frigate/docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

#!/command/with-contenv bash
# shellcheck shell=bash
# Start the NGINX service

set -o errexit -o nounset -o pipefail

runs_as_root=0
if [[ "$(id -u)" -eq 0 ]]; then
    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root nginx; then
        runs_as_root=1
    fi
fi

# Logs should be sent to stdout so that s6 can collect them

echo "[INFO] Starting NGINX..."

# Taken from https://github.com/felipecrs/cgroup-scripts/commits/master/get_cpus.sh
function get_cpus() {
    local quota=""
    local period=""

    if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
        if [ -f /sys/fs/cgroup/cpu.max ]; then
            read -r quota period </sys/fs/cgroup/cpu.max
            if [ "$quota" = "max" ]; then
                quota=""
                period=""
            fi
        else
            echo "[WARN] /sys/fs/cgroup/cpu.max not found. Falling back to /proc/cpuinfo." >&2
        fi
    else
        if [ -f /sys/fs/cgroup/cpu/cpu.cfs_quota_us ] && [ -f /sys/fs/cgroup/cpu/cpu.cfs_period_us ]; then
            quota=$(cat /sys/fs/cgroup/cpu/cpu.cfs_quota_us)
            period=$(cat /sys/fs/cgroup/cpu/cpu.cfs_period_us)

            if [ "$quota" = "-1" ]; then
                quota=""
                period=""
            fi
        else
            echo "[WARN] /sys/fs/cgroup/cpu/cpu.cfs_quota_us or /sys/fs/cgroup/cpu/cpu.cfs_period_us not found. Falling back to /proc/cpuinfo." >&2
        fi
    fi

    local cpus
    if [ "${period}" != "0" ] && [ -n "${quota}" ] && [ -n "${period}" ]; then
        cpus=$((quota / period))
        if [ "$cpus" -eq 0 ]; then
            cpus=1
        fi
    else
        cpus=$(grep -c ^processor /proc/cpuinfo)
    fi

    printf '%s' "$cpus"
}

function set_worker_processes() {
    # Capture number of assigned CPUs to calculate worker processes
    local cpus

    cpus=$(get_cpus)
    if [[ "${cpus}" -gt 4 ]]; then
        cpus=4
    fi

    sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /tmp/nginx/conf/nginx.conf
}

# Rebuilt root-owned every start: a symlink planted by the previously
# unprivileged nginx would redirect the root cp/tempio writes below onto any
# root file. rm does not traverse symlinks; the bare mkdir fails closed if raced.
rm -rf /tmp/nginx
mkdir /tmp/nginx
mkdir -p /tmp/nginx/conf /tmp/nginx/client_body /tmp/nginx/proxy \
         /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi
cp -r /usr/local/nginx/conf/. /tmp/nginx/conf/

set_worker_processes

# TLS certs: user-mounted certs at /etc/letsencrypt/live/frigate (documented
# contract) always win; otherwise fall back to a self-signed cert persisted in
# /config/tls, which stays writable under a read-only root filesystem.
letsencrypt_path=/etc/letsencrypt/live/frigate
selfsigned_path=/config/tls

if [ -f "$letsencrypt_path/privkey.pem" ] && [ -f "$letsencrypt_path/fullchain.pem" ]; then
    cert_path="$letsencrypt_path"
else
    cert_path="$selfsigned_path"

    # Root writing into /config follows any symlink planted there, and /config
    # is owned by whoever the host mount says, not by root. Generate as the
    # runtime user wherever we are going to drop to it; the escape hatch keeps
    # root all the way through, so that path is refused rather than dropped.
    gen=()
    if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
        gen=(s6-setuidgid frigate)
    elif [[ "$(id -u)" -eq 0 ]]; then
        for link in "$cert_path" "$cert_path/privkey.pem" "$cert_path/fullchain.pem"; do
            if [[ -L "$link" ]]; then
                echo "[ERROR] ${link} is a symlink; refusing to write TLS material through it as root" >&2
                exit 1
            fi
        done
    fi

    "${gen[@]}" mkdir -p "$cert_path"

    if [ ! \( -f "$cert_path/privkey.pem" -a -f "$cert_path/fullchain.pem" \) ]; then
        echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
        "${gen[@]}" openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
            -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
            -keyout "$cert_path/privkey.pem" -out "$cert_path/fullchain.pem" 2>/dev/null
        "${gen[@]}" chmod 600 "$cert_path/privkey.pem"
        "${gen[@]}" chmod 644 "$cert_path/fullchain.pem"
    fi
fi

# ACME challenges are only served from a writable rootfs; skipping the mkdir
# under read_only leaves the location 404ing, which is the same as unused
mkdir -p /etc/letsencrypt/www 2>/dev/null || true

# nginx settings are read once; both templates consume them
nginx_settings=$(python3 /usr/local/nginx/get_nginx_settings.py)

# build templates for optional FRIGATE_BASE_PATH environment variable
echo "$nginx_settings" | \
    tempio -template /usr/local/nginx/templates/base_path.gotmpl \
           -out /tmp/nginx/conf/base_path.conf

# build templates for additional network settings; listen.conf is the only
# template that needs the resolved cert directory
echo "$nginx_settings" | \
    jq --arg p "$cert_path" '.tls.cert_path = $p' | \
    tempio -template /usr/local/nginx/templates/listen.gotmpl \
           -out /tmp/nginx/conf/listen.conf

if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
    chown -R frigate:frigate /tmp/nginx
    # heal the cache: a root `nginx -t` chowns every cycle path to the `user` directive user
    if [ -d /dev/shm/nginx_cache ]; then
        chown -R frigate:frigate /dev/shm/nginx_cache
    fi
    # nginx reopens /dev/stdout by path for its logs, and s6 made the pipe
    # root-owned 0600; without this the non-root master exits EACCES
    chown frigate /dev/stdout
    # Only mounted certs need handing over; the self-signed pair is already
    # owned by the runtime user that generated it. Never chown the /config copy:
    # chown follows symlinks, so it would retarget onto any root file the
    # runtime user pointed it at. Tolerant because mounted certs may be :ro.
    if [ "$cert_path" = "$letsencrypt_path" ] && [ -f "$cert_path/privkey.pem" ]; then
        chown frigate:frigate "$cert_path/privkey.pem" "$cert_path/fullchain.pem" 2>/dev/null || true
    fi
fi

# Replace the bash process with the NGINX process, redirecting stderr to stdout
exec 2>&1
# -e stderr: the compiled-in error log path is not writable by the runtime user
if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
    exec \
        s6-notifyoncheck -t 30000 -n 1 \
        nginx -e stderr -c /tmp/nginx/conf/nginx.conf
else
    exec \
        s6-notifyoncheck -t 30000 -n 1 \
        s6-setuidgid frigate nginx -e stderr -c /tmp/nginx/conf/nginx.conf
fi