warnings.embeddedDatabase=false

$ apt-get install python-certbot-nginx -t stretch-backports

$ certbot --nginx certonly -d example.com

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/example.com/fullchain.pem. Your cert will
   expire on 2019-04-22. To obtain a new or tweaked version of this
   certificate in the future, simply run certbot again with the
   "certonly" option. To non-interactively renew *all* of your
   certificates, run "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

$ certbot --nginx renew

$ certbot --nginx renew --dry-run

$ ls /etc/letsencrypt/live/example.com
Output:
cert.pem  chain.pem  fullchain.pem  privkey.pem

$ apt-get update
$ apt-get install nginx

$ systemctl status nginx
Output:
● nginx.service - A high-performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2019-01-21 14:42:01 CET; 20h ago
     Docs: man:nginx(8)
  Process: 7947 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid (code=exited, status=0/SUCCESS)
  Process: 7953 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
  Process: 7950 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
 Main PID: 7955 (nginx)
    Tasks: 9 (limit: 4915)
   CGroup: /system.slice/nginx.service
           ├─7955 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
           ├─7956 nginx: worker process

$ systemctl stop nginx

$ systemctl start nginx

$ systemctl restart nginx

# Server block for insecure http connections on port 80. Redirect to https on port 443
server {
        listen          80;
        listen          [::]:80;
        server_name     example.com;
        return          301 https://$server_name$request_uri;
}

# Server block for secure https connections
server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name inception.example.com;

        ssl on;

        # Replace certificate paths
        ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/example.com/fullchain.pem;

        # Modern SSL Config from
        # https://mozilla.github.io/server-side-tls/ssl-config-generator/
        ssl_protocols TLSv1.2;
        ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
        ssl_prefer_server_ciphers on;
        ssl_session_timeout 1d;
        ssl_session_tickets off;
        add_header Strict-Transport-Security max-age=15768000;
        ssl_stapling on;
        ssl_stapling_verify on;

        ignore_invalid_headers off; #pass through headers from INCEpTION which are considered invalid by NGINX server.

        # Change body size if needed. This defines the maximum upload size for files.
        client_max_body_size    10M;

        # Uncommend this for a redirect from example.com to example.com/inception
        #location / {
        #    return 301 https://$host/inception;
        #}

        location ^~ /inception/ {
            proxy_pass http://127.0.0.1:8080/inception/;
            proxy_redirect default;
            proxy_http_version 1.1;

            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;
            proxy_max_temp_file_size 0;

            proxy_connect_timeout      180;
            proxy_send_timeout         180;
            proxy_read_timeout         180;

            proxy_temp_file_write_size 64k;

            # Required for new HTTP-based CLI
            proxy_request_buffering off;
            proxy_buffering off; # Required for HTTP-based CLI to work over SSL
            proxy_set_header Connection ""; # Clear for keepalive
    }

    # Deny access to Apache .htaccess files. They have no special meaning for NGINX and might leak sensitive information
    location ~ /\.ht {
            deny all;
    }
}

$ ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com

$ nginx -t
Output:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

$ service nginx restart

server.tomcat.internal-proxies=127\.0\.[0-1]\.1
server.tomcat.remote-ip-header=x-forwarded-for
server.tomcat.accesslog.request-attributes-enabled=true
server.tomcat.protocol-header=x-forwarded-proto
server.tomcat.protocol-header-https-value=https

$ service inception restart

wicket.core.csrf.enabled=false
wicket.core.csrf.no-origin-action=allow
wicket.core.csrf.conflicting-origin-action=allow

$ docker run -it --name inception -p8080:8080 inceptionproject/inception:0.17.4

$ docker run -d --name inception -p8080:8080 inceptionproject/inception:0.17.4

$ docker logs inception

$ docker start -ai inception

$ docker start inception

$ mkdir /srv/inception

$ docker run -it --name inception -v /srv/inception:/export -p8080:8080 inceptionproject/inception:0.17.4

##
# docker-compose up [-d]
# docker-compose down
##
version: '2.1'

networks:
  inception-net:

services:
  mysqlserver:
    image: "mysql:5"
    container_name: inception_mysql
    environment:
      - MYSQL_RANDOM_ROOT_PASSWORD=yes
      - MYSQL_DATABASE=inception
      - MYSQL_USER=${DBUSER}
      - MYSQL_PORT=3306
      - MYSQL_PASSWORD=${DBPASSWORD}
    volumes:
      - ${INCEPTION_HOME}/mysql-data:/var/lib/mysql
    command: ["--character-set-server=utf8", "--collation-server=utf8_bin"]
    healthcheck:
      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost", "-p${DBPASSWORD}", "-u${DBUSER}"]
      interval: 20s
      timeout: 10s
      retries: 10
    networks:
      inception-net:

  webserver:
    image: "inceptionproject/inception:0.17.4"
    container_name: inception_webserver
    ports:
      - "${INCEPTION_PORT}:8080"
    environment:
      - INCEPTION_DB_DIALECT=org.hibernate.dialect.MySQL5InnoDBDialect
      - INCEPTION_DB_DRIVER=com.mysql.jdbc.Driver
      - INCEPTION_DB_URL=jdbc:mysql://mysqlserver:3306/inception?useSSL=false&useUnicode=true&characterEncoding=UTF-8
      - INCEPTION_DB_USERNAME=${DBUSER}
      - INCEPTION_DB_PASSWORD=${DBPASSWORD}
    volumes:
      - ${INCEPTION_HOME}/server-data:/export
    depends_on:
      mysqlserver:
        condition: service_healthy
    mem_limit: 1g
    memswap_limit: 1g
    restart: unless-stopped
    networks:
      inception-net:

$ export DBUSER=<USER_NAME>
$ export DBPASSWORD=<PASSWORD>
$ export INCEPTION_HOME=/srv/inception
$ export INCEPTION_PORT=8080
$ docker-compose -p inception up -d

$ docker logs inception_mysqlserver_1
$ docker logs inception_webserver_1

$ docker ps

$ docker-compose -p inception down