ## What it does
 
-**First run:** the official [PDS installer](https://github.com/bluesky-social/pds/blob/main/installer.sh) bootstraps Docker, generates secrets, and creates the initial database. Ansible then templates `compose.yaml` and `Caddyfile` over the installer's defaults and runs `docker compose up -d`.
+**First run:** the official [PDS installer](https://github.com/bluesky-social/pds/blob/main/installer.sh) bootstraps Docker, generates secrets, and creates the initial database. Ansible then reads the generated secrets from `pds.env`, templates `pds.env`, `compose.yaml`, and `Caddyfile`, and runs `docker compose up -d`.
 
-**Subsequent runs:** the installer is skipped (guarded by `account.sqlite`). Ansible only applies changes if the templates have changed. `docker compose up -d` is a no-op when nothing changed.
+**Subsequent runs:** the installer is skipped (guarded by `account.sqlite`). Ansible reads the existing secrets from `pds.env` and re-templates all config files. Changes only trigger a restart if content actually changed.
 
 ## Variables
 
@@ -59,6 +59,12 @@ ansible-playbook playbook.yml
 | `pds_admin_email` | yes | — | Admin contact email (used by Caddy for Let's Encrypt) |
 | `pds_data_dir` | no | `/pds` | Data directory (must be `/pds` — the installer enforces this) |
 | `pds_image_tag` | no | `0.4` | PDS Docker image tag |
+| `pds_blob_upload_limit` | no | `104857600` | Max blob upload size in bytes |
+| `pds_rate_limits_enabled` | no | `true` | Enable rate limiting |
+| `pds_invite_required` | no | `true` | Require invite codes to create accounts |
+| `pds_blobstore_type` | no | `disk` | Blob storage backend (`disk` or `s3`) |
+| `pds_email_smtp_url` | no | — | SMTP URL for email verification |
+| `pds_email_from_address` | no | — | From address for outgoing emails |
 
 ## Auto-updates
 
@@ -80,5 +86,5 @@ pdsadmin account create
 
 ## Notes
 
-- `pds.env` (containing JWT secret, admin password, PLC rotation key) is generated by the installer and not managed by Ansible. Edit it directly on the server to add SMTP or change settings.
+- `pds.env` is Ansible-managed. Secrets (JWT, admin password, PLC rotation key) are generated by the installer on first run, then read and preserved by Ansible on subsequent runs. To change config like S3 or SMTP, update `vars/main.yml` and re-run the playbook.
 - The installer creates a `pds.service` systemd unit. It's left in place — it just runs `docker compose up -d` on boot. Docker's `restart: unless-stopped` policy also handles this independently.

templates/compose.yaml.j2

@@ -26,7 +26,7 @@ services:
 
   watchtower:
     container_name: watchtower
-    image: containrrr/watchtower:latest
+    image: ghcr.io/nicholas-fedor/watchtower:latest
     network_mode: host
     restart: unless-stopped
     volumes: