frigate/docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

#!/command/with-contenv bash
# shellcheck shell=bash
# Start the NGINX service

set -o errexit -o nounset -o pipefail

runs_as_root=0
if [[ "$(id -u)" -eq 0 ]]; then
    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root nginx; then
        runs_as_root=1
    fi
fi

# Logs should be sent to stdout so that s6 can collect them

echo "[INFO] Starting NGINX..."

# Taken from https://github.com/felipecrs/cgroup-scripts/commits/master/get_cpus.sh
function get_cpus() {
    local quota=""
    local period=""

    if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
        if [ -f /sys/fs/cgroup/cpu.max ]; then
            read -r quota period </sys/fs/cgroup/cpu.max
            if [ "$quota" = "max" ]; then
                quota=""
                period=""
            fi
        else
            echo "[WARN] /sys/fs/cgroup/cpu.max not found. Falling back to /proc/cpuinfo." >&2
        fi
    else
        if [ -f /sys/fs/cgroup/cpu/cpu.cfs_quota_us ] && [ -f /sys/fs/cgroup/cpu/cpu.cfs_period_us ]; then
            quota=$(cat /sys/fs/cgroup/cpu/cpu.cfs_quota_us)
            period=$(cat /sys/fs/cgroup/cpu/cpu.cfs_period_us)

            if [ "$quota" = "-1" ]; then
                quota=""
                period=""
            fi
        else
            echo "[WARN] /sys/fs/cgroup/cpu/cpu.cfs_quota_us or /sys/fs/cgroup/cpu/cpu.cfs_period_us not found. Falling back to /proc/cpuinfo." >&2
        fi
    fi

    local cpus
    if [ "${period}" != "0" ] && [ -n "${quota}" ] && [ -n "${period}" ]; then
        cpus=$((quota / period))
        if [ "$cpus" -eq 0 ]; then
            cpus=1
        fi
    else
        cpus=$(grep -c ^processor /proc/cpuinfo)
    fi

    printf '%s' "$cpus"
}

function set_worker_processes() {
    # Capture number of assigned CPUs to calculate worker processes
    local cpus

    cpus=$(get_cpus)
    if [[ "${cpus}" -gt 4 ]]; then
        cpus=4
    fi

    sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /tmp/nginx/conf/nginx.conf
}

# Rebuilt root-owned every start: a symlink planted by the previously
# unprivileged nginx would redirect the root cp/tempio writes below onto any
# root file. rm does not traverse symlinks; the bare mkdir fails closed if raced.
rm -rf /tmp/nginx
mkdir /tmp/nginx
mkdir -p /tmp/nginx/conf /tmp/nginx/client_body /tmp/nginx/proxy \
         /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi
cp -r /usr/local/nginx/conf/. /tmp/nginx/conf/

set_worker_processes

# ensure the directory for ACME challenges exists
mkdir -p /etc/letsencrypt/www

# Create self signed certs if needed
letsencrypt_path=/etc/letsencrypt/live/frigate
mkdir -p $letsencrypt_path

if [ ! \( -f "$letsencrypt_path/privkey.pem" -a -f "$letsencrypt_path/fullchain.pem" \) ]; then
    echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
    openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
        -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
        -keyout "$letsencrypt_path/privkey.pem" -out "$letsencrypt_path/fullchain.pem" 2>/dev/null
    chmod 600 "$letsencrypt_path/privkey.pem"
    chmod 644 "$letsencrypt_path/fullchain.pem"
fi

# nginx settings are read once; both templates consume them
nginx_settings=$(python3 /usr/local/nginx/get_nginx_settings.py)

# build templates for optional FRIGATE_BASE_PATH environment variable
echo "$nginx_settings" | \
    tempio -template /usr/local/nginx/templates/base_path.gotmpl \
           -out /tmp/nginx/conf/base_path.conf

# build templates for additional network settings
echo "$nginx_settings" | \
    tempio -template /usr/local/nginx/templates/listen.gotmpl \
           -out /tmp/nginx/conf/listen.conf

if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
    chown -R frigate:frigate /tmp/nginx
    # heal the cache: a root `nginx -t` chowns every cycle path to the `user` directive user
    if [ -d /dev/shm/nginx_cache ]; then
        chown -R frigate:frigate /dev/shm/nginx_cache
    fi
    # nginx reopens /dev/stdout by path for its logs, and s6 made the pipe
    # root-owned 0600; without this the non-root master exits EACCES
    chown frigate /dev/stdout
    # self-signed certs are root-generated; tolerant because mounted certs may be :ro
    if [ -f "$letsencrypt_path/privkey.pem" ]; then
        chown frigate:frigate "$letsencrypt_path/privkey.pem" "$letsencrypt_path/fullchain.pem" 2>/dev/null || true
    fi
fi

# Replace the bash process with the NGINX process, redirecting stderr to stdout
exec 2>&1
# -e stderr: the compiled-in error log path is not writable by the runtime user
if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
    exec \
        s6-notifyoncheck -t 30000 -n 1 \
        nginx -e stderr -c /tmp/nginx/conf/nginx.conf
else
    exec \
        s6-notifyoncheck -t 30000 -n 1 \
        s6-setuidgid frigate nginx -e stderr -c /tmp/nginx/conf/nginx.conf
fi