From 98306b473c00af6f0ff2b6870cd0deffd90938f8 Mon Sep 17 00:00:00 2001 From: Karol Wypchlo Date: Thu, 21 Apr 2022 14:22:50 +0200 Subject: [PATCH 1/8] use official nginx entrypoint with envsubst and custom restart script --- docker-compose.yml | 8 +- docker/nginx/Dockerfile | 41 +- .../conf.d.templates/server.account.conf | 45 - .../server.account.conf.template | 39 + docker/nginx/conf.d.templates/server.api.conf | 43 - .../conf.d.templates/server.api.conf.template | 39 + ...link.conf => server.dnslink.conf.template} | 8 +- docker/nginx/conf.d.templates/server.hns.conf | 45 - .../conf.d.templates/server.hns.conf.template | 41 + .../conf.d.templates/server.skylink.conf | 43 - .../server.skylink.conf.template | 39 + .../20-envsubst-on-templates.sh | 36 + .../40-reload-every-x-hours.sh | 20 + .../50-generate-local-certificate.sh | 18 + docker/nginx/docker-entrypoint.sh | 42 + docker/nginx/mo | 1106 ----------------- docker/nginx/nginx.conf | 3 + 17 files changed, 307 insertions(+), 1309 deletions(-) delete mode 100644 docker/nginx/conf.d.templates/server.account.conf create mode 100644 docker/nginx/conf.d.templates/server.account.conf.template delete mode 100644 docker/nginx/conf.d.templates/server.api.conf create mode 100644 docker/nginx/conf.d.templates/server.api.conf.template rename docker/nginx/conf.d.templates/{server.dnslink.conf => server.dnslink.conf.template} (71%) delete mode 100644 docker/nginx/conf.d.templates/server.hns.conf create mode 100644 docker/nginx/conf.d.templates/server.hns.conf.template delete mode 100644 docker/nginx/conf.d.templates/server.skylink.conf create mode 100644 docker/nginx/conf.d.templates/server.skylink.conf.template create mode 100755 docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh create mode 100755 docker/nginx/docker-entrypoint.d/40-reload-every-x-hours.sh create mode 100755 docker/nginx/docker-entrypoint.d/50-generate-local-certificate.sh create mode 100755 docker/nginx/docker-entrypoint.sh delete mode 100755 docker/nginx/mo diff --git a/docker-compose.yml b/docker-compose.yml index 5838f136..d92b14fe 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -54,9 +54,11 @@ services: - ./docker/data/certbot:/etc/letsencrypt nginx: - build: - context: ./docker/nginx - dockerfile: Dockerfile + # uncomment "build" and comment out "image" to build from sources + # build: + # context: https://github.com/SkynetLabs/skynet-webportal.git#master + # dockerfile: ./docker/nginx/Dockerfile + image: skynetlabs/nginx container_name: nginx restart: unless-stopped logging: *default-logging diff --git a/docker/nginx/Dockerfile b/docker/nginx/Dockerfile index eca1e3d8..12b27712 100644 --- a/docker/nginx/Dockerfile +++ b/docker/nginx/Dockerfile @@ -2,25 +2,26 @@ FROM openresty/openresty:1.19.9.1-focal WORKDIR / -RUN luarocks install lua-resty-http && \ - luarocks install hasher && \ - openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \ - -subj '/CN=local-certificate' \ - -keyout /etc/ssl/local-certificate.key \ - -out /etc/ssl/local-certificate.crt +RUN apt-get update && apt-get --no-install-recommends install bc=1.07.1-2build1 && \ + apt-get clean && rm -rf /var/lib/apt/lists/* && \ + luarocks install lua-resty-http && \ + luarocks install hasher -COPY mo ./ -COPY libs /etc/nginx/libs -COPY conf.d /etc/nginx/conf.d -COPY conf.d.templates /etc/nginx/conf.d.templates -COPY nginx.conf /usr/local/openresty/nginx/conf/nginx.conf +# reload nginx every 6 hours (for reloading certificates) +ENV NGINX_ENTRYPOINT_RELOAD_EVERY_X_HOURS 6 -CMD [ "bash", "-c", \ - "./mo < /etc/nginx/conf.d.templates/server.account.conf > /etc/nginx/conf.d/server.account.conf ; \ - ./mo < /etc/nginx/conf.d.templates/server.api.conf > /etc/nginx/conf.d/server.api.conf; \ - ./mo < /etc/nginx/conf.d.templates/server.dnslink.conf > /etc/nginx/conf.d/server.dnslink.conf; \ - ./mo < /etc/nginx/conf.d.templates/server.hns.conf > /etc/nginx/conf.d/server.hns.conf; \ - ./mo < /etc/nginx/conf.d.templates/server.skylink.conf > /etc/nginx/conf.d/server.skylink.conf ; \ - while :; do sleep 6h & wait ${!}; /usr/local/openresty/bin/openresty -s reload; done & \ - /usr/local/openresty/bin/openresty '-g daemon off;'" \ - ] +# copy entrypoint and entrypoint scripts +COPY docker/nginx/docker-entrypoint.sh / +COPY docker/nginx/docker-entrypoint.d /docker-entrypoint.d + +# copy nginx configuration files and libraries +COPY docker/nginx/libs /etc/nginx/libs +COPY docker/nginx/conf.d /etc/nginx/conf.d +COPY docker/nginx/conf.d.templates /etc/nginx/templates +COPY docker/nginx/nginx.conf /usr/local/openresty/nginx/conf/nginx.conf + +ENTRYPOINT ["/docker-entrypoint.sh"] + +STOPSIGNAL SIGQUIT + +CMD ["nginx", "-g", "daemon off;"] diff --git a/docker/nginx/conf.d.templates/server.account.conf b/docker/nginx/conf.d.templates/server.account.conf deleted file mode 100644 index af3b7c4d..00000000 --- a/docker/nginx/conf.d.templates/server.account.conf +++ /dev/null @@ -1,45 +0,0 @@ -{{#ACCOUNTS_ENABLED}} - {{#PORTAL_DOMAIN}} - server { - server_name account.{{PORTAL_DOMAIN}}; # example: account.siasky.net - - include /etc/nginx/conf.d/server/server.http; - } - - server { - server_name account.{{PORTAL_DOMAIN}}; # example: account.siasky.net - - set_by_lua_block $skynet_portal_domain { return "{{PORTAL_DOMAIN}}" } - set_by_lua_block $skynet_server_domain { - -- fall back to portal domain if server domain is not defined - if "{{SERVER_DOMAIN}}" == "" then - return "{{PORTAL_DOMAIN}}" - end - return "{{SERVER_DOMAIN}}" - } - - include /etc/nginx/conf.d/server/server.account; - } - {{/PORTAL_DOMAIN}} - - {{#SERVER_DOMAIN}} - server { - server_name account.{{SERVER_DOMAIN}}; # example: account.eu-ger-1.siasky.net - - include /etc/nginx/conf.d/server/server.http; - - set_by_lua_block $server_alias { return string.match("{{SERVER_DOMAIN}}", "^([^.]+)") } - } - - server { - server_name account.{{SERVER_DOMAIN}}; # example: account.eu-ger-1.siasky.net - - set_by_lua_block $skynet_portal_domain { return "{{SERVER_DOMAIN}}" } - set_by_lua_block $skynet_server_domain { return "{{SERVER_DOMAIN}}" } - - include /etc/nginx/conf.d/server/server.account; - - set_by_lua_block $server_alias { return string.match("{{SERVER_DOMAIN}}", "^([^.]+)") } - } - {{/SERVER_DOMAIN}} -{{/ACCOUNTS_ENABLED}} diff --git a/docker/nginx/conf.d.templates/server.account.conf.template b/docker/nginx/conf.d.templates/server.account.conf.template new file mode 100644 index 00000000..64de6523 --- /dev/null +++ b/docker/nginx/conf.d.templates/server.account.conf.template @@ -0,0 +1,39 @@ +server { + server_name account.${PORTAL_DOMAIN}; # example: account.siasky.net + + include /etc/nginx/conf.d/server/server.http; +} + +server { + server_name account.${PORTAL_DOMAIN}; # example: account.siasky.net + + set_by_lua_block $skynet_portal_domain { return "${PORTAL_DOMAIN}" } + set_by_lua_block $skynet_server_domain { + -- fall back to portal domain if server domain is not defined + if "${SERVER_DOMAIN}" == "" then + return "${PORTAL_DOMAIN}" + end + return "${SERVER_DOMAIN}" + } + + include /etc/nginx/conf.d/server/server.account; +} + +server { + server_name account.${SERVER_DOMAIN}; # example: account.eu-ger-1.siasky.net + + include /etc/nginx/conf.d/server/server.http; + + set_by_lua_block $server_alias { return string.match("${SERVER_DOMAIN}", "^([^.]+)") } +} + +server { + server_name account.${SERVER_DOMAIN}; # example: account.eu-ger-1.siasky.net + + set_by_lua_block $skynet_portal_domain { return "${SERVER_DOMAIN}" } + set_by_lua_block $skynet_server_domain { return "${SERVER_DOMAIN}" } + + include /etc/nginx/conf.d/server/server.account; + + set_by_lua_block $server_alias { return string.match("${SERVER_DOMAIN}", "^([^.]+)") } +} diff --git a/docker/nginx/conf.d.templates/server.api.conf b/docker/nginx/conf.d.templates/server.api.conf deleted file mode 100644 index 591212ba..00000000 --- a/docker/nginx/conf.d.templates/server.api.conf +++ /dev/null @@ -1,43 +0,0 @@ -{{#PORTAL_DOMAIN}} -server { - server_name {{PORTAL_DOMAIN}}; # example: siasky.net - - include /etc/nginx/conf.d/server/server.http; -} - -server { - server_name {{PORTAL_DOMAIN}}; # example: siasky.net - - set_by_lua_block $skynet_portal_domain { return "{{PORTAL_DOMAIN}}" } - set_by_lua_block $skynet_server_domain { - -- fall back to portal domain if server domain is not defined - if "{{SERVER_DOMAIN}}" == "" then - return "{{PORTAL_DOMAIN}}" - end - return "{{SERVER_DOMAIN}}" - } - - include /etc/nginx/conf.d/server/server.api; -} -{{/PORTAL_DOMAIN}} - -{{#SERVER_DOMAIN}} -server { - server_name {{SERVER_DOMAIN}}; # example: eu-ger-1.siasky.net - - include /etc/nginx/conf.d/server/server.http; - - set_by_lua_block $server_alias { return string.match("{{SERVER_DOMAIN}}", "^([^.]+)") } -} - -server { - server_name {{SERVER_DOMAIN}}; # example: eu-ger-1.siasky.net - - set_by_lua_block $skynet_portal_domain { return "{{SERVER_DOMAIN}}" } - set_by_lua_block $skynet_server_domain { return "{{SERVER_DOMAIN}}" } - - include /etc/nginx/conf.d/server/server.api; - - set_by_lua_block $server_alias { return string.match("{{SERVER_DOMAIN}}", "^([^.]+)") } -} -{{/SERVER_DOMAIN}} diff --git a/docker/nginx/conf.d.templates/server.api.conf.template b/docker/nginx/conf.d.templates/server.api.conf.template new file mode 100644 index 00000000..7d36ff08 --- /dev/null +++ b/docker/nginx/conf.d.templates/server.api.conf.template @@ -0,0 +1,39 @@ +server { + server_name ${PORTAL_DOMAIN}; # example: siasky.net + + include /etc/nginx/conf.d/server/server.http; +} + +server { + server_name ${PORTAL_DOMAIN}; # example: siasky.net + + set_by_lua_block $skynet_portal_domain { return "${PORTAL_DOMAIN}" } + set_by_lua_block $skynet_server_domain { + -- fall back to portal domain if server domain is not defined + if "${SERVER_DOMAIN}" == "" then + return "${PORTAL_DOMAIN}" + end + return "${SERVER_DOMAIN}" + } + + include /etc/nginx/conf.d/server/server.api; +} + +server { + server_name ${SERVER_DOMAIN}; # example: eu-ger-1.siasky.net + + include /etc/nginx/conf.d/server/server.http; + + set_by_lua_block $server_alias { return string.match("${SERVER_DOMAIN}", "^([^.]+)") } +} + +server { + server_name ${SERVER_DOMAIN}; # example: eu-ger-1.siasky.net + + set_by_lua_block $skynet_portal_domain { return "${SERVER_DOMAIN}" } + set_by_lua_block $skynet_server_domain { return "${SERVER_DOMAIN}" } + + include /etc/nginx/conf.d/server/server.api; + + set_by_lua_block $server_alias { return string.match("${SERVER_DOMAIN}", "^([^.]+)") } +} diff --git a/docker/nginx/conf.d.templates/server.dnslink.conf b/docker/nginx/conf.d.templates/server.dnslink.conf.template similarity index 71% rename from docker/nginx/conf.d.templates/server.dnslink.conf rename to docker/nginx/conf.d.templates/server.dnslink.conf.template index d42ee245..95c623b6 100644 --- a/docker/nginx/conf.d.templates/server.dnslink.conf +++ b/docker/nginx/conf.d.templates/server.dnslink.conf.template @@ -12,13 +12,13 @@ server { ssl_certificate /etc/ssl/local-certificate.crt; ssl_certificate_key /etc/ssl/local-certificate.key; - set_by_lua_block $skynet_portal_domain { return "{{PORTAL_DOMAIN}}" } + set_by_lua_block $skynet_portal_domain { return "${PORTAL_DOMAIN}" } set_by_lua_block $skynet_server_domain { -- fall back to portal domain if server domain is not defined - if "{{SERVER_DOMAIN}}" == "" then - return "{{PORTAL_DOMAIN}}" + if "${SERVER_DOMAIN}" == "" then + return "${PORTAL_DOMAIN}" end - return "{{SERVER_DOMAIN}}" + return "${SERVER_DOMAIN}" } include /etc/nginx/conf.d/server/server.dnslink; diff --git a/docker/nginx/conf.d.templates/server.hns.conf b/docker/nginx/conf.d.templates/server.hns.conf deleted file mode 100644 index 0e4f21f3..00000000 --- a/docker/nginx/conf.d.templates/server.hns.conf +++ /dev/null @@ -1,45 +0,0 @@ -{{#PORTAL_DOMAIN}} -server { - server_name *.hns.{{PORTAL_DOMAIN}}; # example: *.hns.siasky.net - - include /etc/nginx/conf.d/server/server.http; -} - -server { - server_name *.hns.{{PORTAL_DOMAIN}}; # example: *.hns.siasky.net - - set_by_lua_block $skynet_portal_domain { return "{{PORTAL_DOMAIN}}" } - set_by_lua_block $skynet_server_domain { - -- fall back to portal domain if server domain is not defined - if "{{SERVER_DOMAIN}}" == "" then - return "{{PORTAL_DOMAIN}}" - end - return "{{SERVER_DOMAIN}}" - } - - proxy_set_header Host {{PORTAL_DOMAIN}}; - include /etc/nginx/conf.d/server/server.hns; -} -{{/PORTAL_DOMAIN}} - -{{#SERVER_DOMAIN}} -server { - server_name *.hns.{{SERVER_DOMAIN}}; # example: *.hns.eu-ger-1.siasky.net - - include /etc/nginx/conf.d/server/server.http; - - set_by_lua_block $server_alias { return string.match("{{SERVER_DOMAIN}}", "^([^.]+)") } -} - -server { - server_name *.hns.{{SERVER_DOMAIN}}; # example: *.hns.eu-ger-1.siasky.net - - set_by_lua_block $skynet_portal_domain { return "{{SERVER_DOMAIN}}" } - set_by_lua_block $skynet_server_domain { return "{{SERVER_DOMAIN}}" } - - proxy_set_header Host {{SERVER_DOMAIN}}; - include /etc/nginx/conf.d/server/server.hns; - - set_by_lua_block $server_alias { return string.match("{{SERVER_DOMAIN}}", "^([^.]+)") } -} -{{/SERVER_DOMAIN}} diff --git a/docker/nginx/conf.d.templates/server.hns.conf.template b/docker/nginx/conf.d.templates/server.hns.conf.template new file mode 100644 index 00000000..7067ce4d --- /dev/null +++ b/docker/nginx/conf.d.templates/server.hns.conf.template @@ -0,0 +1,41 @@ +server { + server_name *.hns.${PORTAL_DOMAIN}; # example: *.hns.siasky.net + + include /etc/nginx/conf.d/server/server.http; +} + +server { + server_name *.hns.${PORTAL_DOMAIN}; # example: *.hns.siasky.net + + set_by_lua_block $skynet_portal_domain { return "${PORTAL_DOMAIN}" } + set_by_lua_block $skynet_server_domain { + -- fall back to portal domain if server domain is not defined + if "${SERVER_DOMAIN}" == "" then + return "${PORTAL_DOMAIN}" + end + return "${SERVER_DOMAIN}" + } + + proxy_set_header Host ${PORTAL_DOMAIN}; + include /etc/nginx/conf.d/server/server.hns; +} + +server { + server_name *.hns.${SERVER_DOMAIN}; # example: *.hns.eu-ger-1.siasky.net + + include /etc/nginx/conf.d/server/server.http; + + set_by_lua_block $server_alias { return string.match("${SERVER_DOMAIN}", "^([^.]+)") } +} + +server { + server_name *.hns.${SERVER_DOMAIN}; # example: *.hns.eu-ger-1.siasky.net + + set_by_lua_block $skynet_portal_domain { return "${SERVER_DOMAIN}" } + set_by_lua_block $skynet_server_domain { return "${SERVER_DOMAIN}" } + + proxy_set_header Host ${SERVER_DOMAIN}; + include /etc/nginx/conf.d/server/server.hns; + + set_by_lua_block $server_alias { return string.match("${SERVER_DOMAIN}", "^([^.]+)") } +} diff --git a/docker/nginx/conf.d.templates/server.skylink.conf b/docker/nginx/conf.d.templates/server.skylink.conf deleted file mode 100644 index a97e240c..00000000 --- a/docker/nginx/conf.d.templates/server.skylink.conf +++ /dev/null @@ -1,43 +0,0 @@ -{{#PORTAL_DOMAIN}} -server { - server_name *.{{PORTAL_DOMAIN}}; # example: *.siasky.net - - include /etc/nginx/conf.d/server/server.http; -} - -server { - server_name *.{{PORTAL_DOMAIN}}; # example: *.siasky.net - - set_by_lua_block $skynet_portal_domain { return "{{PORTAL_DOMAIN}}" } - set_by_lua_block $skynet_server_domain { - -- fall back to portal domain if server domain is not defined - if "{{SERVER_DOMAIN}}" == "" then - return "{{PORTAL_DOMAIN}}" - end - return "{{SERVER_DOMAIN}}" - } - - include /etc/nginx/conf.d/server/server.skylink; -} -{{/PORTAL_DOMAIN}} - -{{#SERVER_DOMAIN}} -server { - server_name *.{{SERVER_DOMAIN}}; # example: *.eu-ger-1.siasky.net - - include /etc/nginx/conf.d/server/server.http; - - set_by_lua_block $server_alias { return string.match("{{SERVER_DOMAIN}}", "^([^.]+)") } -} - -server { - server_name *.{{SERVER_DOMAIN}}; # example: *.eu-ger-1.siasky.net - - set_by_lua_block $skynet_portal_domain { return "{{SERVER_DOMAIN}}" } - set_by_lua_block $skynet_server_domain { return "{{SERVER_DOMAIN}}" } - - include /etc/nginx/conf.d/server/server.skylink; - - set_by_lua_block $server_alias { return string.match("{{SERVER_DOMAIN}}", "^([^.]+)") } -} -{{/SERVER_DOMAIN}} diff --git a/docker/nginx/conf.d.templates/server.skylink.conf.template b/docker/nginx/conf.d.templates/server.skylink.conf.template new file mode 100644 index 00000000..7e22c13c --- /dev/null +++ b/docker/nginx/conf.d.templates/server.skylink.conf.template @@ -0,0 +1,39 @@ +server { + server_name *.${PORTAL_DOMAIN}; # example: *.siasky.net + + include /etc/nginx/conf.d/server/server.http; +} + +server { + server_name *.${PORTAL_DOMAIN}; # example: *.siasky.net + + set_by_lua_block $skynet_portal_domain { return "${PORTAL_DOMAIN}" } + set_by_lua_block $skynet_server_domain { + -- fall back to portal domain if server domain is not defined + if "${SERVER_DOMAIN}" == "" then + return "${PORTAL_DOMAIN}" + end + return "${SERVER_DOMAIN}" + } + + include /etc/nginx/conf.d/server/server.skylink; +} + +server { + server_name *.${SERVER_DOMAIN}; # example: *.eu-ger-1.siasky.net + + include /etc/nginx/conf.d/server/server.http; + + set_by_lua_block $server_alias { return string.match("${SERVER_DOMAIN}", "^([^.]+)") } +} + +server { + server_name *.${SERVER_DOMAIN}; # example: *.eu-ger-1.siasky.net + + set_by_lua_block $skynet_portal_domain { return "${SERVER_DOMAIN}" } + set_by_lua_block $skynet_server_domain { return "${SERVER_DOMAIN}" } + + include /etc/nginx/conf.d/server/server.skylink; + + set_by_lua_block $server_alias { return string.match("${SERVER_DOMAIN}", "^([^.]+)") } +} diff --git a/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh b/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh new file mode 100755 index 00000000..c46cea44 --- /dev/null +++ b/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh @@ -0,0 +1,36 @@ +#!/bin/sh + +# https://github.com/nginxinc/docker-nginx/blob/master/entrypoint/20-envsubst-on-templates.sh +# Copyright (C) 2011-2016 Nginx, Inc. +# All rights reserved. + +set -e + +ME=$(basename $0) + +auto_envsubst() { + local template_dir="${NGINX_ENVSUBST_TEMPLATE_DIR:-/etc/nginx/templates}" + local suffix="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}" + local output_dir="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx/conf.d}" + + local template defined_envs relative_path output_path subdir + defined_envs=$(printf '${%s} ' $(env | cut -d= -f1)) + [ -d "$template_dir" ] || return 0 + if [ ! -w "$output_dir" ]; then + echo >&3 "$ME: ERROR: $template_dir exists, but $output_dir is not writable" + return 0 + fi + find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do + relative_path="${template#$template_dir/}" + output_path="$output_dir/${relative_path%$suffix}" + subdir=$(dirname "$relative_path") + # create a subdirectory where the template file exists + mkdir -p "$output_dir/$subdir" + echo >&3 "$ME: Running envsubst on $template to $output_path" + envsubst "$defined_envs" < "$template" > "$output_path" + done +} + +auto_envsubst + +exit 0 diff --git a/docker/nginx/docker-entrypoint.d/40-reload-every-x-hours.sh b/docker/nginx/docker-entrypoint.d/40-reload-every-x-hours.sh new file mode 100755 index 00000000..cdd7d17e --- /dev/null +++ b/docker/nginx/docker-entrypoint.d/40-reload-every-x-hours.sh @@ -0,0 +1,20 @@ +#!/bin/sh + +# source: https://github.com/nginxinc/docker-nginx/pull/509 + +set -e + +ME=$(basename $0) + +[ "${NGINX_ENTRYPOINT_RELOAD_EVERY_X_HOURS:-}" ] || exit 0 +if [ $(echo "$NGINX_ENTRYPOINT_RELOAD_EVERY_X_HOURS > 0" | bc) = 0 ]; then + echo >&3 "$ME: Error. Provide integer or floating point number greater that 0. See 'man sleep'." + exit 1 +fi + +start_background_reload() { + echo >&3 "$ME: Reloading Nginx every $NGINX_ENTRYPOINT_RELOAD_EVERY_X_HOURS hour(s)" + while :; do sleep ${NGINX_ENTRYPOINT_RELOAD_EVERY_X_HOURS}h; echo >&3 "$ME: Reloading Nginx ..." && nginx -s reload; done & +} + +start_background_reload diff --git a/docker/nginx/docker-entrypoint.d/50-generate-local-certificate.sh b/docker/nginx/docker-entrypoint.d/50-generate-local-certificate.sh new file mode 100755 index 00000000..d556fd3e --- /dev/null +++ b/docker/nginx/docker-entrypoint.d/50-generate-local-certificate.sh @@ -0,0 +1,18 @@ +#!/bin/sh + +# Generate locally signed ssl certificate to be used on routes +# that do not require certificate issued by trusted CA + +set -e + +ME=$(basename $0) + +generate_local_certificate() { + echo >&3 "$ME: Generating locally signed ssl certificate" + openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \ + -subj '/CN=local-certificate' \ + -keyout /etc/ssl/local-certificate.key \ + -out /etc/ssl/local-certificate.crt +} + +generate_local_certificate diff --git a/docker/nginx/docker-entrypoint.sh b/docker/nginx/docker-entrypoint.sh new file mode 100755 index 00000000..07793211 --- /dev/null +++ b/docker/nginx/docker-entrypoint.sh @@ -0,0 +1,42 @@ +#!/bin/sh +# vim:sw=4:ts=4:et + +# https://github.com/nginxinc/docker-nginx/blob/master/entrypoint/docker-entrypoint.sh +# Copyright (C) 2011-2016 Nginx, Inc. +# All rights reserved. + +set -e + +if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + exec 3>&1 +else + exec 3>/dev/null +fi + +if [ "$1" = "nginx" -o "$1" = "nginx-debug" ]; then + if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then + echo >&3 "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration" + + echo >&3 "$0: Looking for shell scripts in /docker-entrypoint.d/" + find "/docker-entrypoint.d/" -follow -type f -print | sort -V | while read -r f; do + case "$f" in + *.sh) + if [ -x "$f" ]; then + echo >&3 "$0: Launching $f"; + "$f" + else + # warn on shell scripts without exec bit + echo >&3 "$0: Ignoring $f, not executable"; + fi + ;; + *) echo >&3 "$0: Ignoring $f";; + esac + done + + echo >&3 "$0: Configuration complete; ready for start up" + else + echo >&3 "$0: No files found in /docker-entrypoint.d/, skipping configuration" + fi +fi + +exec "$@" diff --git a/docker/nginx/mo b/docker/nginx/mo deleted file mode 100755 index ba8e48d1..00000000 --- a/docker/nginx/mo +++ /dev/null @@ -1,1106 +0,0 @@ -#!/usr/bin/env bash -# -#/ Mo is a mustache template rendering software written in bash. It inserts -#/ environment variables into templates. -#/ -#/ Simply put, mo will change {{VARIABLE}} into the value of that -#/ environment variable. You can use {{#VARIABLE}}content{{/VARIABLE}} to -#/ conditionally display content or iterate over the values of an array. -#/ -#/ Learn more about mustache templates at https://mustache.github.io/ -#/ -#/ Simple usage: -#/ -#/ mo [OPTIONS] filenames... -#/ -#/ Options: -#/ -#/ -u, --fail-not-set -#/ Fail upon expansion of an unset variable. -#/ -x, --fail-on-function -#/ Fail when a function returns a non-zero status code. -#/ -e, --false -#/ Treat the string "false" as empty for conditionals. -#/ -h, --help -#/ This message. -#/ -s=FILE, --source=FILE -#/ Load FILE into the environment before processing templates. -#/ Can be used multiple times. -# -# Mo is under a MIT style licence with an additional non-advertising clause. -# See LICENSE.md for the full text. -# -# This is open source! Please feel free to contribute. -# -# https://github.com/tests-always-included/mo - - -# Public: Template parser function. Writes templates to stdout. -# -# $0 - Name of the mo file, used for getting the help message. -# $@ - Filenames to parse. -# -# Options: -# -# --allow-function-arguments -# -# Permit functions in templates to be called with additional arguments. This -# puts template data directly in to the path of an eval statement. Use with -# caution. Not listed in the help because it only makes sense when mo is -# sourced. -# -# -u, --fail-not-set -# -# Fail upon expansion of an unset variable. Default behavior is to silently -# ignore and expand into empty string. -# -# -x, --fail-on-function -# -# Fail when a function used by a template returns an error status code. -# Alternately, ou may set the MO_FAIL_ON_FUNCTION environment variable to a -# non-empty value to enable this behavior. -# -# -e, --false -# -# Treat "false" as an empty value. You may set the MO_FALSE_IS_EMPTY -# environment variable instead to a non-empty value to enable this behavior. -# -# -h, --help -# -# Display a help message. -# -# -s=FILE, --source=FILE -# -# Source a file into the environment before processing template files. -# This can be used multiple times. -# -# -- -# -# Used to indicate the end of options. You may optionally use this when -# filenames may start with two hyphens. -# -# Mo uses the following environment variables: -# -# MO_ALLOW_FUNCTION_ARGUMENTS - When set to a non-empty value, this allows -# functions referenced in templates to receive additional -# options and arguments. This puts the content from the -# template directly into an eval statement. Use with extreme -# care. -# MO_FUNCTION_ARGS - Arguments passed to the function -# MO_FAIL_ON_FUNCTION - If a function returns a non-zero status code, abort -# with an error. -# MO_FAIL_ON_UNSET - When set to a non-empty value, expansion of an unset env -# variable will be aborted with an error. -# MO_FALSE_IS_EMPTY - When set to a non-empty value, the string "false" will be -# treated as an empty value for the purposes of conditionals. -# MO_ORIGINAL_COMMAND - Used to find the `mo` program in order to generate a -# help message. -# -# Returns nothing. -mo() ( - # This function executes in a subshell so IFS is reset. - # Namespace this variable so we don't conflict with desired values. - local moContent f2source files doubleHyphens - - IFS=$' \n\t' - files=() - doubleHyphens=false - - if [[ $# -gt 0 ]]; then - for arg in "$@"; do - if $doubleHyphens; then - #: After we encounter two hyphens together, all the rest - #: of the arguments are files. - files=("${files[@]}" "$arg") - else - case "$arg" in - -h|--h|--he|--hel|--help|-\?) - moUsage "$0" - exit 0 - ;; - - --allow-function-arguments) - # shellcheck disable=SC2030 - MO_ALLOW_FUNCTION_ARGUMENTS=true - ;; - - -u | --fail-not-set) - # shellcheck disable=SC2030 - MO_FAIL_ON_UNSET=true - ;; - - -x | --fail-on-function) - # shellcheck disable=SC2030 - MO_FAIL_ON_FUNCTION=true - ;; - - -e | --false) - # shellcheck disable=SC2030 - MO_FALSE_IS_EMPTY=true - ;; - - -s=* | --source=*) - if [[ "$arg" == --source=* ]]; then - f2source="${arg#--source=}" - else - f2source="${arg#-s=}" - fi - - if [[ -f "$f2source" ]]; then - # shellcheck disable=SC1090 - . "$f2source" - else - echo "No such file: $f2source" >&2 - exit 1 - fi - ;; - - --) - #: Set a flag indicating we've encountered double hyphens - doubleHyphens=true - ;; - - *) - #: Every arg that is not a flag or a option should be a file - files=(${files[@]+"${files[@]}"} "$arg") - ;; - esac - fi - done - fi - - moGetContent moContent "${files[@]}" || return 1 - moParse "$moContent" "" true -) - - -# Internal: Call a function. -# -# $1 - Variable for output -# $2 - Function to call -# $3 - Content to pass -# $4 - Additional arguments as a single string -# -# This can be dangerous, especially if you are using tags like -# {{someFunction ; rm -rf / }} -# -# Returns nothing. -moCallFunction() { - local moArgs moContent moFunctionArgs moFunctionResult - - moArgs=() - moTrimWhitespace moFunctionArgs "$4" - - # shellcheck disable=SC2031 - if [[ -n "${MO_ALLOW_FUNCTION_ARGUMENTS-}" ]]; then - # Intentionally bad behavior - # shellcheck disable=SC2206 - moArgs=($4) - fi - - moContent=$(echo -n "$3" | MO_FUNCTION_ARGS="$moFunctionArgs" eval "$2" "${moArgs[@]}") || { - moFunctionResult=$? - # shellcheck disable=SC2031 - if [[ -n "${MO_FAIL_ON_FUNCTION-}" && "$moFunctionResult" != 0 ]]; then - echo "Function '$2' with args (${moArgs[*]+"${moArgs[@]}"}) failed with status code $moFunctionResult" - exit "$moFunctionResult" - fi - } - - # shellcheck disable=SC2031 - local "$1" && moIndirect "$1" "$moContent" -} - - -# Internal: Scan content until the right end tag is found. Creates an array -# with the following members: -# -# [0] = Content before end tag -# [1] = End tag (complete tag) -# [2] = Content after end tag -# -# Everything using this function uses the "standalone tags" logic. -# -# $1 - Name of variable for the array -# $2 - Content -# $3 - Name of end tag -# $4 - If -z, do standalone tag processing before finishing -# -# Returns nothing. -moFindEndTag() { - local content remaining scanned standaloneBytes tag - - #: Find open tags - scanned="" - moSplit content "$2" '{{' '}}' - - while [[ "${#content[@]}" -gt 1 ]]; do - moTrimWhitespace tag "${content[1]}" - - #: Restore content[1] before we start using it - content[1]='{{'"${content[1]}"'}}' - - case $tag in - '#'* | '^'*) - #: Start another block - scanned="${scanned}${content[0]}${content[1]}" - moTrimWhitespace tag "${tag:1}" - moFindEndTag content "${content[2]}" "$tag" "loop" - scanned="${scanned}${content[0]}${content[1]}" - remaining=${content[2]} - ;; - - '/'*) - #: End a block - could be ours - moTrimWhitespace tag "${tag:1}" - scanned="$scanned${content[0]}" - - if [[ "$tag" == "$3" ]]; then - #: Found our end tag - if [[ -z "${4-}" ]] && moIsStandalone standaloneBytes "$scanned" "${content[2]}" true; then - #: This is also a standalone tag - clean up whitespace - #: and move those whitespace bytes to the "tag" element - # shellcheck disable=SC2206 - standaloneBytes=( $standaloneBytes ) - content[1]="${scanned:${standaloneBytes[0]}}${content[1]}${content[2]:0:${standaloneBytes[1]}}" - scanned="${scanned:0:${standaloneBytes[0]}}" - content[2]="${content[2]:${standaloneBytes[1]}}" - fi - - local "$1" && moIndirectArray "$1" "$scanned" "${content[1]}" "${content[2]}" - return 0 - fi - - scanned="$scanned${content[1]}" - remaining=${content[2]} - ;; - - *) - #: Ignore all other tags - scanned="${scanned}${content[0]}${content[1]}" - remaining=${content[2]} - ;; - esac - - moSplit content "$remaining" '{{' '}}' - done - - #: Did not find our closing tag - scanned="$scanned${content[0]}" - local "$1" && moIndirectArray "$1" "${scanned}" "" "" -} - - -# Internal: Find the first index of a substring. If not found, sets the -# index to -1. -# -# $1 - Destination variable for the index -# $2 - Haystack -# $3 - Needle -# -# Returns nothing. -moFindString() { - local pos string - - string=${2%%$3*} - [[ "$string" == "$2" ]] && pos=-1 || pos=${#string} - local "$1" && moIndirect "$1" "$pos" -} - - -# Internal: Generate a dotted name based on current context and target name. -# -# $1 - Target variable to store results -# $2 - Context name -# $3 - Desired variable name -# -# Returns nothing. -moFullTagName() { - if [[ -z "${2-}" ]] || [[ "$2" == *.* ]]; then - local "$1" && moIndirect "$1" "$3" - else - local "$1" && moIndirect "$1" "${2}.${3}" - fi -} - - -# Internal: Fetches the content to parse into a variable. Can be a list of -# partials for files or the content from stdin. -# -# $1 - Variable name to assign this content back as -# $2-@ - File names (optional) -# -# Returns nothing. -moGetContent() { - local moContent moFilename moTarget - - moTarget=$1 - shift - if [[ "${#@}" -gt 0 ]]; then - moContent="" - - for moFilename in "$@"; do - #: This is so relative paths work from inside template files - moContent="$moContent"'{{>'"$moFilename"'}}' - done - else - moLoadFile moContent || return 1 - fi - - local "$moTarget" && moIndirect "$moTarget" "$moContent" -} - - -# Internal: Indent a string, placing the indent at the beginning of every -# line that has any content. -# -# $1 - Name of destination variable to get an array of lines -# $2 - The indent string -# $3 - The string to reindent -# -# Returns nothing. -moIndentLines() { - local content fragment len posN posR result trimmed - - result="" - - #: Remove the period from the end of the string. - len=$((${#3} - 1)) - content=${3:0:$len} - - if [[ -z "${2-}" ]]; then - local "$1" && moIndirect "$1" "$content" - - return 0 - fi - - moFindString posN "$content" $'\n' - moFindString posR "$content" $'\r' - - while [[ "$posN" -gt -1 ]] || [[ "$posR" -gt -1 ]]; do - if [[ "$posN" -gt -1 ]]; then - fragment="${content:0:$posN + 1}" - content=${content:$posN + 1} - else - fragment="${content:0:$posR + 1}" - content=${content:$posR + 1} - fi - - moTrimChars trimmed "$fragment" false true " " $'\t' $'\n' $'\r' - - if [[ -n "$trimmed" ]]; then - fragment="$2$fragment" - fi - - result="$result$fragment" - - moFindString posN "$content" $'\n' - moFindString posR "$content" $'\r' - - # If the content ends in a newline, do not indent. - if [[ "$posN" -eq ${#content} ]]; then - # Special clause for \r\n - if [[ "$posR" -eq "$((posN - 1))" ]]; then - posR=-1 - fi - - posN=-1 - fi - - if [[ "$posR" -eq ${#content} ]]; then - posR=-1 - fi - done - - moTrimChars trimmed "$content" false true " " $'\t' - - if [[ -n "$trimmed" ]]; then - content="$2$content" - fi - - result="$result$content" - - local "$1" && moIndirect "$1" "$result" -} - - -# Internal: Send a variable up to the parent of the caller of this function. -# -# $1 - Variable name -# $2 - Value -# -# Examples -# -# callFunc () { -# local "$1" && moIndirect "$1" "the value" -# } -# callFunc dest -# echo "$dest" # writes "the value" -# -# Returns nothing. -moIndirect() { - unset -v "$1" - printf -v "$1" '%s' "$2" -} - - -# Internal: Send an array as a variable up to caller of a function -# -# $1 - Variable name -# $2-@ - Array elements -# -# Examples -# -# callFunc () { -# local myArray=(one two three) -# local "$1" && moIndirectArray "$1" "${myArray[@]}" -# } -# callFunc dest -# echo "${dest[@]}" # writes "one two three" -# -# Returns nothing. -moIndirectArray() { - unset -v "$1" - - # IFS must be set to a string containing space or unset in order for - # the array slicing to work regardless of the current IFS setting on - # bash 3. This is detailed further at - # https://github.com/fidian/gg-core/pull/7 - eval "$(printf "IFS= %s=(\"\${@:2}\") IFS=%q" "$1" "$IFS")" -} - - -# Internal: Determine if a given environment variable exists and if it is -# an array. -# -# $1 - Name of environment variable -# -# Be extremely careful. Even if strict mode is enabled, it is not honored -# in newer versions of Bash. Any errors that crop up here will not be -# caught automatically. -# -# Examples -# -# var=(abc) -# if moIsArray var; then -# echo "This is an array" -# echo "Make sure you don't accidentally use \$var" -# fi -# -# Returns 0 if the name is not empty, 1 otherwise. -moIsArray() { - # Namespace this variable so we don't conflict with what we're testing. - local moTestResult - - moTestResult=$(declare -p "$1" 2>/dev/null) || return 1 - [[ "${moTestResult:0:10}" == "declare -a" ]] && return 0 - [[ "${moTestResult:0:10}" == "declare -A" ]] && return 0 - - return 1 -} - - -# Internal: Determine if the given name is a defined function. -# -# $1 - Function name to check -# -# Be extremely careful. Even if strict mode is enabled, it is not honored -# in newer versions of Bash. Any errors that crop up here will not be -# caught automatically. -# -# Examples -# -# moo () { -# echo "This is a function" -# } -# if moIsFunction moo; then -# echo "moo is a defined function" -# fi -# -# Returns 0 if the name is a function, 1 otherwise. -moIsFunction() { - local functionList functionName - - functionList=$(declare -F) - # shellcheck disable=SC2206 - functionList=( ${functionList//declare -f /} ) - - for functionName in "${functionList[@]}"; do - if [[ "$functionName" == "$1" ]]; then - return 0 - fi - done - - return 1 -} - - -# Internal: Determine if the tag is a standalone tag based on whitespace -# before and after the tag. -# -# Passes back a string containing two numbers in the format "BEFORE AFTER" -# like "27 10". It indicates the number of bytes remaining in the "before" -# string (27) and the number of bytes to trim in the "after" string (10). -# Useful for string manipulation: -# -# $1 - Variable to set for passing data back -# $2 - Content before the tag -# $3 - Content after the tag -# $4 - true/false: is this the beginning of the content? -# -# Examples -# -# moIsStandalone RESULT "$before" "$after" false || return 0 -# RESULT_ARRAY=( $RESULT ) -# echo "${before:0:${RESULT_ARRAY[0]}}...${after:${RESULT_ARRAY[1]}}" -# -# Returns nothing. -moIsStandalone() { - local afterTrimmed beforeTrimmed char - - moTrimChars beforeTrimmed "$2" false true " " $'\t' - moTrimChars afterTrimmed "$3" true false " " $'\t' - char=$((${#beforeTrimmed} - 1)) - char=${beforeTrimmed:$char} - - # If the content before didn't end in a newline - if [[ "$char" != $'\n' ]] && [[ "$char" != $'\r' ]]; then - # and there was content or this didn't start the file - if [[ -n "$char" ]] || ! $4; then - # then this is not a standalone tag. - return 1 - fi - fi - - char=${afterTrimmed:0:1} - - # If the content after doesn't start with a newline and it is something - if [[ "$char" != $'\n' ]] && [[ "$char" != $'\r' ]] && [[ -n "$char" ]]; then - # then this is not a standalone tag. - return 2 - fi - - if [[ "$char" == $'\r' ]] && [[ "${afterTrimmed:1:1}" == $'\n' ]]; then - char="$char"$'\n' - fi - - local "$1" && moIndirect "$1" "$((${#beforeTrimmed})) $((${#3} + ${#char} - ${#afterTrimmed}))" -} - - -# Internal: Join / implode an array -# -# $1 - Variable name to receive the joined content -# $2 - Joiner -# $3-$* - Elements to join -# -# Returns nothing. -moJoin() { - local joiner part result target - - target=$1 - joiner=$2 - result=$3 - shift 3 - - for part in "$@"; do - result="$result$joiner$part" - done - - local "$target" && moIndirect "$target" "$result" -} - - -# Internal: Read a file into a variable. -# -# $1 - Variable name to receive the file's content -# $2 - Filename to load - if empty, defaults to /dev/stdin -# -# Returns nothing. -moLoadFile() { - local content len - - # The subshell removes any trailing newlines. We forcibly add - # a dot to the content to preserve all newlines. - # As a future optimization, it would be worth considering removing - # cat and replacing this with a read loop. - - content=$(cat -- "${2:-/dev/stdin}" && echo '.') || return 1 - len=$((${#content} - 1)) - content=${content:0:$len} # Remove last dot - - local "$1" && moIndirect "$1" "$content" -} - - -# Internal: Process a chunk of content some number of times. Writes output -# to stdout. -# -# $1 - Content to parse repeatedly -# $2 - Tag prefix (context name) -# $3-@ - Names to insert into the parsed content -# -# Returns nothing. -moLoop() { - local content context contextBase - - content=$1 - contextBase=$2 - shift 2 - - while [[ "${#@}" -gt 0 ]]; do - moFullTagName context "$contextBase" "$1" - moParse "$content" "$context" false - shift - done -} - - -# Internal: Parse a block of text, writing the result to stdout. -# -# $1 - Block of text to change -# $2 - Current name (the variable NAME for what {{.}} means) -# $3 - true when no content before this, false otherwise -# -# Returns nothing. -moParse() { - # Keep naming variables mo* here to not overwrite needed variables - # used in the string replacements - local moArgs moBlock moContent moCurrent moIsBeginning moNextIsBeginning moTag - - moCurrent=$2 - moIsBeginning=$3 - - # Find open tags - moSplit moContent "$1" '{{' '}}' - - while [[ "${#moContent[@]}" -gt 1 ]]; do - moTrimWhitespace moTag "${moContent[1]}" - moNextIsBeginning=false - - case $moTag in - '#'*) - # Loop, if/then, or pass content through function - # Sets context - moStandaloneAllowed moContent "${moContent[@]}" "$moIsBeginning" - moTrimWhitespace moTag "${moTag:1}" - - # Split arguments from the tag name. Arguments are passed to - # functions. - moArgs=$moTag - moTag=${moTag%% *} - moTag=${moTag%%$'\t'*} - moArgs=${moArgs:${#moTag}} - moFindEndTag moBlock "$moContent" "$moTag" - moFullTagName moTag "$moCurrent" "$moTag" - - if moTest "$moTag"; then - # Show / loop / pass through function - if moIsFunction "$moTag"; then - moCallFunction moContent "$moTag" "${moBlock[0]}" "$moArgs" - moParse "$moContent" "$moCurrent" false - moContent="${moBlock[2]}" - elif moIsArray "$moTag"; then - eval "moLoop \"\${moBlock[0]}\" \"$moTag\" \"\${!${moTag}[@]}\"" - else - moParse "${moBlock[0]}" "$moCurrent" true - fi - fi - - moContent="${moBlock[2]}" - ;; - - '>'*) - # Load partial - get name of file relative to cwd - moPartial moContent "${moContent[@]}" "$moIsBeginning" "$moCurrent" - moNextIsBeginning=${moContent[1]} - moContent=${moContent[0]} - ;; - - '/'*) - # Closing tag - If hit in this loop, we simply ignore - # Matching tags are found in moFindEndTag - moStandaloneAllowed moContent "${moContent[@]}" "$moIsBeginning" - ;; - - '^'*) - # Display section if named thing does not exist - moStandaloneAllowed moContent "${moContent[@]}" "$moIsBeginning" - moTrimWhitespace moTag "${moTag:1}" - moFindEndTag moBlock "$moContent" "$moTag" - moFullTagName moTag "$moCurrent" "$moTag" - - if ! moTest "$moTag"; then - moParse "${moBlock[0]}" "$moCurrent" false "$moCurrent" - fi - - moContent="${moBlock[2]}" - ;; - - '!'*) - # Comment - ignore the tag content entirely - # Trim spaces/tabs before the comment - moStandaloneAllowed moContent "${moContent[@]}" "$moIsBeginning" - ;; - - .) - # Current content (environment variable or function) - moStandaloneDenied moContent "${moContent[@]}" - moShow "$moCurrent" "$moCurrent" - ;; - - '=') - # Change delimiters - # Any two non-whitespace sequences separated by whitespace. - # This tag is ignored. - moStandaloneAllowed moContent "${moContent[@]}" "$moIsBeginning" - ;; - - '{'*) - # Unescaped - split on }}} not }} - moStandaloneDenied moContent "${moContent[@]}" - moContent="${moTag:1}"'}}'"$moContent" - moSplit moContent "$moContent" '}}}' - moTrimWhitespace moTag "${moContent[0]}" - moArgs=$moTag - moTag=${moTag%% *} - moTag=${moTag%%$'\t'*} - moArgs=${moArgs:${#moTag}} - moFullTagName moTag "$moCurrent" "$moTag" - moContent=${moContent[1]} - - # Now show the value - # Quote moArgs here, do not quote it later. - moShow "$moTag" "$moCurrent" "$moArgs" - ;; - - '&'*) - # Unescaped - moStandaloneDenied moContent "${moContent[@]}" - moTrimWhitespace moTag "${moTag:1}" - moFullTagName moTag "$moCurrent" "$moTag" - moShow "$moTag" "$moCurrent" - ;; - - *) - # Normal environment variable or function call - moStandaloneDenied moContent "${moContent[@]}" - moArgs=$moTag - moTag=${moTag%% *} - moTag=${moTag%%$'\t'*} - moArgs=${moArgs:${#moTag}} - moFullTagName moTag "$moCurrent" "$moTag" - - # Quote moArgs here, do not quote it later. - moShow "$moTag" "$moCurrent" "$moArgs" - ;; - esac - - moIsBeginning=$moNextIsBeginning - moSplit moContent "$moContent" '{{' '}}' - done - - echo -n "${moContent[0]}" -} - - -# Internal: Process a partial. -# -# Indentation should be applied to the entire partial. -# -# This sends back the "is beginning" flag because the newline after a -# standalone partial is consumed. That newline is very important in the middle -# of content. We send back this flag to reset the processing loop's -# `moIsBeginning` variable, so the software thinks we are back at the -# beginning of a file and standalone processing continues to work. -# -# Prefix all variables. -# -# $1 - Name of destination variable. Element [0] is the content, [1] is the -# true/false flag indicating if we are at the beginning of content. -# $2 - Content before the tag that was not yet written -# $3 - Tag content -# $4 - Content after the tag -# $5 - true/false: is this the beginning of the content? -# $6 - Current context name -# -# Returns nothing. -moPartial() { - # Namespace variables here to prevent conflicts. - local moContent moFilename moIndent moIsBeginning moPartial moStandalone moUnindented - - if moIsStandalone moStandalone "$2" "$4" "$5"; then - # shellcheck disable=SC2206 - moStandalone=( $moStandalone ) - echo -n "${2:0:${moStandalone[0]}}" - moIndent=${2:${moStandalone[0]}} - moContent=${4:${moStandalone[1]}} - moIsBeginning=true - else - moIndent="" - echo -n "$2" - moContent=$4 - moIsBeginning=$5 - fi - - moTrimWhitespace moFilename "${3:1}" - - # Execute in subshell to preserve current cwd and environment - ( - # It would be nice to remove `dirname` and use a function instead, - # but that's difficult when you're only given filenames. - cd "$(dirname -- "$moFilename")" || exit 1 - moUnindented="$( - moLoadFile moPartial "${moFilename##*/}" || exit 1 - moParse "${moPartial}" "$6" true - - # Fix bash handling of subshells and keep trailing whitespace. - # This is removed in moIndentLines. - echo -n "." - )" || exit 1 - moIndentLines moPartial "$moIndent" "$moUnindented" - echo -n "$moPartial" - ) || exit 1 - - # If this is a standalone tag, the trailing newline after the tag is - # removed and the contents of the partial are added, which typically - # contain a newline. We need to send a signal back to the processing - # loop that the moIsBeginning flag needs to be turned on again. - # - # [0] is the content, [1] is that flag. - local "$1" && moIndirectArray "$1" "$moContent" "$moIsBeginning" -} - - -# Internal: Show an environment variable or the output of a function to -# stdout. -# -# Limit/prefix any variables used. -# -# $1 - Name of environment variable or function -# $2 - Current context -# $3 - Arguments string if $1 is a function -# -# Returns nothing. -moShow() { - # Namespace these variables - local moJoined moNameParts moContent - - if moIsFunction "$1"; then - moCallFunction moContent "$1" "" "$3" - moParse "$moContent" "$2" false - return 0 - fi - - moSplit moNameParts "$1" "." - - if [[ -z "${moNameParts[1]-}" ]]; then - if moIsArray "$1"; then - eval moJoin moJoined "," "\${$1[@]}" - echo -n "$moJoined" - else - # shellcheck disable=SC2031 - if moTestVarSet "$1"; then - echo -n "${!1}" - elif [[ -n "${MO_FAIL_ON_UNSET-}" ]]; then - echo "Env variable not set: $1" >&2 - exit 1 - fi - fi - else - # Further subindexes are disallowed - eval "echo -n \"\${${moNameParts[0]}[${moNameParts[1]%%.*}]}\"" - fi -} - - -# Internal: Split a larger string into an array. -# -# $1 - Destination variable -# $2 - String to split -# $3 - Starting delimiter -# $4 - Ending delimiter (optional) -# -# Returns nothing. -moSplit() { - local pos result - - result=( "$2" ) - moFindString pos "${result[0]}" "$3" - - if [[ "$pos" -ne -1 ]]; then - # The first delimiter was found - result[1]=${result[0]:$pos + ${#3}} - result[0]=${result[0]:0:$pos} - - if [[ -n "${4-}" ]]; then - moFindString pos "${result[1]}" "$4" - - if [[ "$pos" -ne -1 ]]; then - # The second delimiter was found - result[2]="${result[1]:$pos + ${#4}}" - result[1]="${result[1]:0:$pos}" - fi - fi - fi - - local "$1" && moIndirectArray "$1" "${result[@]}" -} - - -# Internal: Handle the content for a standalone tag. This means removing -# whitespace (not newlines) before a tag and whitespace and a newline after -# a tag. That is, assuming, that the line is otherwise empty. -# -# $1 - Name of destination "content" variable. -# $2 - Content before the tag that was not yet written -# $3 - Tag content (not used) -# $4 - Content after the tag -# $5 - true/false: is this the beginning of the content? -# -# Returns nothing. -moStandaloneAllowed() { - local bytes - - if moIsStandalone bytes "$2" "$4" "$5"; then - # shellcheck disable=SC2206 - bytes=( $bytes ) - echo -n "${2:0:${bytes[0]}}" - local "$1" && moIndirect "$1" "${4:${bytes[1]}}" - else - echo -n "$2" - local "$1" && moIndirect "$1" "$4" - fi -} - - -# Internal: Handle the content for a tag that is never "standalone". No -# adjustments are made for newlines and whitespace. -# -# $1 - Name of destination "content" variable. -# $2 - Content before the tag that was not yet written -# $3 - Tag content (not used) -# $4 - Content after the tag -# -# Returns nothing. -moStandaloneDenied() { - echo -n "$2" - local "$1" && moIndirect "$1" "$4" -} - - -# Internal: Determines if the named thing is a function or if it is a -# non-empty environment variable. When MO_FALSE_IS_EMPTY is set to a -# non-empty value, then "false" is also treated is an empty value. -# -# Do not use variables without prefixes here if possible as this needs to -# check if any name exists in the environment -# -# $1 - Name of environment variable or function -# $2 - Current value (our context) -# MO_FALSE_IS_EMPTY - When set to a non-empty value, this will say the -# string value "false" is empty. -# -# Returns 0 if the name is not empty, 1 otherwise. When MO_FALSE_IS_EMPTY -# is set, this returns 1 if the name is "false". -moTest() { - # Test for functions - moIsFunction "$1" && return 0 - - if moIsArray "$1"; then - # Arrays must have at least 1 element - eval "[[ \"\${#${1}[@]}\" -gt 0 ]]" && return 0 - else - # If MO_FALSE_IS_EMPTY is set, then return 1 if the value of - # the variable is "false". - # shellcheck disable=SC2031 - [[ -n "${MO_FALSE_IS_EMPTY-}" ]] && [[ "${!1-}" == "false" ]] && return 1 - - # Environment variables must not be empty - [[ -n "${!1-}" ]] && return 0 - fi - - return 1 -} - -# Internal: Determine if a variable is assigned, even if it is assigned an empty -# value. -# -# $1 - Variable name to check. -# -# Returns true (0) if the variable is set, 1 if the variable is unset. -moTestVarSet() { - [[ "${!1-a}" == "${!1-b}" ]] -} - - -# Internal: Trim the leading whitespace only. -# -# $1 - Name of destination variable -# $2 - The string -# $3 - true/false - trim front? -# $4 - true/false - trim end? -# $5-@ - Characters to trim -# -# Returns nothing. -moTrimChars() { - local back current front last target varName - - target=$1 - current=$2 - front=$3 - back=$4 - last="" - shift 4 # Remove target, string, trim front flag, trim end flag - - while [[ "$current" != "$last" ]]; do - last=$current - - for varName in "$@"; do - $front && current="${current/#$varName}" - $back && current="${current/%$varName}" - done - done - - local "$target" && moIndirect "$target" "$current" -} - - -# Internal: Trim leading and trailing whitespace from a string. -# -# $1 - Name of variable to store trimmed string -# $2 - The string -# -# Returns nothing. -moTrimWhitespace() { - local result - - moTrimChars result "$2" true true $'\r' $'\n' $'\t' " " - local "$1" && moIndirect "$1" "$result" -} - - -# Internal: Displays the usage for mo. Pulls this from the file that -# contained the `mo` function. Can only work when the right filename -# comes is the one argument, and that only happens when `mo` is called -# with `$0` set to this file. -# -# $1 - Filename that has the help message -# -# Returns nothing. -moUsage() { - grep '^#/' "${MO_ORIGINAL_COMMAND}" | cut -c 4- - echo "" - echo "MO_VERSION=$MO_VERSION" -} - - -# Save the original command's path for usage later -MO_ORIGINAL_COMMAND="$(cd "${BASH_SOURCE[0]%/*}" || exit 1; pwd)/${BASH_SOURCE[0]##*/}" -MO_VERSION="2.2.0" - -# If sourced, load all functions. -# If executed, perform the actions as expected. -if [[ "$0" == "${BASH_SOURCE[0]}" ]] || [[ -z "${BASH_SOURCE[0]}" ]]; then - mo "$@" -fi diff --git a/docker/nginx/nginx.conf b/docker/nginx/nginx.conf index 3517a6bc..de55d276 100644 --- a/docker/nginx/nginx.conf +++ b/docker/nginx/nginx.conf @@ -19,6 +19,9 @@ user root; worker_processes auto; +# Enables the use of JIT for regular expressions to speed-up their processing. +pcre_jit on; + #error_log logs/error.log; #error_log logs/error.log notice; #error_log logs/error.log info; From 306442eef3f72d33157bf34df5c95bd6dd49dd50 Mon Sep 17 00:00:00 2001 From: Karol Wypchlo Date: Thu, 21 Apr 2022 15:26:12 +0200 Subject: [PATCH 2/8] use volumes to mount nginx configuration --- docker-compose.yml | 4 ++++ docker/nginx/Dockerfile | 6 ------ .../docker-entrypoint.d/50-generate-local-certificate.sh | 2 +- 3 files changed, 5 insertions(+), 7 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index d92b14fe..6450a10f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -71,6 +71,10 @@ services: - ./docker/data/nginx/skynet:/data/nginx/skynet:ro - ./docker/data/sia/apipassword:/data/sia/apipassword:ro - ./docker/data/certbot:/etc/letsencrypt + - ./docker/nginx/libs:/etc/nginx/libs + - ./docker/nginx/conf.d:/etc/nginx/conf.d + - ./docker/nginx/conf.d.templates:/etc/nginx/templates + - ./docker/nginx/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf networks: shared: ipv4_address: 10.10.10.30 diff --git a/docker/nginx/Dockerfile b/docker/nginx/Dockerfile index 12b27712..b294d522 100644 --- a/docker/nginx/Dockerfile +++ b/docker/nginx/Dockerfile @@ -14,12 +14,6 @@ ENV NGINX_ENTRYPOINT_RELOAD_EVERY_X_HOURS 6 COPY docker/nginx/docker-entrypoint.sh / COPY docker/nginx/docker-entrypoint.d /docker-entrypoint.d -# copy nginx configuration files and libraries -COPY docker/nginx/libs /etc/nginx/libs -COPY docker/nginx/conf.d /etc/nginx/conf.d -COPY docker/nginx/conf.d.templates /etc/nginx/templates -COPY docker/nginx/nginx.conf /usr/local/openresty/nginx/conf/nginx.conf - ENTRYPOINT ["/docker-entrypoint.sh"] STOPSIGNAL SIGQUIT diff --git a/docker/nginx/docker-entrypoint.d/50-generate-local-certificate.sh b/docker/nginx/docker-entrypoint.d/50-generate-local-certificate.sh index d556fd3e..f5ecada1 100755 --- a/docker/nginx/docker-entrypoint.d/50-generate-local-certificate.sh +++ b/docker/nginx/docker-entrypoint.d/50-generate-local-certificate.sh @@ -7,7 +7,7 @@ set -e ME=$(basename $0) -generate_local_certificate() { +generate_local_certificate() { echo >&3 "$ME: Generating locally signed ssl certificate" openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \ -subj '/CN=local-certificate' \ From 6d2d053e23b6199a4dde6926634fe19f29e2e220 Mon Sep 17 00:00:00 2001 From: Karol Wypchlo Date: Thu, 21 Apr 2022 15:36:17 +0200 Subject: [PATCH 3/8] lint testing nginx dockerfile --- .github/workflows/lint-dockerfiles.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/lint-dockerfiles.yml b/.github/workflows/lint-dockerfiles.yml index 467dc117..afdd6558 100644 --- a/.github/workflows/lint-dockerfiles.yml +++ b/.github/workflows/lint-dockerfiles.yml @@ -14,6 +14,7 @@ jobs: matrix: dockerfile: - docker/nginx/Dockerfile + - docker/nginx/testing/Dockerfile - docker/sia/Dockerfile - packages/dashboard/Dockerfile - packages/dashboard-v2/Dockerfile From 873f23b7bfd1be9de47349e42ac2d4e047659e81 Mon Sep 17 00:00:00 2001 From: Karol Wypchlo Date: Thu, 21 Apr 2022 15:57:16 +0200 Subject: [PATCH 4/8] add nginx license source --- docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh | 1 + docker/nginx/docker-entrypoint.sh | 1 + 2 files changed, 2 insertions(+) diff --git a/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh b/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh index c46cea44..14d97a76 100755 --- a/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh +++ b/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh @@ -1,6 +1,7 @@ #!/bin/sh # https://github.com/nginxinc/docker-nginx/blob/master/entrypoint/20-envsubst-on-templates.sh +# https://github.com/nginxinc/docker-nginx/blob/master/LICENSE # Copyright (C) 2011-2016 Nginx, Inc. # All rights reserved. diff --git a/docker/nginx/docker-entrypoint.sh b/docker/nginx/docker-entrypoint.sh index 07793211..3802dab5 100755 --- a/docker/nginx/docker-entrypoint.sh +++ b/docker/nginx/docker-entrypoint.sh @@ -2,6 +2,7 @@ # vim:sw=4:ts=4:et # https://github.com/nginxinc/docker-nginx/blob/master/entrypoint/docker-entrypoint.sh +# https://github.com/nginxinc/docker-nginx/blob/master/LICENSE # Copyright (C) 2011-2016 Nginx, Inc. # All rights reserved. From ac99a426b33417d5e1c9b2e24eae076d8f065c50 Mon Sep 17 00:00:00 2001 From: Karol Wypchlo Date: Thu, 21 Apr 2022 15:59:07 +0200 Subject: [PATCH 5/8] fix DL3014 warning --- docker/nginx/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/nginx/Dockerfile b/docker/nginx/Dockerfile index b294d522..f35c0aff 100644 --- a/docker/nginx/Dockerfile +++ b/docker/nginx/Dockerfile @@ -2,7 +2,7 @@ FROM openresty/openresty:1.19.9.1-focal WORKDIR / -RUN apt-get update && apt-get --no-install-recommends install bc=1.07.1-2build1 && \ +RUN apt-get update && apt-get --no-install-recommends -y install bc=1.07.1-2build1 && \ apt-get clean && rm -rf /var/lib/apt/lists/* && \ luarocks install lua-resty-http && \ luarocks install hasher From 1d6d3cbfb601a69c14da18828b43e512195c92c5 Mon Sep 17 00:00:00 2001 From: Karol Wypchlo Date: Thu, 21 Apr 2022 16:01:20 +0200 Subject: [PATCH 6/8] fix DL3025 warning --- docker/nginx/testing/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/nginx/testing/Dockerfile b/docker/nginx/testing/Dockerfile index ae2cd78f..ed7740b6 100644 --- a/docker/nginx/testing/Dockerfile +++ b/docker/nginx/testing/Dockerfile @@ -8,4 +8,4 @@ RUN luarocks install lua-resty-http && \ COPY rbusted /etc/nginx/ -CMD /etc/nginx/rbusted --verbose --pattern=spec /usr/local/openresty/site/lualib +CMD ["/etc/nginx/rbusted", "--verbose", "--pattern=spec", "/usr/local/openresty/site/lualib"] From 9e675a2a043029c4d17d0eb0cf859035f39bd49d Mon Sep 17 00:00:00 2001 From: Karol Wypchlo Date: Fri, 22 Apr 2022 10:17:30 +0200 Subject: [PATCH 7/8] add comment about skynet_portal_domain being set to server domain --- docker/nginx/conf.d.templates/server.account.conf.template | 7 ++++++- docker/nginx/conf.d.templates/server.api.conf.template | 7 ++++++- docker/nginx/conf.d.templates/server.hns.conf.template | 7 ++++++- docker/nginx/conf.d.templates/server.skylink.conf.template | 7 ++++++- 4 files changed, 24 insertions(+), 4 deletions(-) diff --git a/docker/nginx/conf.d.templates/server.account.conf.template b/docker/nginx/conf.d.templates/server.account.conf.template index 64de6523..8507c407 100644 --- a/docker/nginx/conf.d.templates/server.account.conf.template +++ b/docker/nginx/conf.d.templates/server.account.conf.template @@ -30,7 +30,12 @@ server { server { server_name account.${SERVER_DOMAIN}; # example: account.eu-ger-1.siasky.net - set_by_lua_block $skynet_portal_domain { return "${SERVER_DOMAIN}" } + set_by_lua_block $skynet_portal_domain { + -- when accessing portal directly through server domain, portal domain should be set to server domain + -- motivation: skynet-js uses Skynet-Portal-Api header (that is set to $skynet_portal_domain) to detect current + -- portal address and it should be server domain when accessing specific server by its domain address + return "${SERVER_DOMAIN}" + } set_by_lua_block $skynet_server_domain { return "${SERVER_DOMAIN}" } include /etc/nginx/conf.d/server/server.account; diff --git a/docker/nginx/conf.d.templates/server.api.conf.template b/docker/nginx/conf.d.templates/server.api.conf.template index 7d36ff08..5f742127 100644 --- a/docker/nginx/conf.d.templates/server.api.conf.template +++ b/docker/nginx/conf.d.templates/server.api.conf.template @@ -30,7 +30,12 @@ server { server { server_name ${SERVER_DOMAIN}; # example: eu-ger-1.siasky.net - set_by_lua_block $skynet_portal_domain { return "${SERVER_DOMAIN}" } + set_by_lua_block $skynet_portal_domain { + -- when accessing portal directly through server domain, portal domain should be set to server domain + -- motivation: skynet-js uses Skynet-Portal-Api header (that is set to $skynet_portal_domain) to detect current + -- portal address and it should be server domain when accessing specific server by its domain address + return "${SERVER_DOMAIN}" + } set_by_lua_block $skynet_server_domain { return "${SERVER_DOMAIN}" } include /etc/nginx/conf.d/server/server.api; diff --git a/docker/nginx/conf.d.templates/server.hns.conf.template b/docker/nginx/conf.d.templates/server.hns.conf.template index 7067ce4d..f7bb43fb 100644 --- a/docker/nginx/conf.d.templates/server.hns.conf.template +++ b/docker/nginx/conf.d.templates/server.hns.conf.template @@ -31,7 +31,12 @@ server { server { server_name *.hns.${SERVER_DOMAIN}; # example: *.hns.eu-ger-1.siasky.net - set_by_lua_block $skynet_portal_domain { return "${SERVER_DOMAIN}" } + set_by_lua_block $skynet_portal_domain { + -- when accessing portal directly through server domain, portal domain should be set to server domain + -- motivation: skynet-js uses Skynet-Portal-Api header (that is set to $skynet_portal_domain) to detect current + -- portal address and it should be server domain when accessing specific server by its domain address + return "${SERVER_DOMAIN}" + } set_by_lua_block $skynet_server_domain { return "${SERVER_DOMAIN}" } proxy_set_header Host ${SERVER_DOMAIN}; diff --git a/docker/nginx/conf.d.templates/server.skylink.conf.template b/docker/nginx/conf.d.templates/server.skylink.conf.template index 7e22c13c..0d337abb 100644 --- a/docker/nginx/conf.d.templates/server.skylink.conf.template +++ b/docker/nginx/conf.d.templates/server.skylink.conf.template @@ -30,7 +30,12 @@ server { server { server_name *.${SERVER_DOMAIN}; # example: *.eu-ger-1.siasky.net - set_by_lua_block $skynet_portal_domain { return "${SERVER_DOMAIN}" } + set_by_lua_block $skynet_portal_domain { + -- when accessing portal directly through server domain, portal domain should be set to server domain + -- motivation: skynet-js uses Skynet-Portal-Api header (that is set to $skynet_portal_domain) to detect current + -- portal address and it should be server domain when accessing specific server by its domain address + return "${SERVER_DOMAIN}" + } set_by_lua_block $skynet_server_domain { return "${SERVER_DOMAIN}" } include /etc/nginx/conf.d/server/server.skylink; From d65397ac675abe2a6a258658bee748a62d6135b7 Mon Sep 17 00:00:00 2001 From: Karol Wypchlo Date: Fri, 22 Apr 2022 14:00:33 +0200 Subject: [PATCH 8/8] include nginx list of license conditions and disclaimer --- .../20-envsubst-on-templates.sh | 22 +++++++++++++++++++ docker/nginx/docker-entrypoint.sh | 22 +++++++++++++++++++ 2 files changed, 44 insertions(+) diff --git a/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh b/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh index 14d97a76..be9c5f8e 100755 --- a/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh +++ b/docker/nginx/docker-entrypoint.d/20-envsubst-on-templates.sh @@ -2,9 +2,31 @@ # https://github.com/nginxinc/docker-nginx/blob/master/entrypoint/20-envsubst-on-templates.sh # https://github.com/nginxinc/docker-nginx/blob/master/LICENSE + # Copyright (C) 2011-2016 Nginx, Inc. # All rights reserved. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. + +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + set -e ME=$(basename $0) diff --git a/docker/nginx/docker-entrypoint.sh b/docker/nginx/docker-entrypoint.sh index 3802dab5..d45a6d9a 100755 --- a/docker/nginx/docker-entrypoint.sh +++ b/docker/nginx/docker-entrypoint.sh @@ -3,9 +3,31 @@ # https://github.com/nginxinc/docker-nginx/blob/master/entrypoint/docker-entrypoint.sh # https://github.com/nginxinc/docker-nginx/blob/master/LICENSE + # Copyright (C) 2011-2016 Nginx, Inc. # All rights reserved. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. + +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + set -e if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then