feat/wakatime integration- #249 plus tools/reference_stack_compose with wakapi

tools/reference_stack_compose/nginx/compose.yaml

@@ -0,0 +1,37 @@
+services:
+  nginx:
+    image: nginx:stable-alpine
+    container_name: nginx
+    hostname: nginx
+    restart: always
+
+    volumes:
+      - ${SSL_KEY_FILE}:/certs/nginx_key.pem:ro
+      - ${SSL_CERT_FILE}:/certs/nginx_certificate.pem:ro
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - /var/www/acme:/var/www/acme:ro
+      - ./static:/var/www/static
+
+    ports:
+      - "0.0.0.0:443:443"
+      - "0.0.0.0:80:80"
+      - ":::443:443"
+      - ":::80:80"
+
+    environment:
+      NGINX_WORKER_PROCESSES: "4"
+      NGINX_WORKER_CONNECTIONS: "768"
+
+    networks:
+      - overleaf-network
+
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsI --connect-timeout 10 http://localhost || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
+networks:
+  overleaf-network:
+    external: true

tools/reference_stack_compose/nginx/nginx.conf

@@ -0,0 +1,71 @@
+events {}
+http {
+    server {
+        listen 80 default_server;
+        listen [::]:80 default_server;
+        server_name _;
+        # ACME challenge — must come before the redirect
+        location /.well-known/acme-challenge/ {
+            root /var/www/acme;
+        }
+        # Everything else redirects to HTTPS
+        location / {
+            return 301 https://$host$request_uri;
+        }
+    }
+
+	server {
+		listen 443 ssl;
+		listen [::]:443 ssl;
+		ssl_certificate      /certs/nginx_certificate.pem;
+		ssl_certificate_key  /certs/nginx_key.pem;
+		ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
+		ssl_prefer_server_ciphers   on;
+		ssl_ciphers                 EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+		add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
+		server_tokens off;
+		client_max_body_size 50M;
+
+		location / {
+			proxy_pass http://overleaf:80;
+			proxy_set_header X-Forwarded-Proto $scheme;
+			proxy_http_version 1.1;
+			proxy_set_header Upgrade $http_upgrade;
+			proxy_set_header Connection "upgrade";
+			proxy_set_header Host $host;
+			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+			proxy_read_timeout 3m;
+			proxy_send_timeout 3m;
+			proxy_hide_header Cache-Control;
+			add_header Cache-Control "no-store" always;
+		}
+		location /ub/ {
+			alias /var/www/static/ub/;
+			try_files $uri =404;
+			types {
+				image/svg+xml svg;
+			}
+		}
+
+		# Bundled Wakapi (WakaTime-compatible server) — UI + API under /wakapi.
+		# Wakapi 2.18.2 contract: the app serves its routes at / and uses
+		# WAKAPI_BASE_PATH=/wakapi only for the URLs/cookies it generates —
+		# so the proxy must STRIP the prefix (trailing slash on proxy_pass):
+		# /wakapi/login → /login, while its links stay /wakapi/… end-to-end.
+		# Security: strip any client-supplied identity header — only the overleaf
+		# container (pinned source IP) may use the trusted-header identity.
+		# /wakapi (exact) → canonical form with trailing slash
+		location = /wakapi {
+			return 301 /wakapi/;
+		}
+		location /wakapi/ {
+			proxy_pass http://wakapi:3000/;
+			proxy_set_header Remote-User "";
+			proxy_set_header X-Forwarded-Proto $scheme;
+			proxy_set_header Host $host;
+			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+			proxy_http_version 1.1;
+		}
+	}
+}
+

tools/reference_stack_compose/nginx/static/ub/logo.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 39.761 39.761" width="32" height="32"><path d="M8.184 15.336c0 3.648 3.035 6.551 6.679 6.551 3.649 0 6.684-2.836 6.684-6.551v-13.5h-3.309v13.5c0 1.824-1.484 3.242-3.304 3.242-1.758 0-3.309-1.418-3.309-3.242v-13.5H8.184Z" style="fill:#d7193a;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="scale(1.33333)"/><path d="M24.789 1.836v13.5c0 5.469-4.523 9.855-9.992 9.855-5.535 0-9.988-4.32-9.988-9.855v-13.5H1.5v13.5C1.5 22.695 7.508 28.5 14.797 28.5c7.359 0 13.297-5.805 13.297-13.164v-13.5z" style="fill:#d7193a;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="scale(1.33333)"/></svg>