docker-compose.yml

services:
  traefik:
    isolation: ${TRAEFIK_ISOLATION}
    image: ${TRAEFIK_IMAGE}
    command:
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--ping"
      - "--providers.docker.endpoint=npipe:////./pipe/docker_engine"
      - "--providers.docker.exposedByDefault=false"
      - "--providers.file.directory=C:/etc/traefik/config/dynamic"
      - "--entryPoints.websecure.address=:443"
      - "--entryPoints.websecure.forwardedHeaders.insecure"
    ports:
      - "443:443"
      - "8079:8080"
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
    volumes:
      - source: \\.\pipe\docker_engine\
        target: \\.\pipe\docker_engine\
        type: npipe
      - ./docker/traefik:C:/etc/traefik
    depends_on:
      id:
        condition: service_healthy
      cm:
        condition: service_healthy
  mssql:
    isolation: ${ISOLATION}
    image: ${SITECORE_DOCKER_REGISTRY}nonproduction/mssql-developer:2025-${EXTERNAL_IMAGE_TAG_SUFFIX}
    environment:
      NAME: ${SQL_SERVER}
      SA_PASSWORD: ${SQL_SA_PASSWORD}
      ACCEPT_EULA: "Y"
    # No TLS_CERTIFICATE_PASSWORD or c:\certs mount on purpose. The image registers
    # a mounted PFX into LocalMachine\My without persisting its private key, after
    # which SQL cannot complete a TLS handshake and clients time out. SQL uses its
    # own self-generated certificate instead; clients pass TrustServerCertificate=true.
    ports:
      - "14330:1433"
    volumes:
      - type: bind
        source: .\docker\data\mssql
        target: c:\data
  mssql-init:
    isolation: ${ISOLATION}
    image: ${SITECORE_DOCKER_REGISTRY}sitecore-xm1-mssql-init:${SITECORE_VERSION}
    environment:
      SQL_SERVER: ${SQL_SERVER}
      SQL_ADMIN_LOGIN: ${SQL_SA_LOGIN}
      SQL_ADMIN_PASSWORD: ${SQL_SA_PASSWORD}
      SQL_DATABASE_PREFIX: ${SQL_DATABASE_PREFIX}
      SQL_CUSTOM_DATABASE_PREFIX_UPDATE_FROM: ${SQL_CUSTOM_DATABASE_PREFIX_UPDATE_FROM}
      SITECORE_ADMIN_PASSWORD: ${SITECORE_ADMIN_PASSWORD}
      POST_DEPLOYMENT_WAIT_PERIOD: 300
    healthcheck:
      test:
        [
          "CMD",
          "powershell",
          "-command",
          "if ([System.Environment]::GetEnvironmentVariable('DatabasesDeploymentStatus', 'Machine') -eq 'Complete') { exit 0 } else { exit 1}",
        ]
      start_period: 300s
      interval: 5s
    depends_on:
      mssql:
        condition: service_healthy

  solr:
    isolation: ${ISOLATION}
    image: ${SITECORE_DOCKER_REGISTRY}nonproduction/solr:10.0.0-${EXTERNAL_IMAGE_TAG_SUFFIX}
    ports:
      - "8984:8983"
    volumes:
      - type: bind
        source: .\docker\data\solr
        target: c:\data
      - type: bind
        source: .\docker\solr-security
        target: c:\solr-config
    healthcheck:
      test:
        [
          "CMD",
          "powershell",
          "-command",
          "try { $$statusCode = (iwr http://solr:8983/solr/admin/info/system -UseBasicParsing -TimeoutSec 10).StatusCode; if ($$statusCode -eq 200) { exit 0 } else { exit 1 } } catch { if ($$_.Exception.Response -and $$_.Exception.Response.StatusCode.value__ -eq 401) { exit 0 } else { exit 1 } }",
        ]
    post_start:
      - command: ["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", "C:\\solr-config\\ApplySolrSecurity.ps1", "-Username", "${SOLR_ADMIN_USERNAME}", "-Password", "${SOLR_ADMIN_PASSWORD}", "-SolrBaseUrl", "http://localhost:8983", "-ZkHost", "localhost:9983", "-SecurityJsonPath", "C:/solr-config/security.json"]
  solr-init:
    isolation: ${ISOLATION}
    image: ${SITECORE_DOCKER_REGISTRY}sitecore-xm1-solr-init:${SITECORE_VERSION}
    environment:
      SITECORE_SOLR_CONNECTION_STRING: http://${SOLR_ADMIN_USERNAME}:${SOLR_ADMIN_PASSWORD}@solr:8983/solr
      SOLR_CONNECTION_USERNAME: ${SOLR_CONNECTION_USERNAME}
      SOLR_CONNECTION_PASSWORD: ${SOLR_CONNECTION_PASSWORD}
      SOLR_CORE_PREFIX_NAME: ${SOLR_CORE_PREFIX_NAME}
    depends_on:
      solr:
        condition: service_healthy
  id:
    isolation: ${ISOLATION}
    image: ${SITECORE_DOCKER_REGISTRY}sitecore-identity:${SITECORE_ID_VERSION}
    environment:
      # TrustServerCertificate=true because SQL serves its own self-generated
      # certificate in this dev stack; see the mssql service for why.
      Sitecore_Sitecore__IdentityServer__SitecoreMemberShipOptions__ConnectionString: Data Source=${SQL_SERVER};Initial Catalog=${SQL_DATABASE_PREFIX}.Core;User ID=${SQL_SA_LOGIN};Password=${SQL_SA_PASSWORD};Encrypt=true;TrustServerCertificate=true;
      Sitecore_Sitecore__IdentityServer__AccountOptions__PasswordRecoveryUrl: https://${CM_HOST}/sitecore/login?rc=1
      Sitecore_Sitecore__IdentityServer__Clients__PasswordClient__ClientSecrets__ClientSecret1: ${SITECORE_IDSECRET}
      Sitecore_Sitecore__IdentityServer__Clients__DefaultClient__AllowedCorsOrigins__AllowedCorsOriginsGroup1: https://${CM_HOST}
      Sitecore_Sitecore__IdentityServer__CertificateRawData: ${SITECORE_ID_CERTIFICATE}
      Sitecore_Sitecore__IdentityServer__PublicOrigin: https://${ID_HOST}
      Sitecore_Sitecore__IdentityServer__CertificateRawDataPassword: ${SITECORE_ID_CERTIFICATE_PASSWORD}
      Sitecore_License: ${SITECORE_LICENSE}
    healthcheck:
      test: ["CMD", "pwsh", "-command", "C:/Healthchecks/Healthcheck.ps1"]
      timeout: 300s
    depends_on:
      mssql-init:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.id-secure.entrypoints=websecure"
      - "traefik.http.routers.id-secure.rule=Host(`${ID_HOST}`)"
      - "traefik.http.routers.id-secure.tls=true"
      - "traefik.http.services.id-secure.loadbalancer.server.port=80"
  cm:
    isolation: ${ISOLATION}
    image: ${REGISTRY}${COMPOSE_PROJECT_NAME}-cm:${VERSION:-latest}
    build:
      context: ./docker/build/cm
      args:
        BASE_IMAGE: ${SITECORE_DOCKER_REGISTRY}sitecore-xm1-cm:${SITECORE_VERSION}
        MANAGEMENT_SERVICES_IMAGE: ${SITECORE_MODULE_REGISTRY}sitecore-management-services-xm1-assets:${MANAGEMENT_SERVICES_VERSION}
    depends_on:
      mssql-init:
        condition: service_healthy
      solr-init:
        condition: service_started
      id:
        condition: service_started
    environment:
      Sitecore_AppSettings_instanceNameMode:define: default
      Sitecore_ConnectionStrings_Core: Data Source=${SQL_SERVER};Initial Catalog=${SQL_DATABASE_PREFIX}.Core;User ID=${SQL_SA_LOGIN};Password=${SQL_SA_PASSWORD}
      Sitecore_ConnectionStrings_Security: Data Source=${SQL_SERVER};Initial Catalog=${SQL_DATABASE_PREFIX}.Core;User ID=${SQL_SA_LOGIN};Password=${SQL_SA_PASSWORD}
      Sitecore_ConnectionStrings_Master: Data Source=${SQL_SERVER};Initial Catalog=${SQL_DATABASE_PREFIX}.Master;User ID=${SQL_SA_LOGIN};Password=${SQL_SA_PASSWORD}
      Sitecore_ConnectionStrings_Web: Data Source=${SQL_SERVER};Initial Catalog=${SQL_DATABASE_PREFIX}.Web;User ID=${SQL_SA_LOGIN};Password=${SQL_SA_PASSWORD}
      Sitecore_ConnectionStrings_ExperienceForms: Data Source=${SQL_SERVER};Initial Catalog=${SQL_DATABASE_PREFIX}.ExperienceForms;User ID=${SQL_SA_LOGIN};Password=${SQL_SA_PASSWORD}
      Sitecore_ConnectionStrings_Solr.Search: http://${SOLR_CONNECTION_USERNAME}:${SOLR_CONNECTION_PASSWORD}@solr:8983/solr;solrCloud=true
      Sitecore_ConnectionStrings_Sitecoreidentity.secret: ${SITECORE_IDSECRET}
      Sitecore_AppSettings_Telerik.AsyncUpload.ConfigurationEncryptionKey: ${TELERIK_ENCRYPTION_KEY}
      Sitecore_AppSettings_Telerik.Upload.ConfigurationHashKey: ${TELERIK_ENCRYPTION_KEY}
      Sitecore_AppSettings_Telerik.Web.UI.DialogParametersEncryptionKey: ${TELERIK_ENCRYPTION_KEY}
      Sitecore_License: ${SITECORE_LICENSE}
      Sitecore_Identity_Server_Authority: https://${ID_HOST}
      Sitecore_Identity_Server_InternalAuthority: http://id
      Sitecore_Identity_Server_CallbackAuthority: https://${CM_HOST}
      Sitecore_Identity_Server_Require_Https: "false"
      SOLR_CORE_PREFIX_NAME: ${SOLR_CORE_PREFIX_NAME}
      MEDIA_REQUEST_PROTECTION_SHARED_SECRET: ${MEDIA_REQUEST_PROTECTION_SHARED_SECRET}
      LOG_LEVEL_VALUE: ${LOG_LEVEL_VALUE}
    volumes:
      - .\docker\data\cm\:C:\inetpub\wwwroot\App_Data\logs
      - type: bind
        source: .\docker\shared\certs
        target: c:\certs
    healthcheck:
      test: ["CMD", "powershell", "-command", "C:/Healthchecks/Healthcheck.ps1"]
      timeout: 300s
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.force-STS-Header.headers.forceSTSHeader=true"
      - "traefik.http.middlewares.force-STS-Header.headers.stsSeconds=31536000"
      - "traefik.http.routers.cm-secure.entrypoints=websecure"
      - "traefik.http.routers.cm-secure.rule=Host(`${CM_HOST}`)"
      - "traefik.http.routers.cm-secure.tls=true"
      - "traefik.http.routers.cm-secure.middlewares=force-STS-Header"
      - "traefik.http.services.cm-secure.loadbalancer.server.port=80"