Add nginx (closes #11)

Install nginx from apt and check nginx -v in the smoke test.

Model: deepseek-v4-pro

README.md

@@ -12,7 +12,7 @@ Image: `git.eeqj.de/sneak/baseimage`, built for `linux/amd64` and
 ## What is in it
 
 | Component           | Source                                     | Location                                         |
-| --------------- | ------------------------------ | ------------------------------ |
+| ------------------- | ------------------------------------------ | ------------------------------------------------ |
 | Ubuntu 26.04        | `ubuntu:26.04`, fully upgraded             | `/`                                              |
 | init                | `runsvinit` (built from Go)                | `/usr/local/sbin/runsvinit`                      |
 | services            | `runit` (apt)                              | `/etc/sv`, `/etc/service`                        |
@@ -50,6 +50,7 @@ Image: `git.eeqj.de/sneak/baseimage`, built for `linux/amd64` and
 | Bundler             | apt `bundler`                              | `bundle` on `PATH`                               |
 | Valkey              | apt `valkey-server`, `valkey-tools`        | `valkey-server`, `valkey-cli`                    |
 | PostgreSQL          | apt `postgresql`                           | `psql`, `postgres`, `initdb`, `pg_ctl` on `PATH` |
+| nginx               | apt                                        | `/usr/sbin/nginx`                                |
 
 Plus the usual odds and ends: `git`, `curl`, `wget`, `jq`, `rsync`,
 `openssh-client`, `zip`/`unzip`, `xz-utils`, `bzip2`, and the `-dev`
@@ -201,8 +202,8 @@ Every unpinned version is resolved at build time, so a rebuild picks up
 current packages and tool releases. Rebuild and retag periodically; child
 images get everything new on their next build.
 
-The registry sits behind Traefik. The large `RUN` layer (about 650MB
+The registry sits behind Traefik. The large `RUN` layer (about 1.63 GB
-compressed, over 2GB uncompressed) needs the entrypoint
+compressed, 4.3 GB on disk) needs the entrypoint
 `respondingTimeouts` raised from Traefik's 60 second default, or the final
 blob commit fails with a 499 or 500 and docker re-uploads the layer.
 
@@ -217,7 +218,7 @@ Interactive shells (login shells, or anything that sources
   `commit-logs`, `clean`, plus `lib.sh` (shared setup) and `native-arch`.
 - `Dockerfile` — base, environment, one `COPY`, one `ADD`, one `RUN`.
 - `build.sh` — everything the `RUN` does, in order: apt, Go, runsvinit,
-  golangci-lint, Hugo, nvm/Node/corepack/wrangler, pyenv/Python, cleanup,
+  golangci-lint, govulncheck, Hugo, nvm/Node/corepack/wrangler, browsers,
-  sanity checks. Removes itself when done.
+  pyenv/Python, cleanup, sanity checks. Removes itself when done.
 - `rootfs/` — files copied verbatim onto `/` before `build.sh` runs.
 - `logs/YYYY-MM-DD/` — build logs for each released image, per arch.

bin/test

@@ -39,6 +39,7 @@ docker run --rm "$img" bash -ec '
     valkey-cli shutdown nosave
     psql --version
     postgres --version
+    nginx -t
     playwright --version
     firefox --version
     geckodriver --version

build.sh

@@ -32,7 +32,8 @@ apt-get -y install --no-install-recommends \
     libvips-dev libvips-tools libheif-dev libheif-plugin-aomenc \
     imagemagick ghostscript \
     ruby ruby-dev bundler \
-    valkey-server valkey-tools postgresql
+    valkey-server valkey-tools postgresql \
+    nginx
 
 # Link the PostgreSQL server binaries onto PATH. They live under a versioned
 # directory (/usr/lib/postgresql/*/bin); the client psql is already on PATH.
@@ -145,8 +146,9 @@ rm -rf /usr/share/doc /usr/share/man /usr/share/info /usr/share/lintian
 find /usr/share/locale -mindepth 1 -maxdepth 1 ! -name 'en*' ! -name 'locale.alias' -exec rm -rf {} +
 rm -rf /root/.cache /root/.npm /root/.config /root/go /tmp/* /var/tmp/*
 
-# Valkey opens its log file at startup; recreate the log directory the
+# nginx and Valkey open their log files at startup; recreate the log
-# cleanup above removed, with its package owner.
+# directories the cleanup above removed, with their package owners.
+install -d -o root -g adm /var/log/nginx
 install -d -o valkey -g adm -m 2750 /var/log/valkey
 
 # --- sanity ------------------------------------------------------------------
@@ -170,6 +172,7 @@ valkey-cli ping
 valkey-cli shutdown nosave
 psql --version
 postgres --version
+nginx -t
 hugo version
 node --version
 npm --version