DOMjudge 9

• Sign in to the Azure portal, choose Create a resource, search the Marketplace for DOMjudge by SecureAnyCloud and choose Create.
• On Basics pick your subscription, resource group, region and size (Standard_B2ms or larger). Under Administrator account choose SSH public key (recommended) or Password.
• Under Inbound port rules allow SSH (22), HTTP (80) and HTTPS (443), then narrow SSH to your management network.
• Choose Review + create, and then Create. First boot finishes within about two minutes of the VM starting.

Run these commands on your workstation. Use your own resource group, network and key, and the image URN shown on the Marketplace listing.

az vm image terms accept --urn <marketplace-image-urn>
az vm create \
  --resource-group <your-rg> \
  --name domjudge \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name domjudge --port 80,443 --priority 1010

ssh azureuser@<vm-public-ip>

First boot writes your VM's credentials to a root-only file:

sudo cat /root/domjudge-credentials.txt

It looks like this (your values differ):

domjudge.url=https://203.0.113.10/ domjudge.admin.user=admin domjudge.admin.pass=<generated-per-vm> domjudge.demo.user=demo domjudge.demo.pass=<generated-per-vm> domjudge.judgehost.user=judgehost domjudge.judgehost.pass=<generated-per-vm> domjudge.db.name=domjudge domjudge.db.user=domjudge domjudge.db.pass=<generated-per-vm>

domjudge.url is the site address: /etc/sac/domjudge-hostname if that file exists, otherwise the VM's public IP address from Azure's instance metadata, else its private IP address. admin is the jury administrator, demo is the team account of the demo contest, and judgehost is the account judgehosts use to talk to the REST API. If you keep credentials centrally, copy them into Azure Key Vault.

systemctl is-active mariadb php8.3-fpm nginx create-cgroups domjudge-judgedaemon@0 ls /var/lib/sac/data/domjudge-firstboot.done

All five services print active, and the first-boot marker exists. First boot runs once, so after a reboot its unit shows as skipped, which is expected. Only 22, 80 and 443 listen on a public address. MariaDB (3306) and the local resolver listen on localhost:

sudo ss -Hltn | awk '{print $4}' | sort -u

The site answers over HTTPS on its configured name, port 80 redirects to HTTPS, and a request naming any other host is dropped (curl prints 000):

SITE=$(sudo sed -n 's#^domjudge.url=https://\([^/]*\)/#\1#p' /root/domjudge-credentials.txt)
PRIV=$(hostname -I | awk '{print $1}')
curl -sk -o /dev/null -w "%{http_code}\n" --resolve "${SITE}:443:127.0.0.1" "https://${SITE}/public"
curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" -H "Host: ${SITE}" "http://${PRIV}/public"
curl -sk -o /dev/null -w "%{http_code}\n" -H "Host: evil.example" "https://${PRIV}/" || true

MariaDB holds only the socket-authenticated system accounts and DOMjudge's own account, and listens on loopback only:

sudo mariadb -N -e "SELECT CONCAT(User,'@',Host) FROM mysql.global_priv ORDER BY 1; SELECT @@bind_address;"

The local judgehost has registered with the domserver. The admin password goes to curl in a configuration stream, never on its command line:

P=$(sudo sed -n 's/^domjudge.admin.pass=//p' /root/domjudge-credentials.txt)
curl -s -K <(printf 'user = "admin:%s"\n' "${P}") http://127.0.0.1/api/v4/judgehosts \
  | python3 -c 'import sys,json;[print(j["hostname"], "enabled" if j["enabled"] else "disabled") for j in json.load(sys.stdin)]'

The services cannot reach the Azure metadata endpoints. This command runs a small connection probe from inside php8.3-fpm.service as www-data, and then from your shell. The first probe prints verdict=BLOCKED (IMDS and the wire server are unreachable while loopback works). The second shows imds4=REACHABLE:

CG=$(systemctl show -p ControlGroup --value php8.3-fpm.service)
sudo bash -c "echo \$\$ > /sys/fs/cgroup${CG}/cgroup.procs; exec setpriv --reuid=www-data --regid=www-data --init-groups /usr/local/sbin/sac-egress-probe php8.3-fpm.service" /usr/local/sbin/sac-egress-probe your-shell || true

• Open domjudge.url from Step 4 in a browser. Plain http:// redirects to HTTPS. The public scoreboard of the demo contest is at /public.
• The certificate is self-signed and unique to your VM, so the browser warns the first time. Accept it, or install a trusted certificate (Step 9).
• Choose Login, enter admin and the domjudge.admin.pass value, and sign in.

The jury interface opens. Before contest holds contests, problems, languages, teams and users. During contest holds clarifications, submissions, rejudgings and the scoreboard. Administrator holds the configuration settings and the config checker.

The demo contest (demo) is created on first boot, runs for five hours from then, and has three problems: hello, fltcmp and boolfind. Submit a correct solution to hello as the demo team through the REST API, then read the verdict as the jury:

D=$(sudo sed -n 's/^domjudge.demo.pass=//p' /root/domjudge-credentials.txt)
P=$(sudo sed -n 's/^domjudge.admin.pass=//p' /root/domjudge-credentials.txt) printf '#include <stdio.h>\nint main(void) { puts("Hello world!"); return 0; }\n' > /tmp/hello.c
SID=$(curl -s -K <(printf 'user = "demo:%s"\n' "${D}") -F problem=hello -F language=c -F "code[]=@/tmp/hello.c" \
  http://127.0.0.1/api/v4/contests/demo/submissions | python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])') for i in $(seq 1 30); do
V=$(curl -s -K <(printf 'user = "admin:%s"\n' "${P}") "http://127.0.0.1/api/v4/contests/demo/judgements?submission_id=${SID}" \
  | python3 -c 'import sys,json;print(next((j["judgement_type_id"] for j in json.load(sys.stdin) if j.get("end_time")), ""))') [ -n "${V}" ] && break; sleep 2 done echo "submission ${SID}: ${V}"

It prints the submission ID and AC (accepted). The submission appears in the jury's Submissions list with the result CORRECT, and on the scoreboard.

Teams normally submit through the team interface: they sign in with their own account, choose Submit, pick the problem and language, and upload their source file.

To serve the site on your own DNS name, point a DNS record (for example in Azure DNS) at the VM's public IP (a Standard SKU public IP is static), then run on the VM:

sudo domjudge-set-hostname <your-dns-name>

The helper writes the name to /etc/sac/domjudge-hostname, sets the nginx server_name, issues a new self-signed certificate for the name, updates domjudge.url in the credentials file and reloads nginx.

The site certificate is /etc/ssl/domjudge/domjudge.crt and its key /etc/ssl/domjudge/domjudge.key (mode 600, root). To use Let's Encrypt, first set your DNS name (Step 8), allow port 80 from the internet in the network security group, then:

sudo apt-get install -y certbot
sudo certbot certonly --standalone -d contest.example.org \
  --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx" \
  --deploy-hook "install -m 644 \$RENEWED_LINEAGE/fullchain.pem /etc/ssl/domjudge/domjudge.crt && install -m 600 \$RENEWED_LINEAGE/privkey.pem /etc/ssl/domjudge/domjudge.key"

certbot keeps the hooks for every renewal. Running domjudge-set-hostname again replaces the certificate with a self-signed one, so run sudo certbot renew --force-renewal afterwards. For a certificate from another authority, copy the full chain and key to the same two paths and run sudo systemctl reload nginx.

• In the jury interface open Contests and create a contest (or edit demo): set its short name, start and end times, and make it public or private.
• Under Problems import problems as Kattis/ICPC problem packages (zip), then add them to the contest.
• Under Teams and Users create the teams and one user per team (or import them as TSV/JSON under Import / export). Manage team passwords generates passwords for every team.
• Under Languages enable the languages your contest allows. The judging chroot ships compilers for C, C++, Java and Python 3 (PyPy).
• Use Config checker to confirm the setup before the contest starts.

To set a user's password, use Users in the jury interface. You type the password into the form, so it is never placed on a command line.

More judging capacity. The local judgehost judges one submission at a time. For a larger contest, install DOMjudge's judgehost on additional VMs (same release, 9.0.1) and point them at https://<your-host>/api with the judgehost user and domjudge.judgehost.pass from Step 4 in their restapi.secret. Allow 443 from those VMs only, and give each judgehost its own CPU cores for consistent timing.

Component Version Notes

DOMjudge 9.0.1 Official release tarball, GPL-2.0-or-later, installed in /opt/domjudge

PHP libraries Symfony 6.4.48, Twig 3.30, league/commonmark 2.10 DOMjudge's bundled libraries updated to their latest releases within DOMjudge's own version constraints, to include published security fixes

nginx Ubuntu 24.04 package (1.24) TLS front end on 80/443 and the loopback judgehost channel

PHP 8.3 (FPM) DOMjudge's own pool on a unix socket

MariaDB 10.11 127.0.0.1 only; created on first boot

Judging chroot Ubuntu 24.04 (debootstrap) GCC, G++, OpenJDK, PyPy 3

grep DOMJUDGE_VERSION /opt/domjudge/domserver/etc/domserver-static.php nginx -v 2>&1; php -v | head -n 1; mariadb --version

Path Purpose

/opt/domjudge/domserver domserver: web application, bin/dj_console, etc/ secrets (mode 640, root:www-data)

/opt/domjudge/judgehost judgehost: bin/judgedaemon, bin/runguard, etc/restapi.secret, judgings/ work area

/chroot/domjudge The chroot submissions are compiled and run in

/etc/nginx/sites-available/domjudge nginx site; /etc/nginx/domjudge-host.conf holds the configured name

/etc/ssl/domjudge/ Site certificate and key

/etc/sac/domjudge-hostname Your configured site name (created by domjudge-set-hostname)

/var/lib/mysql MariaDB data (created on first boot)

/root/domjudge-credentials.txt Your credentials (mode 600, root)

/var/lib/sac/data/domjudge-firstboot.done First boot marker; nginx and the judgehost start only when it exists

systemctl status nginx php8.3-fpm mariadb domjudge-judgedaemon@0 --no-pager -n 0

Restart the judgehost with sudo systemctl restart domjudge-judgedaemon@0 and reload nginx with sudo systemctl reload nginx. DOMjudge's command-line tools run as the web server user, for example sudo -u www-data /opt/domjudge/domserver/bin/dj_console list domjudge. Logs: sudo journalctl -u domjudge-judgedaemon@0 for the judge, /var/log/nginx/domjudge*.log and /opt/domjudge/domserver/webapp/var/log/ for the domserver.

DOMjudge's own tool dumps the database (as root, over the local socket):

sudo /opt/domjudge/domserver/bin/dj_setup_database -s dump domjudge-$(date +%Y%m%d)
sudo ls /opt/domjudge/domserver/db-dumps/

The dump holds every account's password hash, so keep it private: run sudo chmod 600 on it and encrypt it at rest. Copy it to Azure Blob Storage or another durable destination. dj_setup_database -s load <name> restores it. Azure Backup or a snapshot of the OS disk is a simple whole-VM backup.

The browser cannot connect, or the connection is dropped. Browse to the configured name (domjudge.url in Step 4); other host names are dropped by design. Check that ports 80 and 443 are allowed in the network security group.

nginx or the judgehost is not running after deployment. Both start only after first boot completes:

ls -la /var/lib/sac/data/domjudge-firstboot.done
sudo journalctl -u domjudge-firstboot --no-pager | tail -n 20

Submissions stay pending. Check that the judgehost is running and enabled (jury Judgehosts page, or systemctl status domjudge-judgedaemon@0), and look at its log with sudo journalctl -u domjudge-judgedaemon@0 --no-pager | tail -n 30. The contest must be active and the language enabled.

• Keep port 22 limited to your management network, and limit 80/443 to your contest network during a contest if you can.
• Change the admin password under Users if you share it with anyone, and give each jury member their own account with the jury role.
• Teams' code runs inside runguard's sandbox (its own network namespace, the chroot, CPU and memory limits); keep the judgehost on the same release as the domserver.
• The bundled PHP libraries were updated within DOMjudge's version constraints when the image was built. One library, enshrined/svg-sanitize 0.22 (used only when a jury member or administrator uploads or imports a problem with an SVG image), has advisories fixed only in a newer major release that DOMjudge 9.0.1 does not accept; only import problem packages from sources you trust.
• Apply Ubuntu security updates regularly (sudo apt-get update && sudo apt-get upgrade); unattended security updates are enabled.