warnings.embeddedDatabase=false

$ apt-get install python-certbot-nginx -t stretch-backports

$ certbot --nginx certonly -d example.com

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/example.com/fullchain.pem. Your cert will
   expire on 2019-04-22. To obtain a new or tweaked version of this
   certificate in the future, simply run certbot again with the
   "certonly" option. To non-interactively renew *all* of your
   certificates, run "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

$ certbot --nginx renew

$ certbot --nginx renew --dry-run

$ ls /etc/letsencrypt/live/example.com
Output:
cert.pem  chain.pem  fullchain.pem  privkey.pem

$ apt-get update
$ apt-get install nginx

$ systemctl status nginx
Output:
● nginx.service - A high-performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2019-01-21 14:42:01 CET; 20h ago
     Docs: man:nginx(8)
  Process: 7947 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid (code=exited, status=0/SUCCESS)
  Process: 7953 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
  Process: 7950 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
 Main PID: 7955 (nginx)
    Tasks: 9 (limit: 4915)
   CGroup: /system.slice/nginx.service
           ├─7955 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
           ├─7956 nginx: worker process

$ systemctl stop nginx

$ systemctl start nginx

$ systemctl restart nginx

# Server block for insecure http connections on port 80. Redirect to https on port 443
server {
        listen          80;
        listen          [::]:80;
        server_name     example.com;
        return          301 https://$server_name$request_uri;
}

# Server block for secure https connections
server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name webanno.lingterm.net;

        ssl on;

        # Replace certificate paths
        ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/example.com/fullchain.pem;

        # Modern SSL Config from
        # https://mozilla.github.io/server-side-tls/ssl-config-generator/
        ssl_protocols TLSv1.2;
        ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
        ssl_prefer_server_ciphers on;
        ssl_session_timeout 1d;
        ssl_session_tickets off;
        add_header Strict-Transport-Security max-age=15768000;
        ssl_stapling on;
        ssl_stapling_verify on;

        ignore_invalid_headers off; #pass through headers from WebAnno which are considered invalid by NGINX server.

        # Change body size if needed. This defines the maximum upload size for files.
        client_max_body_size    10M;

        # Uncommend this for a redirect from example.com to example.com/webanno
        #location / {
        #    return 301 https://$host/webanno;
        #}

        location ^~ /webanno/ {
            proxy_pass http://127.0.0.1:8080/webanno/;
            proxy_redirect default;
            proxy_http_version 1.1;

            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;
            proxy_max_temp_file_size 0;

            proxy_connect_timeout      180;
            proxy_send_timeout         180;
            proxy_read_timeout         180;

            proxy_temp_file_write_size 64k;

            # Required for new HTTP-based CLI
            proxy_request_buffering off;
            proxy_buffering off; # Required for HTTP-based CLI to work over SSL
            proxy_set_header Connection ""; # Clear for keepalive
    }

    # Deny access to Apache .htaccess files. They have no special meaning for NGINX and might leak sensitive information
    location ~ /\.ht {
            deny all;
    }
}

$ ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com

$ nginx -t
Output:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

$ service nginx restart

server.tomcat.internal-proxies=127\.0\.[0-1]\.1
server.tomcat.remote-ip-header=x-forwarded-for
server.tomcat.accesslog.request-attributes-enabled=true
server.tomcat.protocol-header=x-forwarded-proto
server.tomcat.protocol-header-https-value=https

<Server>
  <Service>
    <Engine>
      <Host>
        ...
        <!-- Announce NGINX proxy header fields to WebAnno
        <Valve className="org.apache.catalina.valves.RemoteIpValve"
                internalProxies="127\.0\.[0-1]\.1"
                remoteIpHeader="x-forwarded-for"
                requestAttributesEnabled="true"
                protocolHeader="x-forwarded-proto"
                protocolHeaderHttpsValue="https"/>
        <!-- -->

        ...
      </Host>
    </Engine>
  </Service>
</Server>

$ service webanno restart

wicket.core.csrf.enabled=false
wicket.core.csrf.no-origin-action=allow
wicket.core.csrf.conflicting-origin-action=allow

docker run -it --name webanno -p8080:8080 webanno/webanno:3.6.11

docker run -d --name webanno -p8080:8080 webanno/webanno:3.6.11

docker logs webanno

docker start -ai webanno

docker start webanno

$ mkdir /srv/webanno

docker run -it --name webanno -v /srv/webanno:/export -p8080:8080 webanno/webanno:3.6.11

##
# docker-compose up [-d]
# docker-compose down
##
version: '2.1'

networks:
  webanno-net:

services:
  mysqlserver:
    image: "mysql:5"
    environment:
      - MYSQL_RANDOM_ROOT_PASSWORD=yes
      - MYSQL_DATABASE=webanno
      - MYSQL_USER=DBUSER
      - MYSQL_PORT=3306
      - MYSQL_PASSWORD=DBPASSWORD
    volumes:
      - ${WEBANNO_HOME}/mysql-data:/var/lib/mysql
    command: ["--character-set-server=utf8", "--collation-server=utf8_bin"]
    healthcheck:
      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost", "-pDBPASSWORD", "-uDBUSER"]
      interval: 20s
      timeout: 10s
      retries: 10
    networks:
      webanno-net:

  webserver:
    image: "${WEBANNO_IMAGE:-webanno/webanno}:${WEBANNO_VERSION:-3.6.11}"
    ports:
      - "${WEBANNO_PORT}:8080"
    environment:
      - WEBANNO_DB_DIALECT=org.hibernate.dialect.MySQL5InnoDBDialect
      - WEBANNO_DB_DRIVER=com.mysql.jdbc.Driver
      - WEBANNO_DB_URL=jdbc:mysql://mysqlserver:3306/webanno?useSSL=false&useUnicode=true&characterEncoding=UTF-8
      - WEBANNO_DB_USERNAME=DBUSER
      - WEBANNO_DB_PASSWORD=DBPASSWORD
    volumes:
      - ${WEBANNO_HOME}/server-data:/export
    depends_on:
      mysqlserver:
        condition: service_healthy
    restart: unless-stopped
    networks:
      webanno-net:

export WEBANNO_HOME=/srv/webanno
export WEBANNO_PORT=8080
docker-compose -p webanno up -d

docker logs webanno_mysqlserver_1
docker logs webanno_webserver_1

docker-compose -p webanno down

$ service webanno stop

$ mv /opt/webanno /opt/webanno-tomcat7

$ apt-get install tomcat8-user

$ cd /opt
$ tomcat8-instance-create -p 18080 -c 18005 webanno
$ chown -R www-data /opt/webanno

$ mv /opt/webanno-tomcat7/webapps/webanno.war /opt/webanno/webapps/webanno.war

$ service webanno start