資訊通識
&
Server

sudo apt update
sudo apt install nginx

user www-data; ##設定 Nginx 使用 www-data 用戶執行。
worker_processes auto; ##自動調整工作進程的數量
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf; ##包含額外的模塊配置文件

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	# server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}


#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#	server {
#		listen     localhost:110;
#		protocol   pop3;
#		proxy      on;
#	}
#
#	server {
#		listen     localhost:143;
#		protocol   imap;
#		proxy      on;
#	}
#}

server {
	listen 80 default_server;
	listen [::]:80 default_server;

	root /var/www/html;

	index index.html index.htm index.nginx-debian.html;

	server_name _;

	location / {
		try_files $uri $uri/ =404;
	}
}

upstream api {
    server localhost:5000;
}

server {
    listen 80;
    listen [::]:80;
    server_name dian.cjtsai.com;
    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;


    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
            proxy_pass http://api/;
    }
}

server {
    server_name iscoj.fg.tp.edu.tw iscoj.ckefgisc.org;
    location /{
        proxy_pass http://tioj/;

        proxy_set_header X-Real-IP $remote_addr;
    	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    	proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header Host $http_host;
        proxy_redirect off;

        # 舊網址 to 新網址格式 (with s)
        rewrite "^/problem/(.*)$" /problems/$1 permanent;
    }

#iscoj auto refresh and external judge server connection
    location /cable {
        proxy_pass http://localhost:4000/cable;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400; # 1 day
    }
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
  	# 憑證與金鑰的路徑
    ssl_certificate /etc/letsencrypt/live/iscoj.fg.tp.edu.tw/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/iscoj.fg.tp.edu.tw/privkey.pem; # managed by Certbot
}

server {
    if ($host = iscoj.fg.tp.edu.tw) {
        return 301 https://$host$request_uri;
    } # managed by Certbot
    if ($host = fgiscoj.fg.tp.edu.tw) {
        return 301 https://$host$request_uri;
    } # managed by Certbot
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name iscoj.fg.tp.edu.tw fgiscoj.fg.tp.edu.tw;
    return 404; # managed by Certbot

}

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#

#	passenger_enabled on;


map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}


upstream vscode{
	server 0.0.0.0:8443;
	keepalive 16;
}
upstream websocket{
	server 0.0.0.0:3000;
	keepalive 16;
}
upstream tioj {
	server 0.0.0.0:4000;
	keepalive 16;
}

upstream qduoj {
	server 0.0.0.0:1443;
	keepalive 16;
}

upstream cms {
	server 0.0.0.0:8890;
	keepalive 8;
}

upstream cms-admin {
	server 0.0.0.0:8891;
	keepalive 8;
}

upstream cms-rank {
	server 0.0.0.0:8892;
	keepalive 8;
}


# fgiscoj -> qduoj
server {
	listen 443 ssl;
  	listen [::]:443 ssl;

  	# 憑證與金鑰的路徑
    ssl_certificate /etc/letsencrypt/live/iscoj.fg.tp.edu.tw/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/iscoj.fg.tp.edu.tw/privkey.pem; # managed by Certbot

	root /var/www/html;
	server_name fgiscoj.fg.tp.edu.tw;

	location /{
		proxy_pass https://qduoj/;
		# 把 IP、Protocol 等 header 都一起送給反向代理的 server
		proxy_set_header X-Real-IP $remote_addr;
      	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      	proxy_set_header X-Forwarded-Proto https;
      	proxy_set_header X-Forwarded-Server $host;
      	proxy_set_header Host $http_host;
      	proxy_redirect off;
	}
}


server {

	# SSL configuration
	#
	listen 443 ssl default_server;
	listen [::]:443 ssl default_server;
	
  	# 憑證與金鑰的路徑
    ssl_certificate /etc/letsencrypt/live/iscoj.fg.tp.edu.tw/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/iscoj.fg.tp.edu.tw/privkey.pem; # managed by Certbot
	# Note: You should disable gzip for SSL traffic.
	# See: https://bugs.debian.org/773332
	#
	# Read up on ssl_ciphers to ensure a secure configuration.
	# See: https://bugs.debian.org/765782
	#
	# Self signed certs generated by the ssl-cert package
	# Don't use them in a production server!
	#
	# include snippets/snakeoil.conf;

	root /var/www/html;

	# Add index.php to the list if you are using PHP
	# index index.html index.htm index.nginx-debian.html;
	
	server_name iscoj.fg.tp.edu.tw iscoj.ckefgisc.org; 
	location /{
		proxy_pass http://tioj/;

		# 把 IP、Protocol 等 header 都一起送給反向代理的 server
		proxy_set_header X-Real-IP $remote_addr;
      	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      	proxy_set_header X-Forwarded-Proto https;
      	proxy_set_header X-Forwarded-Server $host;
      	proxy_set_header Host $http_host;
      	proxy_redirect off;
		

        # 舊網址 to 新網址格式 (with s) 
		rewrite "^/problem/(.*)$" /problems/$1 permanent;
	}
	
#iscoj auto refresh and external judge server connection

    location /cable {
        proxy_pass http://localhost:4000/cable;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400; # 1 day
    }	
	
	location = /problem {
		return 302 /problem/;
	}
	
	location = /vscode {
		return 302 /vscode/;
	}
	location /vscode/ {
		proxy_pass http://127.0.0.1:8443/;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header Host $http_host;
		proxy_set_header X-NginX-Proxy true;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";
		proxy_redirect off;
	}

	location = /cms {
		return 302 /cms/;
	}
	location /cms/ {
		proxy_pass http://cms/;  
	}	

	location = /cms/admin {
		return 302 /cms/admin/;
	}
	location /cms/admin/ {
		proxy_pass http://cms-admin/; 
	}	

	location = /cms/ranking {
		return 302 /cms/ranking/;
	}
	location /cms/ranking/ {
		proxy_pass http://cms-rank/;
		proxy_buffering off;
	}	

	location /cms/<ANS> {
		return 302 https://hackmd.io/_uploads/rJMJQzcNn.png;
	}
	location /cms/96 {
		return 302 https://hackmd.io/@QYi6gllvSum0RZrW3jaysg/Sy75nf9Vn;
	}
	location /cms/96/ {
		return 302 https://hackmd.io/@QYi6gllvSum0RZrW3jaysg/Sy75nf9Vn;
	}
	location /cms/2000000080{
		return 302 https://hackmd.io/@ckefgisc-izcc/BkZzbzPQ0;	
	}
	location /cms/2000000080/{
		return 302 https://hackmd.io/@ckefgisc-izcc/BkZzbzPQ0;
	}

}


server {
    if ($host = iscoj.fg.tp.edu.tw) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

	if ($host = fgiscoj.fg.tp.edu.tw) {
	    return 301 https://$host$request_uri;
	} # managed by Certbot

	if ($host = iscoj.ckefgisc.org) {
	    return 301 https://$host$request_uri;
	} # managed by Certbot


	listen 80 default_server;
	listen [::]:80 default_server;
	server_name iscoj.fg.tp.edu.tw fgiscoj.fg.tp.edu.tw iscoj.ckefgisc.org;
    return 404; # managed by Certbot

}

# 啟用
sudo systemctl enable nginx

# 啟動
sudo systemctl start nginx

# 重啟
sudo systemctl restart nginx

# 更新設定檔後 reload
sudo systemctl reload nginx

# 關閉
sudo systemctl stop nginx

# 查看狀態
sudo systemctl status nginx

##
# 無法啟動？
# 檢查誰占用了 80 port （通常是 apache2）
sudo lsof -i -P -n | grep LISTEN

# 把 apache 關掉
sudo systemctl stop apache2

# 如果你沒有systemctl 可以使用nginx -s下達各種指令
nginx -s start/stop/reload

# 檢查conf檔案是否可用
nginx -t

# 自訂義conf檔案路徑
nginx -c [conf_file]

FROM ubuntu:latest #抓取預設映像檔

VOLUME /data #使 /data 跨工作階段保存
WORKDIR /data #指定在 /data 工作

COPY . . #將現有的東西複製進去

RUN apt install -y neofetch 
# 注意 -y 很重要 不然 apt 會跳prompt
# 它會讓你永遠install不完
RUN whatever you want
# 記得不要有會等待的東西就好

EXPOSE 3000
# 向外部開啟3000口(通常做測試用)

CMD ["rails", "s"]
# 啟動服務 這時如果這個指令停下整個container也會停下
# 所以通常是放 node server.js / rails s 之類的東西

COPY . .

FROM ubuntu:latest

# Install Linux library dependency
RUN apt-get update
RUN apt-get install -y wget apt-transport-https gpg

# Install microsoft.gpg
RUN wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.asc.gpg
RUN mv microsoft.asc.gpg /etc/apt/trusted.gpg.d/
RUN wget -q https://packages.microsoft.com/config/ubuntu/18.04/prod.list
RUN mv prod.list /etc/apt/sources.list.d/microsoft-prod.list
RUN chown root:root /etc/apt/trusted.gpg.d/microsoft.asc.gpg
RUN chown root:root /etc/apt/sources.list.d/microsoft-prod.list

# Install .NET Core SDK
RUN apt-get update
RUN apt-get install -y dotnet-sdk-2.1

# Display Greeting
CMD [ "echo", "Ubuntu 18.04 LTS with .NET Core 2.1"]

FROM ubuntu:20.04

RUN apt-get update && apt-get upgrade -y
RUN apt-get install -y \
    build-essential \
    cgroup-lite \
    cppreference-doc-en-html \
    fp-compiler \
    git \
    haskell-platform \
    libcap-dev \
    libcups2-dev \
    libffi-dev \
    libpq-dev \
    libyaml-dev \
    mono-mcs \
    openjdk-8-jdk-headless \
    php7.4-cli \
    postgresql-client \
    python3-pip \
    python3.8 \
    python3.8-dev \
    rustc \
    sudo \
    wait-for-it \
    zip \
    vim

# Create cmsuser user with sudo privileges
RUN useradd -ms /bin/bash cmsuser && \
    usermod -aG sudo cmsuser
# Disable sudo password
RUN echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
# Set cmsuser as default user
USER cmsuser

COPY --chown=cmsuser:cmsuser . /home/cmsuser/cms

WORKDIR /home/cmsuser/cms
EXPOSE 8888-8890

RUN sudo pip3 install -r requirements.txt
RUN sudo pip3 install -r dev-requirements.txt
RUN sudo python3 setup.py install

RUN sudo python3 prerequisites.py --yes --cmsuser=cmsuser install

RUN sudo sed 's/cmsuser:0000@localhost/postgres@db/' ./config/cms.conf.sample \
    | sudo tee /usr/local/etc/cms.conf

ENV LANG C.UTF-8

CMD [""]

docker exec -it container_name bash

version: '3'
services:
  web:
    image: my-web-app:latest
    ports:
      - "5000:5000"
    depends_on:
      - redis
  redis:
    image: redis:alpine

version: "3.7"

x-logging:
  &default-logging
  driver: "json-file"
  options:
    max-size: "100m"
    max-file: "2"

services:
  web:
    build:
      context: ./
      args:
        MYSQL_ROOT_PASSWORD: $MYSQL_ROOT_PASSWORD
        TIOJ_KEY: $FETCH_KEY
    environment:
      - RAILS_ENV=production
      - SMTP_USERNAME
      - SMTP_PASSWORD
      - SMTP_PORT
      - SMTP_ADDRESS
      - MAIL_HOSTNAME
      - MAIL_SENDER
    volumes:
      - /srv/tioj/web-td:/tioj/td
      - /srv/tioj/web-log:/tioj/log
      - /srv/tioj/public:/tioj/public
    depends_on:
      - db
    networks:
      - app
    ports:
      - "4000:4000"
    logging: *default-logging
  db:
    image: mysql:8.0
    volumes:
      - /srv/tioj/db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD
      - MYSQL_DATABASE=tioj_production
    networks:
      - app
    logging: *default-logging
  judge:
    build: https://github.com/TIOJ-INFOR-Online-Judge/tioj-judge.git#ddb2f430eb7b6a4561ed23c1ef2ad94fcafc5b22
    environment:
      TIOJ_URL: "http://localhost:4000"
      TIOJ_KEY: $FETCH_KEY
    volumes:
      - /srv/tioj/judge-td-pool:/var/lib/tioj-judge/td-pool
      - /srv/tioj/judge-testdata:/var/lib/tioj-judge/testdata
    tmpfs:
      - /tmp:exec
    privileged: true
    network_mode: host
    pid: host
    logging: *default-logging

networks:
  app:

version: "3"
services:

  oj-redis:
    image: redis:4.0-alpine
    container_name: oj-redis
    restart: always
    volumes:
      - ./data/redis:/data
  
  oj-postgres:
    image: postgres:10-alpine
    container_name: oj-postgres
    restart: always
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=onlinejudge
      - POSTGRES_USER=onlinejudge
      - POSTGRES_PASSWORD=onlinejudge

  judge-server:
    image: registry.cn-hangzhou.aliyuncs.com/onlinejudge/judge_server
    container_name: judge-server
    restart: always
    read_only: true
    cap_drop:
      - SETPCAP
      - MKNOD
      - NET_BIND_SERVICE
      - SYS_CHROOT
      - SETFCAP
      - FSETID
    tmpfs:
      - /tmp
    volumes:
      - ./data/backend/test_case:/test_case:ro
      - ./data/judge_server/log:/log
      - ./data/judge_server/run:/judger
    environment:
      - SERVICE_URL=http://judge-server:8080
      - BACKEND_URL=http://oj-backend:8000/api/judge_server_heartbeat/
      - TOKEN=CHANGE_THIS
      # - judger_debug=1
  
  oj-backend:
    image: registry.cn-hangzhou.aliyuncs.com/onlinejudge/oj_backend
    container_name: oj-backend
    restart: always
    depends_on:
      - oj-redis
      - oj-postgres
      - judge-server
    volumes:
      - ./data/backend:/data
    environment:
      - POSTGRES_DB=onlinejudge
      - POSTGRES_USER=onlinejudge
      - POSTGRES_PASSWORD=onlinejudge
      - JUDGE_SERVER_TOKEN=CHANGE_THIS
      - FORCE_HTTPS=1
      # - STATIC_CDN_HOST=cdn.oj.com
    ports:
      - "0.0.0.0:8000:8000"
      - "0.0.0.0:1443:1443"

# 啟動服務
docker-compose up

# 在背景執行
docker-compose up -d

# 停止服務
docker-compose down

雪溱老師您好：
我是建中電研的學術長吳亞倫，也是先前負責管理網頁伺服器的同學。

首先，我要對不慎刪除伺服器當中設定檔一事，向老師道歉。
當初7/30日時，當時虛擬機器被重啟之後，網站docker的啟動出了問題。但是，當我連線到伺服器時卻發覺伺服器的port被別的東西佔用了，導致我無法按照說明文件的方式啟用網站。而當時學長也不清楚伺服器的現況，但因為我太心急要處理暑訓的東西，因此便自己試著要嘗試解決，因此嘗試了一些網路上的做法，也因此可能不慎動到了不該動到的地方。最後我是將systemctl的nginx停掉之後才得以正常啟動網站。後來網站也一直以此方式運作到九月多。
對於此自行修理一事我感到非常的抱歉。我應該要在交接伺服器使用權之後便主動向老師您聯絡，並且了解伺服器的狀態。但是我卻反而單獨聽信網路上的說明文件與指令胡亂嘗試，才動到不該動的地方，造成了老師以及北資同學的麻煩。

其實，在老師將伺服器關機的這一段時間內，我一直對於此事感到十分的自責，同時，我也花了許多時間去研究伺服器相關的知識以及相同問題的處理方式，希望能夠挽救回伺服器，也為我闖的禍負責。

因此，我希望老師可以答應我的請求，讓我一同參與接下來伺服器修理或是轉移到新伺服器的工作，讓我有一次彌補過錯的機會，並且從老師的教導當中學習更多。我保證我皆會在經過老師允許之後才對伺服器進行修理及調整。
另外，為了避免再犯相同錯誤，我會詳細的紀錄下此修理過程，並且在明年詳細的交接給學弟妹，避免他們和我犯下一樣的錯誤。
此外，我也懇求老師能夠將原本伺服器暫時開機，讓我將原本的題目等資料備份下來，使得學弟妹能夠暫時以其他方式進行練習。

我知道我的錯誤使得老師十分生氣，實在不應該再提出這種請求。但是我非常希望能夠彌補我的錯誤，因此誠心希望老師能夠同意讓我協助北資的同學一起進行之後的修理工作。希望老師願意原諒我的錯誤。

以下是我的聯絡資訊:
email: xxxxxxxxxx
line ID: xxxxxxxxxxxx
希望能夠收到老師您的回覆

Sincerely, 
吳亞倫 敬上