Nginx
&
Docker

# 啟動
multipass launch --name server-class 22.04 --cpus 2 --memory 3G --disk 20G
# CPU、記憶體、硬碟要多少你們可以自己調整

# 進入虛擬機
multipass shell server-class

sudo apt update
sudo apt upgrade
sudo apt install build-essential gcc git vim npm nodejs apache2 nginx docker docker-compose neofetch ufw

sudo apt update
apt install nginx

user www-data; ##設定 Nginx 使用 www-data 用戶執行。
worker_processes auto; ##自動調整工作進程的數量
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf; ##包含額外的模塊配置文件

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	# server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}


#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#	server {
#		listen     localhost:110;
#		protocol   pop3;
#		proxy      on;
#	}
#
#	server {
#		listen     localhost:143;
#		protocol   imap;
#		proxy      on;
#	}
#}

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
	listen 80 default_server;
	listen [::]:80 default_server;

	# SSL configuration
	#
	# listen 443 ssl default_server;
	# listen [::]:443 ssl default_server;
	#
	# Note: You should disable gzip for SSL traffic.
	# See: https://bugs.debian.org/773332
	#
	# Read up on ssl_ciphers to ensure a secure configuration.
	# See: https://bugs.debian.org/765782
	#
	# Self signed certs generated by the ssl-cert package
	# Don't use them in a production server!
	#
	# include snippets/snakeoil.conf;

	root /var/www/html;

	# Add index.php to the list if you are using PHP
	index index.html index.htm index.nginx-debian.html;

	server_name _;

	location / {
		# First attempt to serve request as file, then
		# as directory, then fall back to displaying a 404.
		try_files $uri $uri/ =404;
	}

	# pass PHP scripts to FastCGI server
	#
	#location ~ \.php$ {
	#	include snippets/fastcgi-php.conf;
	#
	#	# With php-fpm (or other unix sockets):
	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;
	#	# With php-cgi (or other tcp sockets):
	#	fastcgi_pass 127.0.0.1:9000;
	#}

	# deny access to .htaccess files, if Apache's document root
	# concurs with nginx's one
	#
	#location ~ /\.ht {
	#	deny all;
	#}
}


# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
#	listen 80;
#	listen [::]:80;
#
#	server_name example.com;
#
#	root /var/www/example.com;
#	index index.html;
#
#	location / {
#		try_files $uri $uri/ =404;
#	}
#}

upstream api {
    server localhost:5000;
}

server {
    listen 80;
    listen [::]:80;
    server_name dian.cjtsai.com;
    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;


    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
            proxy_pass http://api/;
    }
}

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#

#	passenger_enabled on;


map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}


upstream vscode{
	server 0.0.0.0:8443;
	keepalive 16;
}
upstream websocket{
	server 0.0.0.0:3000;
	keepalive 16;
}
upstream tioj {
	server 0.0.0.0:4000;
	keepalive 16;
}

upstream qduoj {
	server 0.0.0.0:1443;
	keepalive 16;
}

upstream cms {
	server 0.0.0.0:8890;
	keepalive 8;
}

upstream cms-admin {
	server 0.0.0.0:8891;
	keepalive 8;
}

upstream cms-rank {
	server 0.0.0.0:8892;
	keepalive 8;
}


# fgiscoj -> qduoj
server {
	listen 443 ssl;
  	listen [::]:443 ssl;

  	# 憑證與金鑰的路徑
    ssl_certificate /etc/letsencrypt/live/iscoj.fg.tp.edu.tw/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/iscoj.fg.tp.edu.tw/privkey.pem; # managed by Certbot

	root /var/www/html;
	server_name fgiscoj.fg.tp.edu.tw;

	location /{
		proxy_pass https://qduoj/;
		# 把 IP、Protocol 等 header 都一起送給反向代理的 server
		proxy_set_header X-Real-IP $remote_addr;
      	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      	proxy_set_header X-Forwarded-Proto https;
      	proxy_set_header X-Forwarded-Server $host;
      	proxy_set_header Host $http_host;
      	proxy_redirect off;
	}
}


server {

	# SSL configuration
	#
	listen 443 ssl default_server;
	listen [::]:443 ssl default_server;
	
  	# 憑證與金鑰的路徑
    ssl_certificate /etc/letsencrypt/live/iscoj.fg.tp.edu.tw/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/iscoj.fg.tp.edu.tw/privkey.pem; # managed by Certbot
	# Note: You should disable gzip for SSL traffic.
	# See: https://bugs.debian.org/773332
	#
	# Read up on ssl_ciphers to ensure a secure configuration.
	# See: https://bugs.debian.org/765782
	#
	# Self signed certs generated by the ssl-cert package
	# Don't use them in a production server!
	#
	# include snippets/snakeoil.conf;

	root /var/www/html;

	# Add index.php to the list if you are using PHP
	# index index.html index.htm index.nginx-debian.html;
	
	server_name iscoj.fg.tp.edu.tw iscoj.ckefgisc.org; 
	location /{
		proxy_pass http://tioj/;

		# 把 IP、Protocol 等 header 都一起送給反向代理的 server
		proxy_set_header X-Real-IP $remote_addr;
      	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      	proxy_set_header X-Forwarded-Proto https;
      	proxy_set_header X-Forwarded-Server $host;
      	proxy_set_header Host $http_host;
      	proxy_redirect off;
		

        # 舊網址 to 新網址格式 (with s) 
		rewrite "^/problem/(.*)$" /problems/$1 permanent;
	}
	
#iscoj auto refresh and external judge server connection

    location /cable {
        proxy_pass http://localhost:4000/cable;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400; # 1 day
    }	
	
	location = /problem {
		return 302 /problem/;
	}
	
	location = /vscode {
		return 302 /vscode/;
	}
	location /vscode/ {
		proxy_pass http://127.0.0.1:8443/;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header Host $http_host;
		proxy_set_header X-NginX-Proxy true;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";
		proxy_redirect off;
	}

	location = /cms {
		return 302 /cms/;
	}
	location /cms/ {
		proxy_pass http://cms/;  
	}	

	location = /cms/admin {
		return 302 /cms/admin/;
	}
	location /cms/admin/ {
		proxy_pass http://cms-admin/; 
	}	

	location = /cms/ranking {
		return 302 /cms/ranking/;
	}
	location /cms/ranking/ {
		proxy_pass http://cms-rank/;
		proxy_buffering off;
	}	

	location /cms/<ANS> {
		return 302 https://hackmd.io/_uploads/rJMJQzcNn.png;
	}
	location /cms/96 {
		return 302 https://hackmd.io/@QYi6gllvSum0RZrW3jaysg/Sy75nf9Vn;
	}
	location /cms/96/ {
		return 302 https://hackmd.io/@QYi6gllvSum0RZrW3jaysg/Sy75nf9Vn;
	}
	location /cms/2000000080{
		return 302 https://hackmd.io/@ckefgisc-izcc/BkZzbzPQ0;	
	}
	location /cms/2000000080/{
		return 302 https://hackmd.io/@ckefgisc-izcc/BkZzbzPQ0;
	}

}


server {
    if ($host = iscoj.fg.tp.edu.tw) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

	if ($host = fgiscoj.fg.tp.edu.tw) {
	    return 301 https://$host$request_uri;
	} # managed by Certbot

	if ($host = iscoj.ckefgisc.org) {
	    return 301 https://$host$request_uri;
	} # managed by Certbot


	listen 80 default_server;
	listen [::]:80 default_server;
	server_name iscoj.fg.tp.edu.tw fgiscoj.fg.tp.edu.tw iscoj.ckefgisc.org;
    return 404; # managed by Certbot

}

# 啟用
sudo systemctl enable nginx

# 啟動
sudo systemctl start nginx

# 重啟
sudo systemctl restart nginx

# 更新設定檔後 reload
sudo systemctl reload nginx

# 關閉
sudo systemctl stop nginx

# 如果你沒有systemctl 可以使用nginx -s下達各種指令
nginx -s start/stop/reload

# 檢查conf檔案是否可用
nginx -t

# 自訂義conf檔案路徑
nginx -c [conf_file]

FROM ubuntu:latest

# Install Linux library dependency
RUN apt-get update
RUN apt-get install -y wget apt-transport-https gpg

# Install microsoft.gpg
RUN wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.asc.gpg
RUN mv microsoft.asc.gpg /etc/apt/trusted.gpg.d/
RUN wget -q https://packages.microsoft.com/config/ubuntu/18.04/prod.list
RUN mv prod.list /etc/apt/sources.list.d/microsoft-prod.list
RUN chown root:root /etc/apt/trusted.gpg.d/microsoft.asc.gpg
RUN chown root:root /etc/apt/sources.list.d/microsoft-prod.list

# Install .NET Core SDK
RUN apt-get update
RUN apt-get install -y dotnet-sdk-2.1

# Display Greeting
CMD [ "echo", "Ubuntu 18.04 LTS with .NET Core 2.1"]

FROM ubuntu:20.04

RUN apt-get update && apt-get upgrade -y
RUN apt-get install -y \
    build-essential \
    cgroup-lite \
    cppreference-doc-en-html \
    fp-compiler \
    git \
    haskell-platform \
    libcap-dev \
    libcups2-dev \
    libffi-dev \
    libpq-dev \
    libyaml-dev \
    mono-mcs \
    openjdk-8-jdk-headless \
    php7.4-cli \
    postgresql-client \
    python3-pip \
    python3.8 \
    python3.8-dev \
    rustc \
    sudo \
    wait-for-it \
    zip \
    vim

# Create cmsuser user with sudo privileges
RUN useradd -ms /bin/bash cmsuser && \
    usermod -aG sudo cmsuser
# Disable sudo password
RUN echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
# Set cmsuser as default user
USER cmsuser

COPY --chown=cmsuser:cmsuser . /home/cmsuser/cms

WORKDIR /home/cmsuser/cms
EXPOSE 8888-8890

RUN sudo pip3 install -r requirements.txt
RUN sudo pip3 install -r dev-requirements.txt
RUN sudo python3 setup.py install

RUN sudo python3 prerequisites.py --yes --cmsuser=cmsuser install

RUN sudo sed 's/cmsuser:0000@localhost/postgres@db/' ./config/cms.conf.sample \
    | sudo tee /usr/local/etc/cms.conf

ENV LANG C.UTF-8

CMD [""]

version: '3'
services:
  web:
    image: my-web-app:latest
    ports:
      - "5000:5000"
    depends_on:
      - redis
  redis:
    image: redis:alpine

version: "3.7"

x-logging:
  &default-logging
  driver: "json-file"
  options:
    max-size: "100m"
    max-file: "2"

services:
  web:
    build:
      context: ./
      args:
        MYSQL_ROOT_PASSWORD: $MYSQL_ROOT_PASSWORD
        TIOJ_KEY: $FETCH_KEY
    environment:
      - RAILS_ENV=production
      - SMTP_USERNAME
      - SMTP_PASSWORD
      - SMTP_PORT
      - SMTP_ADDRESS
      - MAIL_HOSTNAME
      - MAIL_SENDER
    volumes:
      - /srv/tioj/web-td:/tioj/td
      - /srv/tioj/web-log:/tioj/log
      - /srv/tioj/public:/tioj/public
    depends_on:
      - db
    networks:
      - app
    ports:
      - "4000:4000"
    logging: *default-logging
  db:
    image: mysql:8.0
    volumes:
      - /srv/tioj/db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD
      - MYSQL_DATABASE=tioj_production
    networks:
      - app
    logging: *default-logging
  judge:
    build: https://github.com/TIOJ-INFOR-Online-Judge/tioj-judge.git#ddb2f430eb7b6a4561ed23c1ef2ad94fcafc5b22
    environment:
      TIOJ_URL: "http://localhost:4000"
      TIOJ_KEY: $FETCH_KEY
    volumes:
      - /srv/tioj/judge-td-pool:/var/lib/tioj-judge/td-pool
      - /srv/tioj/judge-testdata:/var/lib/tioj-judge/testdata
    tmpfs:
      - /tmp:exec
    privileged: true
    network_mode: host
    pid: host
    logging: *default-logging

networks:
  app:

version: "3"
services:

  oj-redis:
    image: redis:4.0-alpine
    container_name: oj-redis
    restart: always
    volumes:
      - ./data/redis:/data
  
  oj-postgres:
    image: postgres:10-alpine
    container_name: oj-postgres
    restart: always
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=onlinejudge
      - POSTGRES_USER=onlinejudge
      - POSTGRES_PASSWORD=onlinejudge

  judge-server:
    image: registry.cn-hangzhou.aliyuncs.com/onlinejudge/judge_server
    container_name: judge-server
    restart: always
    read_only: true
    cap_drop:
      - SETPCAP
      - MKNOD
      - NET_BIND_SERVICE
      - SYS_CHROOT
      - SETFCAP
      - FSETID
    tmpfs:
      - /tmp
    volumes:
      - ./data/backend/test_case:/test_case:ro
      - ./data/judge_server/log:/log
      - ./data/judge_server/run:/judger
    environment:
      - SERVICE_URL=http://judge-server:8080
      - BACKEND_URL=http://oj-backend:8000/api/judge_server_heartbeat/
      - TOKEN=CHANGE_THIS
      # - judger_debug=1
  
  oj-backend:
    image: registry.cn-hangzhou.aliyuncs.com/onlinejudge/oj_backend
    container_name: oj-backend
    restart: always
    depends_on:
      - oj-redis
      - oj-postgres
      - judge-server
    volumes:
      - ./data/backend:/data
    environment:
      - POSTGRES_DB=onlinejudge
      - POSTGRES_USER=onlinejudge
      - POSTGRES_PASSWORD=onlinejudge
      - JUDGE_SERVER_TOKEN=CHANGE_THIS
      - FORCE_HTTPS=1
      # - STATIC_CDN_HOST=cdn.oj.com
    ports:
      - "0.0.0.0:8000:8000"
      - "0.0.0.0:1443:1443"

# 啟動服務
docker compose up

# 在背景執行
docker compose up -d

# 停止服務
docker compose down

# 指定檔案名稱
docker compose up -f customname.yml