for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do
    sudo apt-get remove -y $pkg
done

sudo apt-get update
sudo apt-get install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

echo deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable \
| sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
cat /etc/apt/sources.list.d/docker.list

sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

systemctl is-enabled docker containerd
sudo docker run --rm hello-world
docker compose version

sudo usermod -aG docker TU_USUARIO
exit

groups
docker ps

sudo tee /etc/docker/daemon.json > /dev/null <<'EOF'
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}
EOF
sudo systemctl restart docker
docker info --format '{{.LoggingDriver}}'

docker run -d --name prueba -p 8080:80 nginx:alpine

sudo ufw status | grep 8080 || echo "UFW no tiene ninguna regla para el 8080"
sudo ss -tlpn | grep 8080

docker rm -f prueba

docker run -d --name demo nginx:alpine
docker ps
docker logs demo
docker exec -it demo sh

docker stop demo
docker ps
docker ps -a
docker rm demo
docker images
docker image prune -a

sudo mkdir -p /opt/apps
sudo chown TU_USUARIO:TU_USUARIO /opt/apps
mkdir -p /opt/apps/it-tools
cd /opt/apps/it-tools
pwd

tee /opt/apps/it-tools/compose.yaml > /dev/null <<'EOF'
services:
  it-tools:
    image: corentinth/it-tools:latest
    container_name: it-tools
    restart: unless-stopped
    ports:
      - "127.0.0.1:8081:80"
EOF
cat /opt/apps/it-tools/compose.yaml

cd /opt/apps/it-tools
docker compose up -d
docker compose ps
curl -I http://127.0.0.1:8081

cd /opt/apps/it-tools
sed -i 's|corentinth/it-tools:latest|corentinth/it-tools:TU_VERSION|' compose.yaml
grep image compose.yaml
docker compose up -d
docker compose ps

sudo tee /etc/nginx/conf.d/websocket.conf > /dev/null <<'EOF'
# Ebenezer: soporte de WebSocket para las aplicaciones detrás del proxy
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}
EOF

sudo tee /etc/nginx/snippets/proxy.conf > /dev/null <<'EOF'
# Ebenezer: ajustes comunes para reenviar a una aplicación
proxy_http_version 1.1;
proxy_set_header Host              $host;
proxy_set_header X-Real-IP         $remote_addr;
proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade           $http_upgrade;
proxy_set_header Connection        $connection_upgrade;
proxy_read_timeout 60s;
EOF
sudo nginx -t

sudo tee /etc/nginx/sites-available/herramientas.TU_DOMINIO > /dev/null <<'EOF'
server {
    listen 80;
    listen [::]:80;
    server_name herramientas.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}
EOF
sudo ln -s /etc/nginx/sites-available/herramientas.TU_DOMINIO /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

sudo certbot certonly --webroot -w /var/www/letsencrypt -d herramientas.TU_DOMINIO --dry-run
sudo certbot certonly --webroot -w /var/www/letsencrypt -d herramientas.TU_DOMINIO --cert-name herramientas.TU_DOMINIO

sudo tee /etc/nginx/sites-available/herramientas.TU_DOMINIO > /dev/null <<'EOF'
# HTTP: Let's Encrypt y redirección a HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name herramientas.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS: reenvío a IT-Tools (contenedor en 127.0.0.1:8081)
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name herramientas.TU_DOMINIO;

    ssl_certificate     /etc/letsencrypt/live/herramientas.TU_DOMINIO/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/herramientas.TU_DOMINIO/privkey.pem;
    include snippets/tls.conf;

    add_header Strict-Transport-Security "max-age=86400" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        proxy_pass http://127.0.0.1:8081;
        include snippets/proxy.conf;
    }

    access_log /var/log/nginx/herramientas.access.log;
    error_log  /var/log/nginx/herramientas.error.log;
}
EOF
sudo nginx -t && sudo systemctl reload nginx

cd /opt/apps/it-tools
sed -i 's|it-tools:VERSION_ANTERIOR|it-tools:VERSION_NUEVA|' compose.yaml
docker compose pull
docker compose up -d
docker compose ps
docker image prune -f

systemctl is-enabled docker containerd
docker compose -f /opt/apps/it-tools/compose.yaml ps
sudo ss -tlpn | grep -E ':(80|443|8081) '
sudo nginx -t
sudo certbot renew --dry-run

sudo reboot
# ...espera un minuto, ssh lab, y:
docker ps