Entrypoint steps are functions called from main (closes #163)

bin/entrypoint.sh was top-level code with one helper; the shell section
of the code style guide asks for every step in a function and a main
called at the end. The PORT and TRUSTED_PROXIES checks, the data
directory, starting each process, the wait loop, stopping both and the
exit are now functions, which main calls in order, setting the stop
trap before either process starts. It stays POSIX sh with no set -e.
Messages and exit codes are unchanged; the 8081 message is passed to
echo as two arguments so its line fits in 80 columns.

Model: opus-5-5

TODO.md

@@ -21,6 +21,13 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: `bin/entrypoint.sh` has each of its steps in a function, and a
+  `main` at the end calls them in order, as the shell section of the code style
+  guide asks ([#163](https://git.eeqj.de/sneak/netwatch/issues/163)). It is
+  still POSIX sh with no `set -e`, and does what it did, with the same messages
+  and exit codes. Checked by running the image with each script: a normal start,
+  bad `PORT`, `TRUSTED_PROXIES` and `DATA_DIR` values, `docker stop`, INT, and
+  nginx exiting on its own
 - 2026-10-19: while report files cannot be written, the health check answers 503
   with `"status":"error"` and the same fields, so the image's `HEALTHCHECK`
   reports the container `unhealthy`

bin/entrypoint.sh

@@ -13,6 +13,7 @@ set -u
 # address and start anyway, and reports a bad port without naming
 # PORT, so a value that is not a usable port stops the container here,
 # before either process starts.
+check_port() {
     export PORT="${PORT:-8080}"
     case "$PORT" in
         *[!0-9]*)
@@ -28,9 +29,11 @@ if [ "${#PORT}" -gt 5 ] || [ "$PORT" -lt 1 ] || [ "$PORT" -gt 65535 ]; then
         exit 1
     fi
     if [ "$PORT" -eq 8081 ]; then
-    echo "entrypoint: PORT cannot be 8081, netwatch-server listens there" >&2
+        echo "entrypoint: PORT cannot be 8081, netwatch-server" \
+            "listens there" >&2
         exit 1
     fi
+}
 
 # TRUSTED_PROXIES names the reverse proxies in front of the container,
 # as IP addresses or CIDRs separated by commas. nginx takes the client
@@ -47,6 +50,7 @@ fi
 # TRUSTED_PROXIES. Its error, naming the CIDR, is dropped for the one
 # below, naming the entry as written. set -f keeps a * in an entry from
 # becoming a list of file names.
+write_trusted_proxies() {
     TRUSTED_PROXIES="${TRUSTED_PROXIES-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"
     set -f
     for proxy in $(printf '%s' "$TRUSTED_PROXIES" | tr ',' ' '); do
@@ -62,6 +66,7 @@ for proxy in $(printf '%s' "$TRUSTED_PROXIES" | tr ',' ' '); do
         fi
         echo "set_real_ip_from $cidr;"
     done > /etc/nginx/trusted-proxies.conf
+}
 
 # netwatch-server keeps its report files in DATA_DIR, on the /data
 # volume, which may be a host directory owned by root or by another
@@ -73,12 +78,10 @@ done > /etc/nginx/trusted-proxies.conf
 # naming DATA_DIR, unless DATA_DIR is /data or a path below it, and it
 # acts on nothing outside /data, whatever symbolic or hard links it
 # meets there.
+prepare_data_dir() {
     export DATA_DIR="${DATA_DIR:-/data/reports}"
     netwatch-server prepare-data-dir "$DATA_DIR" || exit 1
-
+}
-# A stop signal is only noted here; the loop below acts on it.
-stop_requested=""
-trap 'stop_requested=yes' TERM INT
 
 # netwatch-server runs as the netwatch user and listens on loopback
 # only, on a port other than the public one; configs/nginx.conf proxies
@@ -87,9 +90,11 @@ trap 'stop_requested=yes' TERM INT
 # the container has. The netwatch user has no login shell, hence -s
 # /bin/sh. busybox su replaces itself with the command instead of
 # staying on as its parent, so $! is the server's own PID.
+start_backend() {
     BIND_ADDRESS=127.0.0.1 PORT=8081 TRUSTED_PROXIES=127.0.0.1/32 \
         su -s /bin/sh netwatch -c 'exec netwatch-server' &
     backend=$!
+}
 
 # nginx starts through the nginx image's own entrypoint, which applies
 # the image's start-up configuration and then replaces itself with
@@ -98,9 +103,11 @@ backend=$!
 # that rendering to PORT: a variable nginx itself uses, such as $uri,
 # would otherwise be replaced by an environment variable of the same
 # name.
+start_nginx() {
     NGINX_ENVSUBST_FILTER='^PORT$' \
         /docker-entrypoint.sh nginx -g 'daemon off;' &
     nginx=$!
+}
 
 running() {
     kill -0 "$1" 2>/dev/null
@@ -109,26 +116,47 @@ running() {
 # POSIX sh cannot wait for whichever of two children exits first, so
 # look once a second. The shell collects a child that has exited while
 # it runs sleep, and running() is false for that child from then on.
+wait_for_stop_or_exit() {
     while [ -z "$stop_requested" ] && running "$backend" && running "$nginx"; do
         sleep 1
     done
+}
 
 # Stop both, then wait until neither is left.
+stop_both() {
     kill -TERM "$backend" "$nginx" 2>/dev/null
     while running "$backend" || running "$nginx"; do
         sleep 1
     done
+}
 
+# Success is a requested stop that both processes exited cleanly from.
+exit_with_status() {
     wait "$backend"
     backend_status=$?
     wait "$nginx"
     nginx_status=$?
     echo "entrypoint: netwatch-server exited $backend_status," \
         "nginx exited $nginx_status"
-
-# Success is a requested stop that both processes exited cleanly from.
     if [ -n "$stop_requested" ] && [ "$backend_status" -eq 0 ] &&
         [ "$nginx_status" -eq 0 ]; then
         exit 0
     fi
     exit 1
+}
+
+main() {
+    check_port
+    write_trusted_proxies
+    prepare_data_dir
+    # A stop signal is only noted here; wait_for_stop_or_exit acts on it.
+    stop_requested=""
+    trap 'stop_requested=yes' TERM INT
+    start_backend
+    start_nginx
+    wait_for_stop_or_exit
+    stop_both
+    exit_with_status
+}
+
+main "$@"