mirror of
https://github.com/blakeblackshear/frigate.git
synced 2026-10-02 12:56:51 +03:00
139 lines
4.8 KiB
Plaintext
Executable File
139 lines
4.8 KiB
Plaintext
Executable File
#!/command/with-contenv bash
|
|
# shellcheck shell=bash
|
|
# Start the NGINX service
|
|
|
|
set -o errexit -o nounset -o pipefail
|
|
|
|
runs_as_root=0
|
|
if [[ "$(id -u)" -eq 0 ]]; then
|
|
if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root nginx; then
|
|
runs_as_root=1
|
|
fi
|
|
fi
|
|
|
|
# Logs should be sent to stdout so that s6 can collect them
|
|
|
|
echo "[INFO] Starting NGINX..."
|
|
|
|
# Taken from https://github.com/felipecrs/cgroup-scripts/commits/master/get_cpus.sh
|
|
function get_cpus() {
|
|
local quota=""
|
|
local period=""
|
|
|
|
if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
|
|
if [ -f /sys/fs/cgroup/cpu.max ]; then
|
|
read -r quota period </sys/fs/cgroup/cpu.max
|
|
if [ "$quota" = "max" ]; then
|
|
quota=""
|
|
period=""
|
|
fi
|
|
else
|
|
echo "[WARN] /sys/fs/cgroup/cpu.max not found. Falling back to /proc/cpuinfo." >&2
|
|
fi
|
|
else
|
|
if [ -f /sys/fs/cgroup/cpu/cpu.cfs_quota_us ] && [ -f /sys/fs/cgroup/cpu/cpu.cfs_period_us ]; then
|
|
quota=$(cat /sys/fs/cgroup/cpu/cpu.cfs_quota_us)
|
|
period=$(cat /sys/fs/cgroup/cpu/cpu.cfs_period_us)
|
|
|
|
if [ "$quota" = "-1" ]; then
|
|
quota=""
|
|
period=""
|
|
fi
|
|
else
|
|
echo "[WARN] /sys/fs/cgroup/cpu/cpu.cfs_quota_us or /sys/fs/cgroup/cpu/cpu.cfs_period_us not found. Falling back to /proc/cpuinfo." >&2
|
|
fi
|
|
fi
|
|
|
|
local cpus
|
|
if [ "${period}" != "0" ] && [ -n "${quota}" ] && [ -n "${period}" ]; then
|
|
cpus=$((quota / period))
|
|
if [ "$cpus" -eq 0 ]; then
|
|
cpus=1
|
|
fi
|
|
else
|
|
cpus=$(grep -c ^processor /proc/cpuinfo)
|
|
fi
|
|
|
|
printf '%s' "$cpus"
|
|
}
|
|
|
|
function set_worker_processes() {
|
|
# Capture number of assigned CPUs to calculate worker processes
|
|
local cpus
|
|
|
|
cpus=$(get_cpus)
|
|
if [[ "${cpus}" -gt 4 ]]; then
|
|
cpus=4
|
|
fi
|
|
|
|
sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /tmp/nginx/conf/nginx.conf
|
|
}
|
|
|
|
# Rebuilt root-owned every start: a symlink planted by the previously
|
|
# unprivileged nginx would redirect the root cp/tempio writes below onto any
|
|
# root file. rm does not traverse symlinks; the bare mkdir fails closed if raced.
|
|
rm -rf /tmp/nginx
|
|
mkdir /tmp/nginx
|
|
mkdir -p /tmp/nginx/conf /tmp/nginx/client_body /tmp/nginx/proxy \
|
|
/tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi
|
|
cp -r /usr/local/nginx/conf/. /tmp/nginx/conf/
|
|
|
|
set_worker_processes
|
|
|
|
# ensure the directory for ACME challenges exists
|
|
mkdir -p /etc/letsencrypt/www
|
|
|
|
# Create self signed certs if needed
|
|
letsencrypt_path=/etc/letsencrypt/live/frigate
|
|
mkdir -p $letsencrypt_path
|
|
|
|
if [ ! \( -f "$letsencrypt_path/privkey.pem" -a -f "$letsencrypt_path/fullchain.pem" \) ]; then
|
|
echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
|
|
openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
|
|
-subj "/O=FRIGATE DEFAULT CERT/CN=*" \
|
|
-keyout "$letsencrypt_path/privkey.pem" -out "$letsencrypt_path/fullchain.pem" 2>/dev/null
|
|
chmod 600 "$letsencrypt_path/privkey.pem"
|
|
chmod 644 "$letsencrypt_path/fullchain.pem"
|
|
fi
|
|
|
|
# nginx settings are read once; both templates consume them
|
|
nginx_settings=$(python3 /usr/local/nginx/get_nginx_settings.py)
|
|
|
|
# build templates for optional FRIGATE_BASE_PATH environment variable
|
|
echo "$nginx_settings" | \
|
|
tempio -template /usr/local/nginx/templates/base_path.gotmpl \
|
|
-out /tmp/nginx/conf/base_path.conf
|
|
|
|
# build templates for additional network settings
|
|
echo "$nginx_settings" | \
|
|
tempio -template /usr/local/nginx/templates/listen.gotmpl \
|
|
-out /tmp/nginx/conf/listen.conf
|
|
|
|
if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
|
|
chown -R frigate:frigate /tmp/nginx
|
|
# heal the cache: a root `nginx -t` chowns every cycle path to the `user` directive user
|
|
if [ -d /dev/shm/nginx_cache ]; then
|
|
chown -R frigate:frigate /dev/shm/nginx_cache
|
|
fi
|
|
# nginx reopens /dev/stdout by path for its logs, and s6 made the pipe
|
|
# root-owned 0600; without this the non-root master exits EACCES
|
|
chown frigate /dev/stdout
|
|
# self-signed certs are root-generated; tolerant because mounted certs may be :ro
|
|
if [ -f "$letsencrypt_path/privkey.pem" ]; then
|
|
chown frigate:frigate "$letsencrypt_path/privkey.pem" "$letsencrypt_path/fullchain.pem" 2>/dev/null || true
|
|
fi
|
|
fi
|
|
|
|
# Replace the bash process with the NGINX process, redirecting stderr to stdout
|
|
exec 2>&1
|
|
# -e stderr: the compiled-in error log path is not writable by the runtime user
|
|
if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
|
|
exec \
|
|
s6-notifyoncheck -t 30000 -n 1 \
|
|
nginx -e stderr -c /tmp/nginx/conf/nginx.conf
|
|
else
|
|
exec \
|
|
s6-notifyoncheck -t 30000 -n 1 \
|
|
s6-setuidgid frigate nginx -e stderr -c /tmp/nginx/conf/nginx.conf
|
|
fi
|