let services listed in FRIGATE_ROOT_SERVICES skip the privilege drop

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -4,6 +4,13 @@
 
 set -o errexit -o nounset -o pipefail
 
+runs_as_root=0
+if [[ "$(id -u)" -eq 0 ]]; then
+    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root nginx; then
+        runs_as_root=1
+    fi
+fi
+
 # Logs should be sent to stdout so that s6 can collect them
 
 echo "[INFO] Starting NGINX..."
@@ -104,7 +111,7 @@ echo "$nginx_settings" | \
     tempio -template /usr/local/nginx/templates/listen.gotmpl \
            -out /tmp/nginx/conf/listen.conf
 
-if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
+if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
     chown -R frigate:frigate /tmp/nginx
     # heal the cache if a root `nginx -t` chowned it (ngx_create_paths chowns
     # every cycle path to the `user` directive user when run as root)
@@ -125,7 +132,7 @@ fi
 exec 2>&1
 # -e stderr: the compile-time default error log under /usr/local/nginx/logs
 # is not writable by the runtime user and would alert before config load
-if [[ "$(id -u)" -ne 0 || "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
+if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
     exec \
         s6-notifyoncheck -t 30000 -n 1 \
         nginx -e stderr -c /tmp/nginx/conf/nginx.conf