add host

docker-entrypoint.sh

@@ -10,7 +10,6 @@ mkdir -p "${CONF_DIR}"
 ALLOWLIST_FILE="${CONF_DIR}/allowlist.conf"
 
 if [ -z "${ALLOWED_CIDR}" ]; then
-    # Dev mode: allow all IPs
     cat > "${ALLOWLIST_FILE}" <<'GEO'
 geo $allowed_ip {
     default 1;
@@ -18,12 +17,11 @@ geo $allowed_ip {
 GEO
     echo "[entrypoint] ALLOWED_CIDR is empty — allowing all IPs (dev mode)"
 else
-    # Build geo block from comma-separated CIDRs
     {
         echo 'geo $allowed_ip {'
         echo '    default 0;'
         echo "${ALLOWED_CIDR}" | tr ',' '\n' | while read -r cidr; do
-            cidr=$(echo "${cidr}" | xargs)  # trim whitespace
+            cidr=$(echo "${cidr}" | xargs)
             [ -n "${cidr}" ] && echo "    ${cidr} 1;"
         done
         echo '}'
@@ -35,10 +33,10 @@ fi
 AUTH_FILE="${CONF_DIR}/auth.conf"
 
 if [ -z "${PROXY_SECRET}" ]; then
-    echo "[entrypoint] WARNING: PROXY_SECRET is not set — all requests will be rejected!"
+    echo "[entrypoint] PROXY_SECRET is not set — token auth disabled (open mode)"
     cat > "${AUTH_FILE}" <<'MAP'
 map $http_x_proxy_token $auth_ok {
-    default 0;
+    default 1;
 }
 MAP
 else
@@ -51,6 +49,39 @@ MAP
     echo "[entrypoint] Token auth configured"
 fi
 
-# --- 3. Start nginx ---
+# --- 3. Copy locations.conf ---
+cp /etc/nginx/locations.conf "${CONF_DIR}/locations.conf"
+echo "[entrypoint] Locations config copied"
+
+# --- 4. Generate HTTPS server block (if certs exist) ---
+HTTPS_FILE="${CONF_DIR}/https_server.conf"
+SSL_CERT="/etc/nginx/ssl/tls.crt"
+SSL_KEY="/etc/nginx/ssl/tls.key"
+
+if [ -f "${SSL_CERT}" ] && [ -f "${SSL_KEY}" ]; then
+    cat > "${HTTPS_FILE}" <<HTTPS
+server {
+    listen 8443 ssl;
+    server_name _;
+
+    ssl_certificate     ${SSL_CERT};
+    ssl_certificate_key ${SSL_KEY};
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache   shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    include /etc/nginx/conf.d/locations.conf;
+}
+HTTPS
+    echo "[entrypoint] HTTPS enabled on port 8443 (cert: ${SSL_CERT})"
+else
+    # Empty file so nginx include does not fail
+    : > "${HTTPS_FILE}"
+    echo "[entrypoint] No TLS certs found at ${SSL_CERT} — HTTPS disabled"
+fi
+
+# --- 5. Start nginx ---
 echo "[entrypoint] Starting nginx..."
 exec nginx -g 'daemon off;'