fix(swarm): configs and docs for gantry (#1077)

Author: raisedadead

docker/swarm/stacks/oncall/README.md

@@ -1,5 +1,26 @@
 ## Usage
 
-This stack defines all the services for the housekeeping apps. See comments in the stack file for details. Note that for credentials we use the host docker `config.json` file. This requires the update service to be running on the same host (typically the manager node).
+This stack defines all the services for the housekeeping apps. See comments in the stack file for details.
 
-Also note that these credentials need to be updated if they expire. This file is located at `~/.docker/config.json`.
+### Gantry Auto-Update Service
+
+**Authentication Requirements:**
+- Uses host Docker credentials from `/home/freecodecamp/.docker/config.json`
+- Requires `--with-registry-auth` (set via `GANTRY_UPDATE_OPTIONS`) to propagate credentials to worker nodes
+- Credentials must be valid and updated if expired
+
+**Directory Requirements:**
+- Mount `/home/freecodecamp/.docker:/root/.docker` as **writable** (buildx needs write access)
+- Ensure `/home/freecodecamp/.docker/buildx/` directory exists on manager node
+
+**Deployment:**
+```bash
+# Ensure correct ownership and permissions
+sudo chown -R freecodecamp:freecodecamp /home/freecodecamp/.docker
+sudo chmod -R u+w /home/freecodecamp/.docker
+
+# Deploy stack
+docker stack deploy -c docker/swarm/stacks/oncall/stack-oncall.yml oncall
+```
+
+**Note:** The update service runs on the manager node via cronjob scheduling (managed by `svc-cronjob`).

docker/swarm/stacks/oncall/stack-oncall.yml

@@ -20,15 +20,17 @@ services:
       - "GANTRY_SLEEP_SECONDS=0"
       - "GANTRY_LOG_LEVEL=INFO"
       - "GANTRY_SERVICES_FILTERS=label=org.freecodecamp.autoupdate"
+      - "GANTRY_SERVICES_EXCLUDED_FILTERS=name=stg-news"
       - "GANTRY_UPDATE_NUM_WORKERS=3"
       - "GANTRY_MANIFEST_NUM_WORKERS=5"
       - "GANTRY_MANIFEST_CMD=buildx"
       - "GANTRY_CLEANUP_IMAGES=true"
       - "GANTRY_ROLLBACK_ON_FAILURE=true"
       - "GANTRY_UPDATE_TIMEOUT_SECONDS=300"
+      - "GANTRY_UPDATE_OPTIONS=--with-registry-auth"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock"
-      - "/home/freecodecamp/.docker/config.json:/root/.docker/config.json:ro"
+      - "/home/freecodecamp/.docker:/root/.docker"
     deploy:
       mode: replicated
       replicas: 0