docker-entrypoint.sh

#!/bin/bash
set -euo pipefail

# ---------------------------------------------------------------------------
# Container adaptation of the systemd EnvironmentFile mechanism.
#
# On a systemd host, nginx gets UPSTREAM_API_KEY via:
#     EnvironmentFile=/etc/nginx-upstream.env
# Here we read the same root-only file and export it into the nginx master
# process environment, which is what `env upstream_api_key;` exposes to the
# config. The key is still never written into nginx.conf.
# ---------------------------------------------------------------------------
if [[ -f /etc/nginx-upstream.env ]]; then
  # shellcheck disable=SC1091
  set -a; source /etc/nginx-upstream.env; set +a
  echo "[entrypoint] loaded UPSTREAM_API_KEY from /etc/nginx-upstream.env"
fi

# Fail fast if the installer did not produce a config.
[[ -f /usr/local/nginx/nginx.conf ]] || { echo "[entrypoint] nginx.conf missing" >&2; exit 1; }

# Demo upstream: echoes the headers it received, so the injected
# Authorization header is visible at the proxy surface.
python3 /opt/demo_upstream.py &
echo "[entrypoint] demo upstream listening on 127.0.0.1:5000"

# Validate, then run in foreground (no systemd in container).
/usr/local/nginx/sbin/nginx -t
exec /usr/local/nginx/sbin/nginx -g 'daemon off;'