anchor.diff:  ----
   $ service apache2 restart
   ----
  +
  +=== Running via separate Tomcat
  +
  +Instead of using the WebAnno standalone JAR (recommended) which comes with an embedded Tomcat,
  +you can also  deploy the WebAnno WAR archive into a separately installed Tomcat instance. 
  +
  +==== Installing Tomcat
  +
  +* Install package to install user-instances of Tomcat. 
  ++
  +[source,bash]
  +----
  +$ apt-get install tomcat8-user authbind
  +----
  +* Create new instance
  ++
  +[source,bash]
  +----
  +$ cd /opt
  +$ tomcat8-instance-create -p 18080 -c 18005 webanno
  +$ chown -R www-data /opt/webanno
  +----
  +
  +NOTE: If WebAnno is the only application you install on your server, then you can also have WebAnno running on port 80 or port 443. In that case, substitute all instances of port `18080` in these
  +guidelines with the respective port. Mind that running via SSL on port 443 requires additional steps that we have not yet documented. Ports lower than 1024 are privileged and the WebAnno init script will automatically use a tool called *authbind* to allow WebAnno to operate on these ports as the unprivileged www-data user.
  +
  +* Configure the startup script. Edit `/etc/init.d/webanno` and add the following contents or just download the file from link:admin-guide/scripts/webanno[here] and place it in `/etc/init.d`.
  ++
  +[source,bash]
  +----
  +include::scripts/webanno[]
  +----
  +* Make the script executable and register it to run during system start:
  ++
  +[source,bash]
  +----
  +$ chmod +x /etc/init.d/webanno
  +$ update-rc.d webanno defaults
  +----
  +
  +NOTE: If you deploy WebAnno on a Linux machine that is short on entropy, you can significantly 
  +      decrease startup time by adding `-Djava.security.egd=file:/dev/urandom` to the `JAVA_OPTS`
  +      variable in the init script.
  +
  +Now we have a dedicated Apache Tomcat instance for WebAnno installed at `/opt/webanno/` that automatically starts when the system boots and that can be managed through the usual `service` commands.
  +
  +==== Deploying the WAR file
  +
  +* Place the WebAnno WAR into the Tomcat `webapps` folder:
  ++
  +[source,bash,subs="+attributes"]
  +----
  +$ cp webanno-webapp-{revnumber}.war /opt/webanno/webapps/webanno.war
  +----
  ++
  +NOTE: Mind that the copy command above renames the WAR file to `webanno.war`! This is important so that WebAnno is accessible at the URL noted later in the present guidelines.
  +* Start WebAnno
  ++
  +[source,bash]
  +----
  +$ service webanno start
  +----
  +* Open it with your browser at `http://localhost:18080/webanno`. If you chose to run WebAnno behind the Apache web-server use `http://localhost/webanno`.
  +The first time, it will create a username `admin` with password `admin`. Log in with this username and proceed.
  +
  +==== Running the WAR behind Apache HTTPD
  +
  +These are *optional* instructions if you want to run WebAnno behind an Apache web-server instead
  +of accessing it directly. This assumes that you already have the following packages installed:
  +
  +* Apache Web Server
  +* mod_proxy
  +* mod_proxy_ajp
  +
  +* Edit `/opt/webanno/conf/server.xml` and enable AJP Connector on localhost (comment in, add address, and change port
  ++
  +[source,xml]
  +----
  +<Connector port="18009" protocol="AJP/1.3" redirectPort="8443" address="127.0.0.1"/>
  +----
  +* Disable HTTP Connector (just comment it out)
  ++
  +[source,xml]
  +----
  +<!--Connector port="8080" protocol="HTTP/1.1".
  +           connectionTimeout="20000".
  +           URIEncoding="UTF-8"
  +           redirectPort="8443" /-->
  +----
  +* Edit `/etc/apache2/conf.d/webanno.local.conf`
  ++
  +[source,xml]
  +----
  +ProxyPreserveHost On
  +
  +<Proxy ajp://localhost/webanno >
  +  Order Deny,Allow
  +  Deny from none
  +  Allow from all
  +</Proxy>
  +
  +<Location /webanno >
  +  ProxyPass ajp://localhost:18009/webanno timeout=1200
  +  ProxyPassReverse http://localhost/webanno
  +</Location>
  +----
  +* Restart Apache web server
  ++
  +[source,bash]
  +----
  +$ service apache2 restart
  +----
  
positive.code: === Prerequisites
  
  * This guide assumes Debian 9.1 (Stretch). It may also work on Ubuntu with some modifications, but we do not test this. Instructions for other Linux distributions likely deviate significantly.
  * It is further assumed that the user "www-data" already exists on the system and that it shall be used to run WebAnno. Finally, it is expected that you have set up a MySQL database that WebAnno can use. 
  * All commands assume that you are logged in as the *root* user. 
  
  NOTE: If you cannot log in as root but have to use `sudo` to become root, then the recommended way to do that is using the command `sudo su -`.
  
negative.code: ----
  $ chown -R www-data /srv/webanno
  ----
  
  === Running via embedded Tomcat
  
  The WebAnno standalone JAR with an embedded Tomcat server and can be easily set up as a 
  UNIX service. This is the recommended way of running WebAnno on a server.
  
  ==== Installing WebAnno as a service
  
  To set it up as a service, you can do the following steps. For the following
  example, I assume that you install WebAnno in `/srv/webanno`:
  
  * Copy the standalone JAR file +webanno-standalone-{revnumber}.jar+ to `/srv/webanno/webanno.jar`.
     Note the change of the filename to `webanno.jar`.
  * Create the file `/srv/webanno/webanno.conf` with the following content
  +
  [source,text]
  ----
  JAVA_OPTS="-Djava.awt.headless=true -Dwebanno.home=/srv/webanno"
  ----
  +
  * In the previous step, you have already created the `/srv/webanno/settings.properties` file. 
    You *may optionally* configure the Tomcat port using the following line
  +
  [source,text]
  ----
  server.port=18080
  ----
  +
  If you need to do additional configurations of the embedded Tomcat, best refer to the 
  documentation of Spring Boot itself.
  +
  * Make sure that the file `/srv/webanno/webanno.conf` is owned by the root user. If this is
    not the case, WebAnno will ignore it and any settings made there will not have any effect. If
    you start WebAnno and intead of using the MySQL database, it is using an embedded database,
    then you should double-check that `/srv/webanno/webanno.conf` is owned by the root user.
  +
  [source,bash]
  ----
  $ chown root:root /srv/webanno/webanno.conf
  ----
  +
  * Change the owner/group of `/srv/webanno/webanno.jar` to `www-data`. When the service is started,
    it will run with the privileges of the user that owns the JAR file, i.e. in this case WebAnno
    will run as under the `www-data` user.
  +
  [source,bash]
  ----
  $ chown www-data:www-data /srv/webanno/webanno.jar
  ----
  +
  * Create a symlink from `/etc/init.d` to the `/srv/webanno/webanno.jar`:
  +
  [source,bash]
  ----
  $ ln -s /srv/webanno/webanno.jar /etc/init.d/webanno
  ----
  +
  * Start WebAnno using
  +
  [source,bash]
  ----
  $ service webanno start
  ----
  +
  * Stop WebAnno using
  +
  [source,bash]
  ----
  $ service webanno stop
  ----
  
  ==== Running the standalone behind HTTPD
  
  These are *optional* instructions if you want to run WebAnno behind an Apache web-server instead
  of accessing it directly. This assumes that you already have the following packages installed:
  
  * Apache Web Server
  * mod_proxy
  * mod_proxy_ajp
  
  * Add the following lines to `/srv/webanno/settings.properties`:
  +
  [source,text]
  ----
  tomcat.ajp.port=18009
  server.contextPath=/webanno
  server.use-forward-headers=true
  ----
  +
  * Edit `/etc/apache2/conf.d/webanno.local.conf`
  +
  [source,xml]
  ----
  