2
0

docker-entrypoint.sh 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106
  1. #!/bin/bash
  2. set -e
  3. function _parse_true() {
  4. case "$1" in
  5. true | True | TRUE | 1)
  6. return 0
  7. ;;
  8. *)
  9. return 1
  10. ;;
  11. esac
  12. }
  13. function _parse_false() {
  14. case "$1" in
  15. false | False | FALSE | 0)
  16. return 0
  17. ;;
  18. *)
  19. return 1
  20. ;;
  21. esac
  22. }
  23. function _check_unix_socket() {
  24. # Warn if the DOCKER_HOST socket does not exist
  25. if [[ ${DOCKER_HOST} == unix://* ]]; then
  26. local SOCKET_FILE="${DOCKER_HOST#unix://}"
  27. if [[ ! -S ${SOCKET_FILE} ]]; then
  28. cat >&2 <<-EOT
  29. ERROR: you need to share your Docker host socket with a volume at ${SOCKET_FILE}
  30. Typically you should run your nginxproxy/nginx-proxy with: \`-v /var/run/docker.sock:${SOCKET_FILE}:ro\`
  31. See the documentation at: https://github.com/nginx-proxy/nginx-proxy/#usage
  32. EOT
  33. exit 1
  34. fi
  35. fi
  36. }
  37. function _resolvers() {
  38. # Compute the DNS resolvers for use in the templates - if the IP contains ":", it's IPv6 and must be enclosed in []
  39. RESOLVERS=$(awk '$1 == "nameserver" {print ($2 ~ ":")? "["$2"]": $2}' ORS=' ' /etc/resolv.conf | sed 's/ *$//g'); export RESOLVERS
  40. SCOPED_IPV6_REGEX='\[fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}\]'
  41. if [[ -z ${RESOLVERS} ]]; then
  42. echo 'Warning: unable to determine DNS resolvers for nginx' >&2
  43. unset RESOLVERS
  44. elif [[ ${RESOLVERS} =~ ${SCOPED_IPV6_REGEX} ]]; then
  45. echo -n 'Warning: Scoped IPv6 addresses removed from resolvers: ' >&2
  46. echo "${RESOLVERS}" | grep -Eo "$SCOPED_IPV6_REGEX" | paste -s -d ' ' >&2
  47. RESOLVERS=$(echo "${RESOLVERS}" | sed -r "s/${SCOPED_IPV6_REGEX}//g" | xargs echo -n); export RESOLVERS
  48. fi
  49. }
  50. function _setup_dhparam() {
  51. # DH params will be supplied for nginx here:
  52. local DHPARAM_FILE='/etc/nginx/dhparam/dhparam.pem'
  53. # Should be 2048, 3072, or 4096 (default):
  54. local FFDHE_GROUP="${DHPARAM_BITS:=4096}"
  55. # DH params may be provided by the user (rarely necessary)
  56. if [[ -f ${DHPARAM_FILE} ]]; then
  57. echo 'Warning: A custom dhparam.pem file was provided. Best practice is to use standardized RFC7919 DHE groups instead.' >&2
  58. return 0
  59. elif _parse_true "${DHPARAM_SKIP:=false}"; then
  60. echo 'Skipping Diffie-Hellman parameters setup.'
  61. return 0
  62. elif _parse_false "${DHPARAM_GENERATION:=true}"; then
  63. echo 'Warning: The DHPARAM_GENERATION environment variable is deprecated, please consider using DHPARAM_SKIP set to true instead.' >&2
  64. echo 'Skipping Diffie-Hellman parameters setup.'
  65. return 0
  66. elif [[ ! ${DHPARAM_BITS} =~ ^(2048|3072|4096)$ ]]; then
  67. echo "ERROR: Unsupported DHPARAM_BITS size: ${DHPARAM_BITS}. Use: 2048, 3072, or 4096 (default)." >&2
  68. exit 1
  69. fi
  70. echo 'Setting up DH Parameters..'
  71. # Use an existing pre-generated DH group from RFC7919 (https://datatracker.ietf.org/doc/html/rfc7919#appendix-A):
  72. local RFC7919_DHPARAM_FILE="/app/dhparam/ffdhe${FFDHE_GROUP}.pem"
  73. # Provide the DH params file to nginx:
  74. cp "${RFC7919_DHPARAM_FILE}" "${DHPARAM_FILE}"
  75. }
  76. # Run the init logic if the default CMD was provided
  77. if [[ $* == 'forego start -r' ]]; then
  78. _check_unix_socket
  79. _resolvers
  80. _setup_dhparam
  81. fi
  82. exec "$@"