mi
65 lines
3.1 KiB
Bash
65 lines
3.1 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
required="PUBLIC_HOST NGINX_RATE_LIMIT_API NGINX_RATE_LIMIT_AUTH NGINX_RATE_LIMIT_PUBLIC NGINX_RATE_LIMIT_POLLING NGINX_RATE_LIMIT_DOWNLOADS NGINX_RATE_LIMIT_NOTIFICATIONS_READ NGINX_RATE_LIMIT_NOTIFICATIONS_ACTION NGINX_RATE_LIMIT_NOTIFICATION_UPLOAD NGINX_RATE_LIMIT_NOTIFICATIONS_PUBLIC NGINX_RATE_LIMIT_BITRIX NGINX_RATE_LIMIT_SMS_CALLBACK NGINX_RATE_LIMIT_WS NGINX_CLIENT_MAX_BODY_SIZE NGINX_MESSAGE_READ_TIMEOUT_SEC"
|
|
for name in $required; do
|
|
eval "value=\${$name:-}"
|
|
if [ -z "$value" ]; then
|
|
echo "nginx bootstrap: missing $name" >&2
|
|
exit 64
|
|
fi
|
|
done
|
|
|
|
case "${EXPO_DEV_SERVER_URL:-http://host.docker.internal:8081}" in
|
|
http://*/*) echo "nginx bootstrap: EXPO_DEV_SERVER_URL must not contain a path" >&2; exit 64 ;;
|
|
http://*) EXPO_DEV_SERVER_HOSTPORT=${EXPO_DEV_SERVER_URL#http://} ;;
|
|
*) echo "nginx bootstrap: EXPO_DEV_SERVER_URL must use http:// Docker/host DNS" >&2; exit 64 ;;
|
|
esac
|
|
export EXPO_DEV_SERVER_HOSTPORT
|
|
|
|
if [ "${FRONTEND_DEV_PROXY_ENABLED:-false}" = "true" ] \
|
|
&& { [ "${APP_ENV:-}" = "production" ] || [ "${APP_ENV:-}" = "production-like" ]; }; then
|
|
echo "nginx bootstrap: frontend dev proxy is forbidden in $APP_ENV" >&2
|
|
exit 64
|
|
fi
|
|
|
|
umask 027
|
|
common_vars='${NGINX_RATE_LIMIT_API} ${NGINX_RATE_LIMIT_AUTH} ${NGINX_RATE_LIMIT_PUBLIC} ${NGINX_RATE_LIMIT_POLLING} ${NGINX_RATE_LIMIT_DOWNLOADS} ${NGINX_RATE_LIMIT_NOTIFICATIONS_READ} ${NGINX_RATE_LIMIT_NOTIFICATIONS_ACTION} ${NGINX_RATE_LIMIT_NOTIFICATION_UPLOAD} ${NGINX_RATE_LIMIT_NOTIFICATIONS_PUBLIC} ${NGINX_RATE_LIMIT_BITRIX} ${NGINX_RATE_LIMIT_SMS_CALLBACK} ${NGINX_RATE_LIMIT_WS} ${NGINX_CLIENT_MAX_BODY_SIZE} ${EXPO_DEV_SERVER_HOSTPORT}'
|
|
site_vars='${PUBLIC_HOST} ${NGINX_TLS_CERTIFICATE} ${NGINX_TLS_CERTIFICATE_KEY} ${NGINX_MESSAGE_READ_TIMEOUT_SEC} ${BITRIX_FRAME_ANCESTORS}'
|
|
security_vars='${NGINX_HSTS_MAX_AGE} ${S3_CONNECT_SRC}'
|
|
|
|
envsubst "$common_vars" < /etc/nginx/templates-src/nginx.conf.template > /tmp/nginx.conf
|
|
envsubst "$security_vars" < /etc/nginx/templates-src/sites/security-headers.conf.template \
|
|
> /etc/nginx/generated/security-headers.conf
|
|
|
|
if [ "${FRONTEND_DEV_PROXY_ENABLED:-false}" = "true" ]; then
|
|
cp /etc/nginx/templates-src/sites/frontend-dev.conf.template /etc/nginx/generated/frontend-location.conf
|
|
else
|
|
cp /etc/nginx/templates-src/sites/frontend-static.conf.template /etc/nginx/generated/frontend-location.conf
|
|
fi
|
|
|
|
if [ "${NGINX_TLS_ENABLED:-true}" = "true" ]; then
|
|
for certificate in "${NGINX_TLS_CERTIFICATE:-}" "${NGINX_TLS_CERTIFICATE_KEY:-}"; do
|
|
if [ ! -r "$certificate" ]; then
|
|
echo "nginx bootstrap: TLS file is not readable: $certificate" >&2
|
|
exit 78
|
|
fi
|
|
done
|
|
envsubst "$site_vars" < /etc/nginx/templates-src/sites/site-tls.conf.template \
|
|
> /etc/nginx/generated/site.conf
|
|
else
|
|
envsubst '${PUBLIC_HOST}' < /etc/nginx/templates-src/sites/site-bootstrap.conf.template \
|
|
> /etc/nginx/generated/site.conf
|
|
fi
|
|
|
|
cache_root=/var/cache/nginx
|
|
cache_public=$cache_root/public
|
|
chown root:nginx "$cache_root"
|
|
chmod 2770 "$cache_root"
|
|
mkdir -p "$cache_public"
|
|
chown root:nginx "$cache_public"
|
|
chmod 2770 "$cache_public"
|
|
|
|
nginx -t -c /tmp/nginx.conf
|
|
exec nginx -c /tmp/nginx.conf -g 'daemon off;'
|