172.18.0.1 - - [23/Jun/2026:18:10:59 +0000] "GET /hub/api/rest/users/me?fields=guest,endUserAgreementConsent(accepted,majorVersion,minorVersion) HTTP/2.0" 200 29 "https://youtrack.aycon.su/projects/TR/agiles/195-2/current" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" "-"
172.18.0.1 - - [23/Jun/2026:18:10:59 +0000] "GET /hub/api/rest/settings/public?fields=endUserAgreement(enabled,text,majorVersion,minorVersion,requiredForREST) ​​HTTP/2.0" 200 109 "https://youtrack.aycon.su/projects/TR/agiles/195-2/current" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" "-"
172.18.0.1 - - [23/Jun/2026:18:15:00 +0000] "GET /SDK/webLanguage HTTP/1.1" 404 146 "-" "Mozilla/5.0" "-"
172.18.0.1 - - [23/Jun/2026:18:16:59 +0000] "GET / HTTP/1.1" 400 248 "-" "Mozilla/5.0" "-"
172.18.0.1 - - [23/Jun/2026:18:19:27 +0000] "GET / HTTP/1.1" 200 529 "-" "Go-http-client/1.1" "-"
172.18.0.1 - - [23/Jun/2026:18:21:28 +0000] "GET / HTTP/1.1" 200 529 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46" "-"
172.18.0.1 - - [23/Jun/2026:18:21:38 +0000] "GET /SDK/webLanguage HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46" "-"
172.18.0.1 - - [23/Jun/2026:18:22:30 +0000] "GET / HTTP/1.1" 200,896 "-" "Mozilla/5.0" "-"
172.18.0.1 - - [23/Jun/2026:18:22:36 +0000] "GET /robots.txt HTTP/1.1" 200 306 "-" "Mozilla/5.0 (compatible; FreePBX-Scanner/1.0)" "-"
172.18.0.1 - - [23/Jun/2026:18:22:36 +0000] "GET /robots.txt HTTP/1.1" 400 248 "-" "Mozilla/5.0 (compatible; FreePBX-Scanner/1.0)" "-"
172.18.0.1 - - [23/Jun/2026:18:23:14 +0000] "GET /.git/index HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" "-"

172.22.0.1 - - [21/Jun/2026:13:16:53 +0000] "GET /.env HTTP/1.1" 404 178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" "-"
172.22.0.1 - - [21/Jun/2026:13:16:53 +0000] "POST / HTTP/1.1" 405,552 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" "-"
172.22.0.1 - - [21/Jun/2026:13:16:54 +0000] "GET /.env HTTP/1.1" 200 306 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" "-"
172.22.0.1 - - [21/Jun/2026:13:16:54 +0000] "POST / HTTP/1.1" 405,552 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" "-"
172.22.0.1 - - [21/Jun/2026:13:20:21 +0000] "GET /dispatch.asp HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46" "-"
172.22.0.1 - - [21/Jun/2026:13:22:30 +0000] "GET /robots.txt HTTP/1.1" 200 306 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-"
172.22.0.1 - - [21/Jun/2026:13:22:33 +0000] "GET / HTTP/1.0" 200 896 "-" "-" "-"
172.22.0.1 - - [21/Jun/2026:13:23:41 +0000] "GET / HTTP/1.1" 200 896 "-" "curl/7.68.0" "-"
172.22.0.1 - - [21/Jun/2026:13:23:51 +0000] "GET / HTTP/1.1" 200 896 "-" "curl/7.68.0" "-"
172.22.0.1 - - [21/Jun/2026:13:26:12 +0000] "SSH-2.0-Go" 400 150 "-" "-" "-"
172.22.0.1 - - [21/Jun/2026:13:27:20 +0000] "GET /login HTTP/1.1" 404 146 "-" "Go-http-client/1.1" "-"
172.22.0.1 - - [21/Jun/2026:13:29:05 +0000] "GET / HTTP/1.1" 200 529 "-" "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity" "-"
172.22.0.1 - - [21/Jun/2026:13:30:37 +0000] "GET / HTTP/1.1" 200 529 "-" "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36" "-"

services:
    auth_db:
        build:
            context: ./auth_db
            dockerfile: Dockerfile
        volumes:
            - ./auth_db/data:/var/lib/postgresql/18/docker
        env_file:
            - ./auth_db/.env
        shm_size: 128mb
        restart: always
        # expose:
        #     - "5432"
        ports:
            - "5432:5432"
        networks:
            - services_web

    auth_service:
        build:
            context: ./auth_service
            dockerfile: Dockerfile
        container_name: auth_service
        restart: always
        expose:
            - "8080"
        depends_on:
            - auth_db
        networks:
            - services_web

    web_service:
        build:
            context: ./web_service
            dockerfile: Dockerfile
        container_name: web_service
        volumes:
            - ./web_service/dist:/app/dist
        environment:
            - WATCHPACK_POLLING=true
        depends_on:
            - auth_service
        networks:
            - services_web

    youtrack:
        image: jetbrains/youtrack:2026.1.13570
        container_name: youtrack
        restart: always
        isolation: default
        expose:
            - "8080"
        volumes:
            - ./youtrack/data:/opt/youtrack/data
            - ./youtrack/conf:/opt/youtrack/conf
            - ./youtrack/logs:/opt/youtrack/logs
            - ./youtrack/backups:/opt/youtrack/backups
        networks:
            - services_web

    nginx:
        image: nginx:latest
        container_name: nginx_proxy
        restart: always
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
            - ./nginx/sites-enabled:/etc/nginx/sites-enabled:ro
            - ./nginx/mime.types:/etc/nginx/mime.types:ro
            - ./nginx/logs/access.log:/var/log/nginx/access.log
            - ./nginx/logs/error.log:/var/log/nginx/error.log
            - ./web_service/dist:/usr/share/nginx/static:ro
            - ./certbot/certs/archive/$RS_DOMAIN/fullchain1.pem:/etc/nginx/ssl/fullchain.pem:ro
            - ./certbot/certs/archive/$RS_DOMAIN/privkey1.pem:/etc/nginx/ssl/privkey.pem:ro
            - ./nginx/default.conf:/etc/nginx/conf.d/default.conf
        # environment:
        #     - NGINX_ENTRYPOINT_QUIET_LOGS=1
        depends_on:
            - youtrack
            - web_service
            - auth_service
        networks:
            - services_web

networks:
    services_web:
        driver: bridge

server {
    listen       80 proxy_protocol;
    listen  [::]:80 proxy_protocol;
    server_name  localhost;

    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #    root           html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}

# User & group that will be used by worker processes.
# For security use a user & group with limited privileges.
user www-data www-data;

# The file that will store a processes id of the main process.
pid /run/nginx.pid;

# Number of worker processes. The optimial value depends on many things:
# number of CPU cores, number of storage drives, etc. Setting it to a total
# number of CPU cores is good starting point, or just leave it to `auto`.
# Max number of connections = worker_processes * worker_connections
worker_processes auto;

# Max number of open files (RLIMIT_NOFILE) for worker processes.
# Should be > worker_connections.
worker_rlimit_nofile 8192;

error_log  /var/log/nginx/error.log error;

events {
    # Max number of simultaneous connections that can be opened by the worker
    # processes. The simultaneous connections cannot exceed the maximum
    # number of open files, thus: worker_connections < worker_rlimit_nofile.
    worker_connections 8000;
}

http {
    set_real_ip_from  172.16.0.0/12;
    set_real_ip_from  192.168.1.1;
    # real_ip_header    X-Forwarded-For;
    real_ip_header proxy_protocol;
    real_ip_recursive on;

    # Enable or disable emitting nginx version on response's header.
    server_tokens off;

    # Max size & bucket size for the server names hash table.
    server_names_hash_max_size 1024;
    server_names_hash_bucket_size 32;

    # Max size & bucket size for the mime types hash table.
    types_hash_max_size 2048;
    types_hash_bucket_size 32;

    # Speed up static file transfers by using the sendfile() rather than the
    # read() and write() combination. sendfile() has the ability to transfer
    # data from the file descriptor.
    sendfile on;

    # Optimize the amount of data that is being sent at once. Prevent Nginx
    # from sending a partial frame. As a result it will increases the
    # throughput, since TCP frames will be filled up before being sent out.
    # You also need to activate the `sendfile` option.
    tcp_nopush on;

    # By default, the TCP stack implements a mechanism to delay sending the
    # data up to 200ms. To force a socket to send the data in its buffer
    # immediately we can turn this option on.
    tcp_nodelay on;

    # A timeout of which a keep-alive connection will stay open. Longer
    # duration are better for client, especially on SSL, the downside is the
    # worker connection is occupied longer.
    keepalive_timeout 20s;

    # Mime types.
    include mime.types;
    default_type application/octet-stream;

    # Update the charset to match the updated mime.types.
    # By efault the `text/html` is always included by the charset module.
    charset_types
        text/css
        text/plain
        text/vnd.wap.wml
        application/javascript
        application/json
        application/rss+xml
        application/xml;

    # Request log format.
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    
    access_log /var/log/nginx/access.log main;

    # Enable gzip compression.
    gzip on;

    # Gzip compression level (1-9).
    # 5 is a perfect compromise between size and CPU usage, offering about
    # 75% reduction for most ASCII files (almost identical to level 9).
    gzip_comp_level 5;

    # Don't compress a small file that is unlikely to shrink much. The small
    # file is also usually ended up in larger file sizes after gzipping.
    gzip_min_length 256;

    # Compress data even for a proxied connection.
    gzip_proxied any;

    # Cache both the regular and the gzipped versions of a resource whenever
    # client's Accept-Encoding capabilities header varies.
    gzip_vary on;

    # Compress all of the following mime-types, `text/html` is always
    # compressed.
    gzip_types
        application/atom+xml
        application/javascript
        application/json
        application/ld+json
        application/manifest+json
        application/rss+xml
        application/vnd.geo+json
        application/vnd.ms-fontobject
        application/x-font-ttf
        application/x-web-app-manifest+json
        application/xhtml+xml
        application/xml
        font/opentype
        image/bmp
        image/svg+xml
        image/x-icon
        text/cache-manifest
        text/css
        text/plain
        text/vcard
        text/vnd.rim.location.xloc
        text/vtt
        text/x-component
        text/x-cross-domain-policy;

    # Include other custom configurations.
    include conf.d/*.conf;

    # Include site configurations.
    include sites-enabled/*;
}

server {
    listen 80 proxy_protocol;
    listen [::]:80 proxy_protocol;

    # The www and non-www host server name.
    server_name youtrack.aycon.su;

    # Redirect to the non-www HTTPS version.
    return 301 https://youtrack.aycon.su$request_uri;
}

server {
    http2 on;
    listen 443 ssl proxy_protocol;
    listen [::]:443 ssl proxy_protocol;
    server_name youtrack.aycon.su;
    client_max_body_size 200m;
    ssl_certificate ssl/fullchain.pem;
    ssl_certificate_key ssl/privkey.pem;

    location / {
        proxy_pass http://youtrack:8080;

        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_buffering off;
    }
}

server {
    listen 80 proxy_protocol;
    listen [::]:80 proxy_protocol;

    server_name tail-resone.aycon.su;

    return 301 https://tail-resone.aycon.su$request_uri;
}

server {
    http2 on;
    listen 443 ssl proxy_protocol;
    listen [::]:443 ssl proxy_protocol;
    server_name tail-resone.aycon.su;

    ssl_certificate ssl/fullchain.pem;
    ssl_certificate_key ssl/privkey.pem;

    root /usr/share/nginx/static/;
    index index.html;

    location / {
        try_files $uri $uri/ /index.html;
    }

    location /auth/ {
        proxy_pass http://auth_service:8080/;

        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_buffering off;
    }
}