nginx: listen on PORT, default 8080; server_tokens off (closes #26)

nginx.conf is now a template the nginx image renders into conf.d at
container start. bin/entrypoint.sh sets PORT to 8080 when unset or
empty, and stops with an error before starting anything when PORT is
not digits only: nginx would take a value such as localhost or
unix:/tmp/x.sock as an address and start anyway. NGINX_ENVSUBST_FILTER
limits the rendering to PORT, so $uri, $host and every other nginx
variable pass through unchanged. server_tokens off drops the version
from the Server header and error pages. script/frontend-viewport-test
renders the template the same way. EXPOSE still documents 8080; the
backend stays on 127.0.0.1:8081.

Model: opus-5-5

bin/entrypoint.sh

@@ -8,6 +8,18 @@
 # No set -e: kill and wait return non-zero here in normal operation.
 set -u
 
+# PORT is the public port nginx listens on, 8080 when unset or empty.
+# nginx would take a value such as localhost or unix:/tmp/x.sock as an
+# address and start anyway, so anything but digits stops the container
+# here, before either process starts.
+export PORT="${PORT:-8080}"
+case "$PORT" in
+    *[!0-9]*)
+        echo "entrypoint: PORT must be a port number, not '$PORT'" >&2
+        exit 1
+        ;;
+esac
+
 # A stop signal is only noted here; the loop below acts on it.
 stop_requested=""
 trap 'stop_requested=yes' TERM INT
@@ -23,8 +35,13 @@ backend=$!
 
 # nginx starts through the nginx image's own entrypoint, which applies
 # the image's start-up configuration and then replaces itself with
-# nginx.
-/docker-entrypoint.sh nginx -g 'daemon off;' &
+# nginx. Part of that start-up configuration renders nginx.conf into
+# conf.d with nginx listening on PORT. NGINX_ENVSUBST_FILTER limits
+# that rendering to PORT: a variable nginx itself uses, such as $uri,
+# would otherwise be replaced by an environment variable of the same
+# name.
+NGINX_ENVSUBST_FILTER='^PORT$' \
+    /docker-entrypoint.sh nginx -g 'daemon off;' &
 nginx=$!
 
 running() {