chore(docker): replace abandoned containrrr/watchtower, improve .env template

Replace containrrr/watchtower:latest with nickfedor/watchtower:1.15.0.
The original containrrr/watchtower was archived on 2025-12-17 and is
incompatible with Docker 29+. The nickfedor fork is a drop-in
replacement that is actively maintained.

Improve .env.production.template with sensible example values for all
configuration options including observability endpoints and resource
limits.

Author: eldios

docker/.env.production.template

@@ -1,33 +1,51 @@
 # Production deployment environment variables
-# This file should be created by deploy-validator.sh and renamed to .env
-# These variables are critical for the validator to function properly after restart
+# Normally created by deploy-validator.sh (see https://linera.dev/operators/testnets/one-click.html)
+# This template is a reference for manual setup or customization.
 
-# Domain configuration (set by deploy script)
-DOMAIN=${DOMAIN}
-ACME_EMAIL=${ACME_EMAIL}
+# Domain configuration
+DOMAIN=your-domain.example.com
+ACME_EMAIL=admin@example.com
 
 # Genesis configuration (critical - validator won't work without this)
-GENESIS_URL=${GENESIS_URL}
-GENESIS_BUCKET=${GENESIS_BUCKET}
-GENESIS_PATH_PREFIX=${GENESIS_PATH_PREFIX}
+GENESIS_URL=https://storage.googleapis.com/linera-io-dev-public/testnet-conway/genesis.json
+GENESIS_BUCKET=https://storage.googleapis.com/linera-io-dev-public
+GENESIS_PATH_PREFIX=testnet-conway
 
 # Validator configuration
-VALIDATOR_KEY=${VALIDATOR_KEY}
-VALIDATOR_NAME=${VALIDATOR_NAME}
+VALIDATOR_KEY=
+VALIDATOR_NAME=
 
 # Network configuration
-FAUCET_URL=${FAUCET_URL}
-FAUCET_PORT=${FAUCET_PORT:-8080}
+FAUCET_URL=
+FAUCET_PORT=8080
 
 # Storage configuration
-LINERA_STORAGE_SERVICE_PORT=${LINERA_STORAGE_SERVICE_PORT:-1235}
+LINERA_STORAGE_SERVICE_PORT=1235
 
-# Docker image
-LINERA_IMAGE=${LINERA_IMAGE}
+# Docker image (default: testnet conway release from public registry)
+#LINERA_IMAGE=us-docker.pkg.dev/linera-io-dev/linera-public-registry/linera:testnet_conway_release
+
+# Hostname identifier for this validator (used in metrics labels)
+HOSTNAME=your-domain.example.com
+
+# Observability - Prometheus metrics push (OTLP format)
+#PROMETHEUS_OTLP_URL=https://your-prometheus-endpoint/otlp
+#PROMETHEUS_OTLP_USER=
+#PROMETHEUS_OTLP_PASS=
+
+# Observability - Loki logs push
+#LOKI_PUSH_URL=https://your-loki-endpoint/loki/api/v1/push
+#LOKI_PUSH_USER=
+#LOKI_PUSH_PASS=
+
+# Observability - Tempo traces push
+#TEMPO_OTLP_URL=https://your-tempo-endpoint/tempo/otlp
+#TEMPO_OTLP_USER=
+#TEMPO_OTLP_PASS=
 
 # Resource limits (adjust based on host machine specs)
 # Defaults are tuned for an 8-core / 32GB RAM machine.
-# To disable limits, comment out the relevant lines.
+# Uncomment and modify to override defaults.
 #LIMIT_CPUS_WEB=1.00
 #LIMIT_MEM_WEB=1536M
 #LIMIT_CPUS_SCYLLA=2.00
@@ -43,4 +61,4 @@ LINERA_IMAGE=${LINERA_IMAGE}
 #LIMIT_CPUS_GRAFANA=0.50
 #LIMIT_MEM_GRAFANA=512M
 #LIMIT_CPUS_WATCHTOWER=0.25
-#LIMIT_MEM_WATCHTOWER=256M
+#LIMIT_MEM_WATCHTOWER=256M

docker/docker-compose.yml

@@ -280,7 +280,7 @@ services:
           memory: ${LIMIT_MEM_GRAFANA:-512M}
 
   watchtower:
-    image: containrrr/watchtower:latest
+    image: nickfedor/watchtower:1.15.0
     container_name: watchtower
     restart: unless-stopped
     volumes: