Programming-Contests/README.md

ACPC 2026 contest image

This repository builds bootable USB sticks for ACPC 2026 at atlantic-canada26.kattis.com. It starts from the ICPC image icpc2027-2026-09-29, based on Ubuntu 26.04.1. Teams use an account without administrator rights, with compilers configured for the contest and local copies of the language documentation. The network and device restrictions run on each contest machine, so campus staff do not have to install a separate network firewall.

Building the image

The build machine needs qemu-base, qemu-img, edk2-ovmf, ansible, sshpass, e2fsprogs, fuse3 and curl. These are the Arch Linux package names. Hardware virtualization through KVM and about 30 GB of free disk space are also required. Run the build from a regular account, with a private administrator password in place of PASSWORD:

./build.sh --admin-pass 'PASSWORD'

The build downloads the ICPC image from image.icpc.global and compares its SHA-256 checksum with the value recorded in build.sh. This detects a download that differs from the expected image. Changes are written to build/acpc2026.qcow2, which stores the differences from the original image. Ansible configures that copy inside a virtual machine, then shuts it down.

Option	Default	Meaning
--admin-pass PASS	required	Password for the icpc administrator account and for editing the boot menu
--team-pass PASS	contest	Password for the team account
--base-image FILE	download	Use an existing, decompressed ICPC image, in raw .img format
--fresh		Discard the previous build and start from the ICPC image
--export		Also produce build/acpc2026.img for tools that require a raw disk image

Without --fresh, the playbooks are applied to the existing build. Use this to incorporate changes such as an updated domain list. To inspect the result, run ./run_vm.sh. Changes made in that test session are discarded when the virtual machine closes.

Writing the sticks

Run the following command on the build machine, replacing the device names with the intended USB disks. It lists the disks and requires the word ERASE before overwriting them. Every file on those disks will be lost.

sudo ./write_sticks.sh build/acpc2026.qcow2 /dev/sdb /dev/sdc /dev/sdd

Only USB disks are accepted, and the selected disks are written in parallel. Omit the device names to list the USB disks without writing them. Keep the original ICPC image at its existing path because the qcow2 file depends on it.

Accounts and administrator access

The full build separates the team account from the administrator account. Removing administrator rights from team prevents contestants from changing system files, installing system software or turning off the contest restrictions. Keep the administrator password with site staff.

Account	Password	Access
team	contest, or the value of --team-pass	Automatic desktop login, no sudo
icpc	The value of --admin-pass	Administrator access through sudo
root	Password login locked	Staff obtain root privileges through sudo from icpc

During the build, Ansible receives passwords through a temporary variables file that only the build user can read. The file is deleted when the build script exits, and the tasks that set passwords suppress their values in Ansible output. These measures limit exposure of administrator credentials in build files and logs.

The build removes team from the sudo group and replaces the administrator password inherited from the ICPC image. It also removes the temporary SSH configuration used during the build. In the finished image, SSH password authentication is disabled, SSH login is denied to the teams and judges groups, and the firewall rejects new incoming SSH connections. These measures prevent remote access through the temporary build login or a contestant account.

VS Code extension setup

The ICPC image includes a helper named /usr/local/bin/vscode-extension-install. It makes the preinstalled VS Code extensions available in a user's home directory and imports the certificate for the image's local extension server. This requires privileged filesystem mounts and ownership changes. The original image allowed every account to run that helper through sudo without a password, independently of membership in the sudo group.

The helper operates inside the calling user's home directory. A symbolic link is a filesystem reference to another path, and a user can create one in their home. A privileged helper that follows such a reference can modify files outside the intended directory. Removing team from the sudo group would therefore leave a separate route to privileged filesystem operations unless that special sudo permission was removed too.

accounts.yml deletes the special sudo rule and disables the helper's desktop autostart entry. The replacement, team-vscode-extensions.service, runs before the desktop starts and always prepares the account team. Its wrapper removes symbolic links at the certificate and extension paths it checks, refuses a home directory that is itself a symbolic link, and supplies the fixed user and group IDs of team to the original helper. Staff retain the preinstalled extensions without giving contestants permission to invoke the helper as root. The service also runs again after a staff member explicitly resets the team account.

Boot menu and protected files

GRUB is the program that starts Linux before the login screen. The build requires the GRUB user admin and the administrator password to edit boot entries or use the GRUB command line. This prevents contestants from changing the Linux startup options to bypass the normal login and account restrictions. Normal Ubuntu startup requires no password, and recovery entries are removed.

The file /etc/grub.d/01_acpc_password contains a PBKDF2 hash derived from the administrator password. A hash lets GRUB check a password without storing the password itself. Someone with a copy could still test password guesses against it, so the file is readable and executable only by root. The same administrator password protects the icpc account, which is another reason to keep this file private and choose a strong password.

The installed firewall, maintenance and reset helpers are owned by root, with no read or execute permission for the team account. Staff run them through sudo. These permissions prevent contestants from invoking the privileged maintenance commands or replacing their installed contents.

Languages

The contest languages are C, C++, Java and Python 3. Their compiler and interpreter versions match those displayed on the ACPC Kattis language pages, checked on October 15, 2026. The expected versions and compiler options are recorded in languages.yml and files/languages/. The build checks the installed versions against those recorded values and stops if they differ.

Language	Version	Commands
C	gcc-15 15.2.0	compilec, runc
C++	g++-15 15.2.0	compilecpp, runcpp
Java	javac and java 25.0.4.1	compilejava, runjava
Python 3	PyPy 7.3.23, implementing Python 3.11.15	compilepython3, runpython3

The ICPC image includes Java 25.0.4.1. Java is held at that version, and automatic package updates are disabled to keep compiler versions consistent across machines. When an existing build has a different Java version, the build installs the matching packages from the ICPC package repository and verifies each download against its recorded checksum.

The compilec, compilecpp and compilejava helpers add the compiler flags shown on the contest's Kattis pages. Teams can therefore compile with the judge's language standard, optimization, linking and encoding options without typing those flags themselves. For example, compilecpp main.cpp includes the GNU C++23, optimization and static linking flags used by Kattis. compilegcc and compileg++ are aliases for the C and C++ helpers. The Python helper checks syntax with the configured PyPy interpreter.

The run helpers use the published runtime options. Java uses a maximum heap of 2048 MB by default, which can be changed for a local run with a command such as MEMLIM=1024 runjava Main. Local runs do not reproduce the judge's time and memory enforcement.

IDEs and documentation

The image includes CLion, Code::Blocks, Eclipse, IntelliJ IDEA, PyCharm, VS Code and Geany. desktop.yml configures all 19 supported combinations of these IDEs and the contest languages. Defaults are installed in the team home and in /etc/skel, the directory used to create a replacement home after an explicitly requested reset.

IDE	Contest languages	Configured build and run actions
Geany	C, C++, Java, Python	F9 builds and F5 runs. C and C++ use the GCC 15 drivers, Java uses compilejava and runjava, and Python uses PyPy.
Code::Blocks	C, C++	F9 uses the default ACPC GCC 15 profile, with separate C and C++ drivers.
VS Code	C, C++, Java, Python	F6 runs ACPC: Build and run for the active file. Ctrl+Shift+B builds it. Java 25 and PyPy are configured, and the menu opens ~/contest because tasks require an open folder.
CLion	C, C++, Python	The Run action uses the GCC 15 toolchain and single-file templates for C and C++. New Python projects inherit PyPy.
IntelliJ IDEA	Java	The Run action uses the Java 25 SDK, UTF-8 encoding and the contest Java options.
PyCharm	Python	New projects inherit PyPy for the Run action.
Eclipse	C, C++, Java, Python	The menu prepares the contest workspace. Use ACPC Build and run for the active source file. Java 25, PyDev with PyPy, and GCC 15 drivers are configured.

files/desktop/configure_ides.py writes the IDE preferences and launch configurations. The C and C++ drivers in files/ide/ apply the contest language standard, optimization and static linking options before calling the corresponding system compiler. The acpc-solution command builds the selected source and runs it only if the build succeeds. Java compilation uses javac, and Python syntax checking and execution use PyPy.

The ordinary Java actions in Eclipse and VS Code use the Eclipse Java compiler, also called ECJ or JDT. Use their named ACPC actions to compile with the contest's javac command. For imported projects, alternative workspaces or Python virtual environments, follow the compiler checks in the technical notes. The notes also describe the remaining startup dialogs and where to enter program input.

JetBrains user agreements are accepted during preparation, data sharing is declined, and /home/team is marked as a trusted project location. The offline AI completion models and inference programs supplied with IntelliJ IDEA and PyCharm are removed to prevent their use for generated code during the contest. Access to online AI services, including those used by editor extensions, is restricted by the website allowlist.

Language documentation is available offline at https://devdocs/. The local DevDocs copy includes C, C++, OpenJDK 25 and Python 3.11. Kotlin documentation and the prompt to open the external DevDocs site are removed. The C manual pages, such as man 3 qsort, and Python documentation through pypy3 -m pydoc also work offline.

The Contest Help (offline) bookmark opens /usr/share/doc/acpc/help/index.html. It contains 12 searchable articles on input and output, end of file, local testing, judging and common C, C++, Java and Python questions. These are concise summaries of 17 selected Kattis help articles, with source links and instructions for this image. The text, search and layout are stored locally, so the page needs no external scripts, fonts or help widgets. The online help portal, support tickets and status subscriptions are outside the approved contest access.

The team instructions are in docs/TechNotes.pdf, built from docs/TechNotes.tex with LuaLaTeX. The build installs the PDF at /usr/share/doc/icpc/TechNotes.pdf, accessible from the Technical Notes bookmark. After changing the source, run lualatex TechNotes.tex in docs/ and rebuild the image.

Menus and browser

The original World Finals links and PC² submission commands are replaced with the ACPC pages on Kattis. The contest and documentation entries are available from the Applications menu and Firefox bookmarks. The submit and pc2submit commands print the Kattis submission address.

Location	Content
Firefox home page	The ACPC contest site
Firefox bookmarks	Contest, Problems, Standings, Contest Help (offline), Language Documentation, Technical Notes
Applications, Contest	Contest (Kattis), Problems, Standings, Contest Help (offline)
Applications, Documentation	Language Documentation, Technical Notes

Firefox's home page is locked to the contest site. Extension installation is blocked to prevent contestants from adding browser tools, and access to about:config is blocked to prevent changes through Firefox's advanced preferences screen. The preferences needed for website filtering are also locked by policy.

The image retains printfile for sites that provide printing. Staff must configure the printer and the firewall rules for its address and protocol before handing over a machine. Test printing from the team account with the contest restrictions enabled.

Clock

The system clock is synchronized by chrony, the time service. It uses the servers in ntp_servers.txt, with the timezone set to America/Moncton. At startup, the desktop waits up to about 30 seconds for synchronization. Correct time prevents misleading clock displays and browser certificate errors caused by an incorrect date.

The Ubuntu defaults use Network Time Security (NTS), which authenticates replies from time servers. NTS requires an additional connection on TCP port 4460, which this firewall does not permit. When those sources are configured but unreachable, chrony does not simply fall back to the ordinary time servers added for the contest. The installer disables Ubuntu's default source file so that chrony can use the servers in ntp_servers.txt. The protocol and source selection rules are described in the Ubuntu time synchronization guide and the chrony configuration manual.

If chrony still has no selected time server two minutes after boot, time_from_contest.timer checks once a minute and adjusts the clock from the date returned by the contest website. This provides a fallback when the campus network blocks ordinary time synchronization traffic. Chrony is configured not to copy its time to the hardware clock, to avoid changing the clock convention used by Windows on shared lab machines. Run sudo /test_firewall.sh to check the current synchronization status.

Network restrictions

The firewall permits HTTPS access to the names in allowed_domains.txt. DNS lookups, which translate names into addresses, go through a local filter, and time synchronization is restricted to chrony. Other new outgoing connections, new unsolicited incoming connections and forwarded traffic are blocked. The base ICPC image disables IPv6.

Control	What it is intended to prevent
Website allowlist applied to every program	Access to messaging, external code repositories, AI websites and other unapproved sites through a browser or command-line program
Local HTTPS proxy that checks the requested hostname	Access to an unapproved website merely because it shares a server address with Kattis or another allowed site
Local DNS filter and restricted access to DNS servers	Use of arbitrary DNS queries or an alternative resolver to communicate with an outside server
NTP access limited to chrony and the configured server addresses	Use of the time synchronization exception by contestant programs to contact other systems
Incoming and forwarding rules	Remote connections into a contest workstation and use of it to relay another device's network traffic
Rules applied across network interfaces	Avoiding the restrictions by sending traffic through another network connection
open.kattis.com excluded from the web allowlist and redirected locally in /etc/hosts	Access to the public Kattis practice site and past submissions through that hostname

The contest site uses Cloudflare, whose IP addresses are shared by many websites. Allowing those addresses alone would permit connections to unrelated sites hosted at the same addresses. The local proxy therefore checks the hostname sent at the start of an encrypted connection, called TLS Server Name Indication (SNI). It accepts only a listed hostname, resolves that name itself and opens the external connection under a dedicated service account. Contestant programs cannot open external HTTPS connections directly. Firefox's Encrypted Client Hello feature is disabled so that the proxy can read the hostname.

The proxy checks the connection's hostname without decrypting the page contents. Plain HTTP requests receive a local redirect to HTTPS. The DNS filter forwards lookups for the approved web domains and time servers to the resolvers in dns_servers.txt. Only the proxy and DNS service account can contact those resolvers directly.

Allowed domains and verification

The approved access covers the contest pages, Kattis password sign-in and status viewing. Teams sign in with their Kattis username or email address and password. External sign-in providers and webmail are blocked. Staff should ensure that issued team accounts have working passwords before the contest, including any password recovery that requires email.

The eight hostnames in allowed_domains.txt serve these pages and their supporting resources. The October 15, 2026 scan covered public contest pages, signed-in Open Kattis pages, login-related pages and service status. The table identifies where each hostname was observed during that scan.

Domain	Service	Evidence from the October 15, 2026 scan
atlantic-canada26.kattis.com	ACPC 2026 contest	Contest navigation, standings, rules, team pages and password login form
status.kattis.com	Kattis service status	Status page, history and charts
1v5nt68l4ppj.statuspage.io	Kattis status banner hosted by Atlassian	Status banner requests from Kattis pages
dka575ofm4ao0.cloudfront.net	Scripts, style sheets, fonts and images for the status page	Resources loaded by the status page
js.sentry-cdn.com, browser.sentry-cdn.com	Sentry browser error reporting code	Scripts loaded by public and signed-in Kattis pages
challenges.cloudflare.com	Cloudflare browser verification	Verification resources on registration and password-recovery pages
licensebuttons.net	License badges on problem pages	License badge in the Hello World problem's Metadata tab

Each web entry is an exact hostname. The Statuspage identifier and CloudFront name stayed the same across three fresh browser sessions in the October 15 scan. File paths, version hashes and query parameters can change within those hostnames without requiring a firewall edit.

To investigate a broken contest page, use the Network tab in Firefox's developer tools, opened with F12. sudo journalctl -t contest_proxy lists hostnames recorded by the proxy, including refused connections. Review any proposed addition before changing allowed_domains.txt and rebuilding the image. If the campus requires its own DNS or time servers, put their addresses or names in dns_servers.txt and ntp_servers.txt before building.

Connecting a workstation to Wi-Fi

Staff can connect Wi-Fi from the icpc administrator account while the contest restrictions remain enabled. NetworkManager saves the connection for automatic reconnection, including after a reboot. The team account cannot use the network controls to switch connections, edit saved profiles or turn Wi-Fi off. A USB Wi-Fi adapter should be connected before startup so that USBGuard accepts it with the other approved equipment.

For a network with a shared Wi-Fi password, open a terminal on the team desktop and run su - icpc. Enter the administrator password, then replace SSID with the approved network's name in these commands:

sudo nmcli radio wifi on
sudo nmcli device wifi list
sudo nmcli --ask device wifi connect "SSID" name "ACPC Wi-Fi" private no
sudo nmcli connection modify "ACPC Wi-Fi" connection.autoconnect yes connection.permissions ""

The --ask option prompts for the Wi-Fi password so it is not included in the command history. The connection is saved for the machine, and its credentials are stored in files readable only by root. Allowing the machine to reconnect does not grant the team account permission to change networks. These options are described in the NetworkManager command reference.

Review saved connections with sudo nmcli -f NAME,TYPE,AUTOCONNECT connection show. Remove any unapproved Wi-Fi profile with sudo nmcli connection delete "PROFILE NAME" so that the machine cannot reconnect to it automatically. If the approved profile already exists, use sudo nmcli connection up "ACPC Wi-Fi" to reconnect. There is no need to run contest-restrictions off network for this procedure.

Before handing over the workstation, check the active connection with nmcli connection show --active, run sudo contest-restrictions status and sudo /test_firewall.sh, then type exit to leave the administrator shell. The status must show the firewall, USB and network restrictions all on. Confirm that the approved Wi-Fi reconnects after a supervised restart on the actual contest hardware.

Campus networks that require an institutional username and certificate use an enterprise Wi-Fi profile. Have campus IT provide the authentication settings, trusted CA certificate and expected authentication-server name, and configure that profile before the contest. For a network with a web sign-in page, arrange contest access with campus IT in advance so teams do not need to open that page during the contest.

Devices and local restrictions

The device restrictions are installed by lockdown.yml. They prevent contestants from importing files through removable media, attaching devices that enter prepared text, or changing local settings that staff need to control. Staff can temporarily lift the USB and network restrictions with the maintenance command.

Control	What it is intended to prevent
USBGuard rejects USB devices connected after startup	Importing files from a new USB drive or entering prepared code through a device that poses as a keyboard
Desktop authorization rules deny disk and disk-image mounting to non-administrators	Opening removable drives or disk images through the desktop's storage service
Device rules remove automatic access to phones, cameras and media players	Copying files through phone or camera protocols that do not require a mounted disk
Network and modem configuration restricted to administrators	Changing Wi-Fi, hotspot, VPN or modem settings during the contest
Restart, shutdown, suspend and hibernation denied to non-administrators	Interrupting the workstation or restarting it with newly attached devices
Ctrl+Alt+Del, SysRq shortcuts, power and sleep keys, and lid actions disabled	Triggering those power actions through keyboard shortcuts or desktop power management
team removed from the printer administration group	Changing printers or writing printer administration files while retaining ordinary printing access

USB devices present when USBGuard starts are accepted, including the boot stick, keyboard and mouse. Staff should attach the intended equipment before startup. If a keyboard or mouse needs replacement during the contest, inspect the replacement and use sudo usbguard list-devices to find its number, then sudo usbguard allow-device NUMBER to authorize it.

Maintenance

Use the icpc administrator account for maintenance. contest-restrictions controls the firewall, USB restrictions and network configuration permissions. Restrict the change to the part needed for the repair.

sudo contest-restrictions status
sudo contest-restrictions off firewall
sudo contest-restrictions on firewall
sudo contest-restrictions report

Part	Effect of off
firewall	Allow network traffic and restore ordinary DNS resolution
usb	Stop USBGuard and allow the team account to use removable disks and phones
network	Allow the team account to change network settings
all	Apply all three changes

Use usb, network or all in place of firewall as needed. Omitting the part applies the command to all three. A disabled restriction stays disabled after a reboot until staff explicitly enable it again. After USB maintenance, disconnect temporary devices before running on usb, then check the devices that remain connected.

While any of these restrictions is off, a red banner appears across the top of the desktop. It reads “CONTEST RESTRICTIONS ARE OFF ON THIS MACHINE - CALL THE STAFF”. The banner process runs as root, has no close button and is restarted if it stops. Its purpose is to alert staff before a machine is returned to a team with maintenance access still enabled.

report summarizes refused website connections, DNS lookups and USB devices since midnight. To choose another starting time, use a command such as sudo contest-restrictions report "2026-10-23 12:00". Common background lookups from Firefox and the IDEs are counted separately. Use the report to investigate an incident or a page that failed to load, with the corresponding service logs for details.

The commands /disable_firewall.sh and /enable_firewall.sh are the firewall helpers called by contest-restrictions off firewall and contest-restrictions on firewall. They control the same firewall and preserve its state across reboots. Use contest-restrictions on the full image for a consistent maintenance procedure. The separate helpers remain available for installations that include only the firewall.

Manual deletion of the team's files

Running sudo /reset_team_home.sh permanently deletes the team's work on that machine. It stops the desktop session, so unsaved work in open applications is lost too. The script makes no backup and offers no undo.

This command is reserved for a deliberate staff decision to erase a team account. It is never started by boot, login, a timer, cron, the build playbooks or contest-restrictions. Do not add it to an automatic cleanup procedure, maintenance sequence or automated test. Routine troubleshooting, changing a restriction and rebooting a machine do not require a reset.

Before using it, identify the machine and team, obtain authorization from the staff member responsible for their work, and save and verify a copy of every file that must be retained. Check /tmp, /var/tmp and any other work directories as well as the home directory. The deletion includes /home/team and other files owned by team on the root filesystem. Treat team-owned temporary files, the team's crontab and any other team-owned work directory on that filesystem as part of the deletion. The script then recreates the home from /etc/skel and starts a new team desktop.

From an administrator terminal, run sudo /reset_team_home.sh only after those checks. The script asks for the exact word RESET before proceeding. After confirmation, a separate system service continues the deletion even when the terminal closes or the desktop disappears. Starting it through su - icpc in a team terminal has the same consequences and will terminate that desktop session. Treat confirmation as the point after which the team's files will be erased.

Onsite supervision checklist

These checks are for the staff supervising contestants and their workstations.

• Keep the prepared contest sticks under staff control until the workstations are ready for the teams.
• Supervise startup and any restart. Check that no unauthorized USB device is connected during boot. Confirm that the machine starts from the supplied contest stick, and have staff handle device replacements.
• Check that each team uses its assigned workstation, the team desktop account and its issued Kattis contest account.
• Confirm that each workstation uses the approved wired or Wi-Fi connection. Refer connection problems to technical staff instead of allowing teams to use personal hotspots.
• Keep administrator credentials private. Close administrator terminals and sessions before returning a workstation to a team.
• If the red restrictions banner appears, call technical staff and keep the workstation out of use until the restrictions are restored.
• Supervise maintenance and remove temporary devices afterward. Confirm that the warning banner has disappeared before the team resumes work.
• Report unexpected access to websites, personal accounts or devices to the contest organizers, with the workstation and time concerned.

Installing only the firewall

On a machine already running the ICPC image, staff can install the firewall separately. This installs the network filter, DNS filter, proxy, time configuration and firewall administration commands. Accounts, boot protection, USB restrictions and the desktop warning banner are configured by the full image build. For a separate installation, the site is responsible for those controls. From a local administrator console in a copy of this repository, run:

sudo ./install_firewall.sh --start

The installer needs Internet access to obtain nftables, dnsutils, chrony, nginx, libnginx-mod-stream and dnsmasq-base. With --start, the firewall becomes active during the installation and rejects new incoming connections, including SSH. Without that option, it is enabled for the next boot and can also be started with /enable_firewall.sh.

Both installation methods, the shell installer and firewall.yml, install the following commands directly in the filesystem root. They remain available even when contest-restrictions is not installed. Use them from the machine's administrator account:

sudo /disable_firewall.sh
sudo /enable_firewall.sh
sudo /test_firewall.sh

The disable command allows network traffic and restores ordinary DNS resolution until the enable command is run, including after reboots. The enable command starts the firewall, proxy, DNS filter and address refresh services, and enables the firewall for subsequent boots. The test command reports allowed and blocked website access, local DevDocs access, DNS filtering, proxy status and clock synchronization. It does not install or toggle the firewall.

For installation with Ansible over SSH, replace HOST with the machine's address and ADMIN_USER with an account that has sudo access. Run this from the repository on the administrator's computer. The target must be reachable by SSH before starting:

ansible-playbook -i "HOST," -u ADMIN_USER --ask-pass -K -e ansible_become_exe=sudo.ws firewall.yml

The sudo.ws setting selects the sudo implementation whose password prompt Ansible recognizes on this image. The firewall starts at the end of the playbook, after which new SSH connections are refused. Add -e start_firewall=false to defer activation until the next boot or a local enable command. The same enable, disable and test scripts are installed in either case.

Testing

The procedures in tests/README.md use a disposable virtual machine to check the image as a team member and an administrator would use it. They include service checks, desktop interaction and compilation in every supported IDE and language. Graphical reports are generated locally in test_report/, with the IDE compilation report at test_report/ide-config/index.html.

Files

File	Purpose
build.sh	Build and configure the contest disk image
run_vm.sh	Open a disposable session for inspecting the built image
write_sticks.sh	Overwrite the selected USB disks with the built image
site.yml	Apply the account, language, browser, desktop, documentation, firewall and device playbooks, then finish the build
finish.yml	Restore the SSH restrictions, set passwords, remove team sudo membership and shut down the build VM
allowed_domains.txt, dns_servers.txt, ntp_servers.txt	Network lists copied to /etc/contest-firewall/
install_firewall.sh	Install the firewall on the running ICPC machine with shell commands, without Ansible
firewall.yml	Install the same firewall through Ansible
test_firewall.sh	Check an installed firewall. Available as /test_firewall.sh on the contest machine
files/enable_firewall.sh, files/disable_firewall.sh	Installed as /enable_firewall.sh and /disable_firewall.sh by both firewall installers
files/help/index.html, docs.yml	Offline contest help and its installation alongside the local language documentation
files/	Scripts, configuration and system services installed by the playbooks
docs/	Technical notes for contestants
tests/	Tools and instructions for checking a disposable copy of the image