clawbot
e0fa31341f
check / check (push) Successful in 11s
nginx.conf is now a template the nginx image renders into conf.d at container start. bin/entrypoint.sh gives nginx PORT, 8080 when unset or empty, and limits the rendering to PORT with NGINX_ENVSUBST_FILTER, so $uri, $host and every other nginx variable pass through unchanged. A PORT nginx cannot listen on stops the container non-zero. server_tokens off drops the version from the Server header and error pages. script/frontend-viewport-test renders the template the same way. EXPOSE still documents 8080; the backend stays on 127.0.0.1:8081. Model: opus-5-5
65 lines
2.3 KiB
Bash
Executable File
65 lines
2.3 KiB
Bash
Executable File
#!/bin/sh
|
|
# The container's entrypoint: runs netwatch-server and nginx side by
|
|
# side. TERM or INT stops both, and the container exits 0 if both exit
|
|
# cleanly. If either exits on its own, the other is stopped too and the
|
|
# container exits non-zero, so the platform restarts it instead of
|
|
# leaving it half up.
|
|
#
|
|
# No set -e: kill and wait return non-zero here in normal operation.
|
|
set -u
|
|
|
|
# A stop signal is only noted here; the loop below acts on it.
|
|
stop_requested=""
|
|
trap 'stop_requested=yes' TERM INT
|
|
|
|
# netwatch-server runs as the netwatch user and listens on loopback
|
|
# only, on a port other than the public one; nginx.conf proxies to this
|
|
# address. The netwatch user has no login shell, hence -s /bin/sh.
|
|
# busybox su replaces itself with the command instead of staying on as
|
|
# its parent, so $! is the server's own PID.
|
|
BIND_ADDRESS=127.0.0.1 PORT=8081 \
|
|
su -s /bin/sh netwatch -c 'exec netwatch-server' &
|
|
backend=$!
|
|
|
|
# nginx starts through the nginx image's own entrypoint, which applies
|
|
# the image's start-up configuration and then replaces itself with
|
|
# nginx. Part of that start-up configuration renders nginx.conf into
|
|
# conf.d with nginx listening on PORT, the public port, 8080 unless
|
|
# set. NGINX_ENVSUBST_FILTER limits that rendering to PORT: a variable
|
|
# nginx itself uses, such as $uri, would otherwise be replaced by an
|
|
# environment variable of the same name.
|
|
PORT="${PORT:-8080}" NGINX_ENVSUBST_FILTER='^PORT$' \
|
|
/docker-entrypoint.sh nginx -g 'daemon off;' &
|
|
nginx=$!
|
|
|
|
running() {
|
|
kill -0 "$1" 2>/dev/null
|
|
}
|
|
|
|
# POSIX sh cannot wait for whichever of two children exits first, so
|
|
# look once a second. The shell collects a child that has exited while
|
|
# it runs sleep, and running() is false for that child from then on.
|
|
while [ -z "$stop_requested" ] && running "$backend" && running "$nginx"; do
|
|
sleep 1
|
|
done
|
|
|
|
# Stop both, then wait until neither is left.
|
|
kill -TERM "$backend" "$nginx" 2>/dev/null
|
|
while running "$backend" || running "$nginx"; do
|
|
sleep 1
|
|
done
|
|
|
|
wait "$backend"
|
|
backend_status=$?
|
|
wait "$nginx"
|
|
nginx_status=$?
|
|
echo "entrypoint: netwatch-server exited $backend_status," \
|
|
"nginx exited $nginx_status"
|
|
|
|
# Success is a requested stop that both processes exited cleanly from.
|
|
if [ -n "$stop_requested" ] && [ "$backend_status" -eq 0 ] &&
|
|
[ "$nginx_status" -eq 0 ]; then
|
|
exit 0
|
|
fi
|
|
exit 1
|