services:
  controller:
    image: ${JENKINS_IMAGE:?set a reviewed controller image digest}
    restart: unless-stopped
    init: true
    ports:
      - "127.0.0.1:8080:8080"
    environment:
      JAVA_OPTS: "-Xms1g -Xmx2g -Djenkins.install.runSetupWizard=false"
      CASC_JENKINS_CONFIG: /etc/jenkins/jenkins.yaml
      JENKINS_URL: ${JENKINS_URL:?set external HTTPS URL}
    volumes:
      - ${JENKINS_HOME_DIR:?set dedicated absolute home directory}:/var/jenkins_home
      - ./jenkins.yaml:/etc/jenkins/jenkins.yaml:ro
    secrets:
      - JENKINS_BOOTSTRAP_PASSWORD
    mem_limit: 4g
    cpus: 2
    stop_grace_period: 120s
secrets:
  JENKINS_BOOTSTRAP_PASSWORD:
    file: ${JENKINS_BOOTSTRAP_PASSWORD_FILE:?set password file outside Git}