Guard the shared proxy against Do It List's server block

compose.alpha.yaml

@@ -25,8 +25,10 @@ services:
       - /etc/letsencrypt:/etc/letsencrypt:ro
       - ./certbot-webroot:/var/www/certbot:ro
       # Do It List shares this box and this proxy; its server block lives
-      # in its own folder, and its containers join doitlist_edge.
-      - /opt/doitlist/proxy/doitlist.conf:/etc/nginx/conf.d/doitlist.conf:ro
+      # in its own folder, and its containers join doitlist_edge. The guard
+      # loads that block only when nginx accepts it.
+      - /opt/doitlist/proxy:/etc/nginx/doitlist:ro
+      - ./docker/production/nginx/doitlist-guard.sh:/docker-entrypoint.d/90-doitlist-guard.sh:ro
     networks:
       - default
       - doitlist_edge

docker/production/nginx/doitlist-guard.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# Do It List shares this proxy. Its server block may only join the config
+# when nginx still accepts it, so a broken or missing Do It List file can
+# never keep CryptoZing from starting or reloading.
+#
+# Runs at container start (from /docker-entrypoint.d) and on every Do It List
+# routing change: docker exec cz-nginx /docker-entrypoint.d/90-doitlist-guard.sh --strict
+# At start it always exits 0, since a failing entrypoint script stops nginx;
+# --strict exits 1 when it turned the new block away.
+set -u
+status=0
+[ "${1:-}" = "--strict" ] && status=1
+
+src=/etc/nginx/doitlist/doitlist.conf
+live=/etc/nginx/conf.d/doitlist.conf
+prev=/tmp/doitlist.conf.prev
+
+# At start, stderr is already the container log. Under docker exec it is only
+# the caller's console, so --strict also writes to the container log.
+log() {
+    echo "doitlist-guard: $*" >&2
+    [ "$status" = 1 ] && echo "doitlist-guard: $*" > /proc/1/fd/2 2>/dev/null
+    return 0
+}
+
+rm -f "$prev"
+[ -f "$live" ] && cp "$live" "$prev"
+
+if [ -f "$src" ]; then
+    cp "$src" "$live"
+else
+    rm -f "$live"
+fi
+
+if err=$(nginx -t -q 2>&1); then
+    exit 0
+fi
+
+log "Do It List's server block failed nginx -t; keeping the last good one"
+log "$err"
+if [ -f "$prev" ]; then
+    cp "$prev" "$live"
+    nginx -t -q 2>/dev/null && exit "$status"
+fi
+rm -f "$live"
+log "serving without Do It List"
+exit "$status"

scripts/deploy.sh

@@ -16,6 +16,12 @@ FILES=(-f compose.production.yaml)
 # Our deployment layers the site container in; self-hosters won't have it.
 [ -f compose.alpha.yaml ] && FILES+=(-f compose.alpha.yaml)
 
+# Do It List shares our front nginx over doitlist_edge. Neither stack owns the
+# network; make sure it exists so a missing one can't stop our proxy starting.
+if [ -f compose.alpha.yaml ] && ! docker network inspect doitlist_edge > /dev/null 2>&1; then
+    docker network create doitlist_edge > /dev/null
+fi
+
 # Persist the tag so later compose invocations keep serving it.
 if grep -q '^CZ_TAG=' .env; then
     sed -i "s|^CZ_TAG=.*|CZ_TAG=${TAG}|" .env