docker-compose.yml

services:

  jim.web:
    container_name: jim.web
    image: ${DOCKER_REGISTRY-}jim-web${JIM_VERSION:+:${JIM_VERSION}}
    restart: always
    env_file: .env
    environment:
      # Docker-specific overrides (JIM_DB_HOSTNAME set in .env for external DB, or overridden by codespaces file)
      - JIM_DB_HOSTNAME=${JIM_DB_HOSTNAME:-jim.database}
      - JIM_LOG_PATH=/var/log/jim
      - JIM_LOG_REQUESTS=true
    volumes:
      - jim-logs-volume:/var/log/jim
      - jim-keys-volume:/data/keys
      - jim-connector-files-volume:/connector-files
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    build:
      context: .
      dockerfile: src/JIM.Web/Dockerfile
      args:
        VERSION_SUFFIX: ${VERSION_SUFFIX:-}
    depends_on:
      jim.database:
        condition: service_healthy
        required: false
      jim.worker:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80/api/v1/health/ready"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - jim-network

  jim.worker:
    container_name: jim.worker
    image: ${DOCKER_REGISTRY-}jim-worker${JIM_VERSION:+:${JIM_VERSION}}
    restart: always
    env_file: .env
    environment:
      # Docker-specific overrides
      - JIM_DB_HOSTNAME=${JIM_DB_HOSTNAME:-jim.database}
      - JIM_LOG_PATH=/var/log/jim
    volumes:
      - jim-logs-volume:/var/log/jim
      - jim-keys-volume:/data/keys
      - jim-connector-files-volume:/connector-files
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    cap_add:
      # Required for CIFS/SMB file share mounting (file-based connectors)
      - DAC_READ_SEARCH
      - SYS_ADMIN
    security_opt:
      - no-new-privileges:true
    build:
      context: .
      dockerfile: src/JIM.Worker/Dockerfile
      args:
        VERSION_SUFFIX: ${VERSION_SUFFIX:-}
    healthcheck:
      test: ["CMD-SHELL", "test $$(( $$(date +%s) - $$(stat -c %Y /tmp/healthcheck) )) -lt 60"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s
    depends_on:
      jim.database:
        condition: service_healthy
        required: false
    networks:
      - jim-network

  jim.scheduler:
    container_name: jim.scheduler
    image: ${DOCKER_REGISTRY-}jim-scheduler${JIM_VERSION:+:${JIM_VERSION}}
    restart: always
    env_file: .env
    environment:
      # Docker-specific overrides
      - JIM_DB_HOSTNAME=${JIM_DB_HOSTNAME:-jim.database}
      - JIM_LOG_PATH=/var/log/jim
    volumes:
      - jim-logs-volume:/var/log/jim
      - jim-keys-volume:/data/keys
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    build:
      context: .
      dockerfile: src/JIM.Scheduler/Dockerfile
      args:
        VERSION_SUFFIX: ${VERSION_SUFFIX:-}
    healthcheck:
      test: ["CMD-SHELL", "test $$(( $$(date +%s) - $$(stat -c %Y /tmp/healthcheck) )) -lt 120"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 120s
    depends_on:
      jim.database:
        condition: service_healthy
        required: false
      jim.worker:
        condition: service_healthy
    networks:
      - jim-network

  jim.database:
    container_name: jim.database
    image: postgres:18.3@sha256:78481659c47e862334611ccdaf7c369c986b3046da9857112f3b309114a65fb4
    profiles:
      - with-db
    # PostgreSQL tuning - customise for your environment using https://pgtune.leopard.in.ua/
    # The default values below are for a 64GB Windows / 32GB WSL / 16 core / SSD system.
    # For other host sizes, override 'command' and 'shm_size' in a compose override file
    # (see docker-compose.override.yml for an example with 8GB hosts).
    # IMPORTANT: shm_size must be >= shared_buffers (with ~25% headroom recommended):
    #   shared_buffers=2GB  -> shm_size: '3gb'    (e.g. 16GB host)
    #   shared_buffers=4GB  -> shm_size: '5gb'    (e.g. 32GB host)
    #   shared_buffers=8GB  -> shm_size: '10gb'   (e.g. 64GB host)
    #   shared_buffers=16GB -> shm_size: '20gb'   (e.g. 128GB host)
    # statement_timeout=300000 (5 minutes) prevents runaway queries
    # log_min_duration_statement (JIM_DB_LOG_MIN_DURATION) logs slow queries for performance analysis
    # logging_collector + jsonlog writes structured JSON logs to the shared log volume for the Logs UI.
    # The entrypoint wrapper creates a postgres-owned subdirectory before delegating to the
    # standard postgres entrypoint, since the shared volume root is owned by root.
    entrypoint: ["/bin/bash", "-c", "mkdir -p /var/log/jim/database && chown postgres:postgres /var/log/jim/database && exec docker-entrypoint.sh \"$$@\"", "--"]
    command: postgres -c max_connections=200 -c shared_buffers=8GB -c effective_cache_size=24GB -c maintenance_work_mem=2GB -c checkpoint_completion_target=0.9 -c wal_buffers=16MB -c default_statistics_target=100 -c random_page_cost=1.1 -c effective_io_concurrency=200 -c work_mem=10485kB -c min_wal_size=1GB -c max_wal_size=4GB -c max_worker_processes=16 -c max_parallel_workers_per_gather=4 -c max_parallel_workers=16 -c max_parallel_maintenance_workers=4 -c statement_timeout=300000 -c log_min_duration_statement=${JIM_DB_LOG_MIN_DURATION:-1000} -c logging_collector=on -c log_destination=jsonlog -c log_directory=/var/log/jim/database -c log_filename=jim.database.%Y%m%d.log -c log_rotation_age=1440 -c log_rotation_size=0 -c log_file_mode=0644
    restart: always
    shm_size: '10gb'
    volumes:
      - jim-db-volume:/var/lib/postgresql
      - jim-logs-volume:/var/log/jim
    env_file: .env
    environment:
      # Postgres uses different var names
      - POSTGRES_DB=${JIM_DB_NAME}
      - POSTGRES_USER=${JIM_DB_USERNAME}
      - POSTGRES_PASSWORD=${JIM_DB_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - jim-network

networks:
  jim-network:
    name: jim-network
    driver: bridge

volumes:
  jim-db-volume:
    name: jim-db-volume
  jim-logs-volume:
    name: jim-logs-volume
  jim-keys-volume:
    name: jim-keys-volume
  # File Connector storage: imports and exports for the JIM File Connector.
  # Mounted on jim.web (for the file browser dialog) and jim.worker (read/write).
  # Customers integrating with fixed external file locations bind-mount over
  # subdirectories of this volume (e.g. a network share at /connector-files/hr-input).
  # See docs/connectors/jim-file-connector.md for configuration patterns.
  jim-connector-files-volume:
    name: jim-connector-files-volume