angie/autoconf.dist/http-resolver.conf.j2

@@ -1,2 +0,0 @@
-{%- set resolver_status_zone = 'http_resolver' -%}
-{% include 'resolver.j2m' %}

angie/autoconf.dist/resolver.j2m

@@ -1,13 +0,0 @@
-{%- if env.NGX_RESOLVERS %}
-  {%- if env.NGX_RESOLVER_STACK == 'any' %}
-resolver {{ env.NGX_RESOLVERS }} status_zone={{ resolver_status_zone }};
-  {%- elif env.NGX_RESOLVER_STACK == 'ipv4' %}
-resolver {{ env.NGX_RESOLVERS }} status_zone={{ resolver_status_zone }} ipv4=on ipv6=off;
-  {%- elif env.NGX_RESOLVER_STACK == 'ipv6' %}
-resolver {{ env.NGX_RESOLVERS }} status_zone={{ resolver_status_zone }} ipv4=off ipv6=on;
-  {%- endif %}
-{%- endif %}
-
-{%- if env.NGX_RESOLVER_TIMEOUT %}
-resolver_timeout {{ env.NGX_RESOLVER_TIMEOUT }};
-{%- endif %}

angie/autoconf.dist/stream-resolver.conf.j2

@@ -1,2 +0,0 @@
-{%- set resolver_status_zone = 'stream_resolver' -%}
-{% include 'resolver.j2m' %}

build-scripts/image-base.sh

@@ -2,7 +2,7 @@
 set -ef
 cd "$(dirname "$0")/.."
 
-IMAGE_VERSION="${IMAGE_VERSION:-v0.0.2}"
+IMAGE_VERSION="${IMAGE_VERSION:-v0.0.1}"
 
 set -a
 BUILDAH_FORMAT="${BUILDAH_FORMAT:-docker}"

build-scripts/image-deps.sh

@@ -2,7 +2,7 @@
 set -ef
 cd "$(dirname "$0")/.."
 
-IMAGE_VERSION="${IMAGE_VERSION:-v0.0.2}"
+IMAGE_VERSION="${IMAGE_VERSION:-v0.0.1}"
 
 set -a
 BUILDAH_FORMAT="${BUILDAH_FORMAT:-docker}"

build-scripts/image.sh

@@ -2,7 +2,7 @@
 set -ef
 cd "$(dirname "$0")/.."
 
-IMAGE_VERSION="${IMAGE_VERSION:-v0.0.2}"
+IMAGE_VERSION="${IMAGE_VERSION:-v0.0.1}"
 
 set -a
 BUILDAH_FORMAT="${BUILDAH_FORMAT:-docker}"

doc/examples/basic/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.2
+FROM docker.io/rockdrilla/angie-conv:v0.0.1
 SHELL [ "/bin/sh", "-ec" ]
 
 COPY /site/   /etc/angie/site/

doc/examples/basic/README.md

@@ -11,7 +11,7 @@ server {
 Dockerfile:
 
 ```dockerfile
-FROM docker.io/rockdrilla/angie-conv:v0.0.2
+FROM docker.io/rockdrilla/angie-conv:v0.0.1
 
 COPY /site/   /etc/angie/site/
 COPY /static/ /etc/angie/static/

doc/examples/njs/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.2
+FROM docker.io/rockdrilla/angie-conv:v0.0.1
 SHELL [ "/bin/sh", "-ec" ]
 
 COPY /site/ /etc/angie/site/

doc/examples/njs/README.md

@@ -3,7 +3,7 @@
 Dockerfile:
 
 ```dockerfile
-FROM docker.io/rockdrilla/angie-conv:v0.0.2
+FROM docker.io/rockdrilla/angie-conv:v0.0.1
 
 COPY /site/ /etc/angie/site/
 

doc/examples/perl/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.2
+FROM docker.io/rockdrilla/angie-conv:v0.0.1
 SHELL [ "/bin/sh", "-ec" ]
 
 COPY /site/ /etc/angie/site/

doc/examples/perl/README.md

@@ -3,7 +3,7 @@
 Dockerfile:
 
 ```dockerfile
-FROM docker.io/rockdrilla/angie-conv:v0.0.2
+FROM docker.io/rockdrilla/angie-conv:v0.0.1
 
 COPY /site/ /etc/angie/site/
 

doc/examples/ssl/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.2
+FROM docker.io/rockdrilla/angie-conv:v0.0.1
 SHELL [ "/bin/sh", "-ec" ]
 
 COPY /site/   /etc/angie/site/

doc/examples/ssl/README.md

@@ -3,7 +3,7 @@
 Dockerfile:
 
 ```dockerfile
-FROM docker.io/rockdrilla/angie-conv:v0.0.2
+FROM docker.io/rockdrilla/angie-conv:v0.0.1
 
 COPY /site/   /etc/angie/site/
 COPY /static/ /etc/angie/static/

doc/examples/static-template/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.2
+FROM docker.io/rockdrilla/angie-conv:v0.0.1
 SHELL [ "/bin/sh", "-ec" ]
 
 COPY /site/   /etc/angie/site/

doc/examples/static-template/README.md

@@ -13,7 +13,7 @@ server {
 Dockerfile:
 
 ```dockerfile
-FROM docker.io/rockdrilla/angie-conv:v0.0.2
+FROM docker.io/rockdrilla/angie-conv:v0.0.1
 
 COPY /site/   /etc/angie/site/
 COPY /static/ /etc/angie/static/

image-entry.d/00-common.envsh

@@ -8,7 +8,7 @@ empty_dir='/var/lib/empty'
 
 have_envvar() {
 	[ -n "$1" ] || return 1
-	grep -Ezq "^$1=" /proc/$$/environ || return
+	grep -Ezq "^$1=" /proc/self/environ || return
 }
 
 ## unexporting variable in (POSIX) sh is PITA =/
@@ -202,7 +202,6 @@ prepend_list() {
 }
 
 list_have_item() {
-	[ -n "$1" ] || return 1
 	[ -n "$2" ] || return 1
 	case " $1 " in
 	*" $2 "* ) return 0 ;;
@@ -214,15 +213,16 @@ normalize_list() {
 	[ -n "$1" ] || return 0
 
 	printf '%s' "$1" \
-	| sed -zE 's/[[:space:]]+/ /g;s/^ //;s/ $//'
+	| tr -s '[:space:]' ' ' \
+	| sed -zE 's/^ //;s/ $//'
 }
 
 sort_dedup_list() {
 	[ -n "$1" ] || return 0
 
 	printf '%s' "$1" \
-	| tr -s '[:space:]' '\n' | sort -uV \
+	| tr -s '[:space:]' '\n' | sort -uV | paste -sd ' ' \
-	| sed -zE 's/[[:space:]]+/ /g;s/^ //;s/ $//'
+	| sed -zE 's/^\s+//;s/\s+$//'
 }
 
 float_div() {
@@ -236,10 +236,3 @@ find_fast() {
 randN() {
 	od -v -A n -t x1 -N "$1" < /dev/urandom | tr -d '[:space:]'
 }
-
-re_ipv4_oct='[0-9]|[1-9][0-9]|[1-9][0-9][0-9]|2[0-4][0-9]|25[0-5]'
-re_ipv4_addr="^${re_ipv4_oct}\.${re_ipv4_oct}\.${re_ipv4_oct}\.${re_ipv4_oct}\$"
-is_ipv4_address() {
-	[ -n "$1" ] || return 1
-	printf '%s' "$1" | grep -zEq "${re_ipv4_addr}" || return 1
-}

image-entry.d/02-nonroot.envsh

@@ -2,6 +2,5 @@
 
 unset IEP_ROOT
 IEP_ROOT=1
-# [ "$(env stat -Lc %u /proc/$$)" = 0 ] || IEP_ROOT=0
+[ "$(stat -c %u /proc/1)" = 0 ] || IEP_ROOT=0
-[ "$(id -n)" = 0 ] || IEP_ROOT=0
 export IEP_ROOT

image-entry.d/03-local-override.envsh

@@ -3,18 +3,15 @@
 unset IEP_LOCAL_OVERRIDE
 IEP_LOCAL_OVERRIDE=0
 
-unset _fsspec i _extra
+unset _fsspec _fstarget _fstype _fsopts _fsreq _fspass
-while read -r _fsspec i _extra ; do
+while read -r _fsspec _fstarget _fstype _fsopts _fsreq _fspass ; do
-	[ -n "$i" ] || continue
+	case "${_fstarget}" in
-	case "$i" in
 	/angie | /angie/* )
 		IEP_LOCAL_OVERRIDE=1
 		break
 	;;
 	esac
-done <<-EOF
+done < /proc/mounts
-$(grep -F angie /proc/mounts)
+unset _fsspec _fstarget _fstype _fsopts _fsreq _fspass
-EOF
-unset _fsspec i _extra
 
 export IEP_LOCAL_OVERRIDE

image-entry.d/04-local-ip-addresses.envsh

@@ -13,14 +13,9 @@ unset NGX_IPV4_ADDRESSES NGX_IPV6_ADDRESSES
 for i in ${NGX_IP_ADDRESSES} ; do
 	case "$i" in
 	*:* )
-		## TODO: IPv6 address validation
 		NGX_IPV6_ADDRESSES=$(append_list "${NGX_IPV6_ADDRESSES}" "$i")
 	;;
 	* )
-		if ! is_ipv4_address "$i" ; then
-			log_always "invalid IPv4 address: $i"
-			continue
-		fi
 		NGX_IPV4_ADDRESSES=$(append_list "${NGX_IPV4_ADDRESSES}" "$i")
 	;;
 	esac

image-entry.d/06-resolver.envsh

@@ -1,109 +0,0 @@
-#!/bin/sh
-
-unset _NGX_RESOLVER_STACK _NGX_RESOLVER_TIMEOUT
-## here should be SANE defaults (!)
-_NGX_RESOLVER_STACK=ipv4
-_NGX_RESOLVER_TIMEOUT=10s
-
-if [ -z "${NGX_RESOLVER_STACK:-}" ] ; then
-	NGX_RESOLVER_STACK=${_NGX_RESOLVER_STACK}
-else
-	case "${NGX_RESOLVER_STACK}" in
-	[Ii][Pp][Vv]4 | [Vv]4 | 4 )
-		## adjust
-		NGX_RESOLVER_STACK=ipv4
-	;;
-	[Ii][Pp][Vv]6 | [Vv]6 | 6 )
-		## adjust
-		NGX_RESOLVER_STACK=ipv6
-	;;
-	[Dd][Uu][Aa][Ll] | [Aa][Ll][Ll] | [Aa][Nn][Yy] )
-		## adjust
-		NGX_RESOLVER_STACK=any
-	;;
-	[Nn][Oo][Nn][Ee] | 0 )
-		## adjust
-		NGX_RESOLVER_STACK=none
-	;;
-	* )
-		log_always "NGX_RESOLVER_STACK: unrecognized value: ${NGX_RESOLVER_STACK}"
-		log_always "setting NGX_RESOLVER_STACK=${_NGX_RESOLVER_STACK}"
-		NGX_RESOLVER_STACK=${_NGX_RESOLVER_STACK}
-	;;
-	esac
-fi
-export NGX_RESOLVER_STACK
-
-if [ "${NGX_RESOLVER_STACK}" = 'none' ] ; then
-	unset NGX_RESOLV_CONF NGX_RESOLVER_TIMEOUT NGX_RESOLVERS
-else
-	if [ -z "${NGX_RESOLVER_TIMEOUT:-}" ] ; then
-		NGX_RESOLVER_TIMEOUT=${_NGX_RESOLVER_TIMEOUT}
-	else
-		case "${NGX_RESOLVER_TIMEOUT}" in
-		[1-9] | [1-9][0-9] )
-			## convert implicit "seconds" to explicit
-			NGX_RESOLVER_TIMEOUT="${NGX_RESOLVER_TIMEOUT}s"
-		;;
-		[1-9]s | [1-9][0-9]s )
-			## pass
-		;;
-		[1-9]ms | [1-9][0-9]ms | [1-9][0-9][0-9]ms | [1-9][0-9][0-9][0-9]ms | [1-9][0-9][0-9][0-9][0-9]ms )
-			## pass
-		;;
-		* )
-			log_always "NGX_RESOLVER_TIMEOUT: unrecognized value: ${NGX_RESOLVER_TIMEOUT}"
-			log_always "setting NGX_RESOLVER_TIMEOUT=${_NGX_RESOLVER_TIMEOUT}"
-			NGX_RESOLVER_TIMEOUT=${_NGX_RESOLVER_TIMEOUT}
-		;;
-		esac
-	fi
-	export NGX_RESOLVER_TIMEOUT
-
-	unset _resolv_conf
-	while [ -z "${NGX_RESOLVERS+x}" ] ; do
-		_resolv_conf="${NGX_RESOLV_CONF-/etc/resolv.conf}"
-		[ -n "${_resolv_conf}" ] || break
-		[ -f "${_resolv_conf}" ] || break
-		[ -s "${_resolv_conf}" ] || break
-
-		unset i
-		while read -r i ; do
-			[ -n "$i" ] || continue
-
-			case "$i" in
-			## NB: /etc/resolv.conf allows (!) IPv6 addresses in dotted form (RFC 2373) but this is discouraged
-			*:* )
-				## TODO: IPv6 address validation
-				i="[$i]"
-
-				case "${NGX_RESOLVER_STACK}" in
-				ipv6 | any )
-					NGX_RESOLVERS=$(append_list "${NGX_RESOLVERS}" "$i")
-				;;
-				esac
-			;;
-			* )
-				if ! is_ipv4_address "$i" ; then
-					log_always "invalid IPv4 address: $i"
-					continue
-				fi
-
-				case "${NGX_RESOLVER_STACK}" in
-				ipv4 | any )
-					NGX_RESOLVERS=$(append_list "${NGX_RESOLVERS}" "$i")
-				;;
-				esac
-			;;
-			esac
-		done <<-EOF
-		$(mawk '$1 == "nameserver" {print $2}' < "${_resolv_conf}")
-		EOF
-		unset i
-	done
-	unset _resolv_conf
-
-	[ -z "${NGX_RESOLVERS}" ] || export NGX_RESOLVERS
-fi
-
-unset _NGX_RESOLVER_STACK _NGX_RESOLVER_TIMEOUT

image-entry.d/12-core-user.envsh

@@ -9,13 +9,11 @@ unset _NGX_USER _NGX_GROUP
 _NGX_USER=angie
 _NGX_GROUP=angie
 
-if [ -z "${NGX_USER:-}" ] ; then
+[ -n "${NGX_USER:-}" ] || NGX_USER=${_NGX_USER}
-	NGX_USER=${_NGX_USER}
-else
 case "${NGX_USER}" in
 "${_NGX_USER}" ) ;;
-	[1-9]* )
 ## numeric id - remap to name
+[1-9]* )
 	_user_name=$(getent passwd "${NGX_USER}" | cut -d: -f1)
 	if [ -n "${_user_name}" ] ; then
 		NGX_USER=${_user_name}
@@ -38,16 +36,12 @@ else
 	unset _user_name
 ;;
 esac
-fi
-export NGX_USER
 
-if [ -z "${NGX_GROUP:-}" ] ; then
+[ -n "${NGX_GROUP:-}" ] || NGX_GROUP=${_NGX_GROUP}
-	NGX_GROUP=${_NGX_GROUP}
-else
 case "${NGX_GROUP}" in
 "${_NGX_GROUP}" ) ;;
-	[1-9]* )
 ## numeric id - remap to name
+[1-9]* )
 	_group_name=$(getent group "${NGX_GROUP}" | cut -d: -f1)
 	if [ -n "${_group_name}" ] ; then
 		NGX_GROUP=${_group_name}
@@ -70,7 +64,7 @@ else
 	unset _group_name
 ;;
 esac
-fi
+
-export NGX_GROUP
+export NGX_USER NGX_GROUP
 
 unset _NGX_USER _NGX_GROUP

image-entry.d/13-core-worker.envsh

@@ -6,11 +6,9 @@ _NGX_WORKER_PROCESSES=2
 _NGX_WORKER_PRIORITY=0
 _NGX_WORKER_RLIMIT_NOFILE=16384
 _NGX_WORKER_CONNECTIONS=4096
-_NGX_WORKER_AIO_REQUESTS=32
+_NGX_WORKER_AIO_REQUESTS=64
 
-if [ -z "${NGX_WORKER_PROCESSES:-}" ] ; then
+[ -n "${NGX_WORKER_PROCESSES:-}" ] || NGX_WORKER_PROCESSES=${_NGX_WORKER_PROCESSES}
-	NGX_WORKER_PROCESSES=${_NGX_WORKER_PROCESSES}
-else
 case "${NGX_WORKER_PROCESSES}" in
 ## allow values within [1;999]
 [1-9] | [1-9][0-9] | [1-9][0-9][0-9] ) ;;
@@ -31,21 +29,18 @@ else
 	NGX_WORKER_PROCESSES=${_NGX_WORKER_PROCESSES}
 ;;
 esac
-fi
 export NGX_WORKER_PROCESSES
 
 if [ -z "${NGX_WORKER_CPU_AFFINITY:-}" ] ; then
 	unset NGX_WORKER_CPU_AFFINITY
 else
-	## let Angie handle this
+	## offload handling to Angie
 	set -a
 	NGX_WORKER_CPU_AFFINITY=$(normalize_list "${NGX_WORKER_CPU_AFFINITY}")
 	set +a
 fi
 
-if [ -z "${NGX_WORKER_CONNECTIONS:-}" ] ; then
+[ -n "${NGX_WORKER_CONNECTIONS:-}" ] || NGX_WORKER_CONNECTIONS=${_NGX_WORKER_CONNECTIONS}
-	NGX_WORKER_CONNECTIONS=${_NGX_WORKER_CONNECTIONS}
-else
 case "${NGX_WORKER_CONNECTIONS}" in
 [0-9] | [1-9][0-9] )
 	log_always "NGX_WORKER_CONNECTIONS: too low: ${NGX_WORKER_CONNECTIONS}"
@@ -64,7 +59,6 @@ else
 	NGX_WORKER_CONNECTIONS=${_NGX_WORKER_CONNECTIONS}
 ;;
 esac
-fi
 export NGX_WORKER_CONNECTIONS
 
 if [ -z "${NGX_WORKER_PRIORITY:-}" ] ; then
@@ -187,14 +181,11 @@ else
 fi
 if [ ${nofile_limit} -lt ${NGX_WORKER_CONNECTIONS} ] ; then
 	log_always "WARNING: ${nofile_kind} is less than NGX_WORKER_CONNECTIONS (${nofile_limit} < ${NGX_WORKER_CONNECTIONS})"
-	log_always "NGX_WORKER_CONNECTIONS is recommended to be at least twice larger than ${nofile_kind}"
 else
-	unset ratio
 	ratio=$(float_div "${nofile_limit}" "${NGX_WORKER_CONNECTIONS}")
 	case "${ratio}" in
 	1 | 1.* )
 		log_always "WARNING: \"${nofile_kind}/NGX_WORKER_CONNECTIONS\" ratio is too low (=${ratio})"
-		log_always "NGX_WORKER_CONNECTIONS is recommended to be at least twice larger than ${nofile_kind}"
 	;;
 	esac
 	unset ratio

image-entry.d/21-http-modules.envsh

@@ -5,11 +5,35 @@ if [ "${NGX_HTTP}" = 0 ] ; then
 else
 	NGX_HTTP_NO_PROXY=$(gobool_to_int "${NGX_HTTP_NO_PROXY:-0}" 0)
 	export NGX_HTTP_NO_PROXY
+	if [ "${NGX_HTTP_NO_PROXY}" = 0 ] ; then
+		NGX_HTTP_CONFLOAD=$(append_list "${NGX_HTTP_CONFLOAD}" proxy)
+	fi
 
 	unset http_modules http_confload
 	http_modules=
 	http_confload="${NGX_HTTP_CONFLOAD:-}"
 
+	if [ -n "${NGX_HTTP_MODULES}" ] ; then
+		## angie-module-lua: depends on angie-module-ndk
+		## angie-module-set-misc: depends on angie-module-ndk
+
+		# unset want_ndk
+		# want_ndk=0
+		# if list_have_item "${NGX_HTTP_MODULES}" lua ; then
+		# 	want_ndk=1
+		# elif list_have_item "${NGX_HTTP_MODULES}" set-misc ; then
+		# 	want_ndk=1
+		# fi
+		# if [ ${want_ndk} = 1 ] ; then
+		# 	NGX_HTTP_MODULES=$(prepend_list "${NGX_HTTP_MODULES}" ndk)
+		# fi
+		# unset want_ndk
+		NGX_HTTP_MODULES=$(
+			printf '%s' "${NGX_HTTP_MODULES}" \
+			| sed -zE 's/(\s|^)(lua|set-misc)(\s|$)/\1ndk \2\3/g'
+		)
+	fi
+
 	## filter out builtin http modules
 	unset i
 	for i in ${NGX_HTTP_MODULES:-} ; do
@@ -38,30 +62,17 @@ else
 	done
 	unset i
 
-	if [ "${NGX_HTTP_NO_PROXY}" = 0 ] ; then
-		http_confload="${http_confload} proxy"
-	fi
-
 	## grpc depends on http/2
-	if list_have_item "${http_confload}" grpc ; then
+	if list_have_item "${NGX_HTTP_CONFLOAD}" grpc ; then
-		http_confload="${http_confload} v2"
+		unset want_http2
+		want_http2=0
+		if ! list_have_item "${NGX_HTTP_CONFLOAD}" v2 ; then
+			want_http2=1
 		fi
-
+		if [ "${want_http2}" = 1 ] ; then
-	## angie-module-lua: depends on angie-module-ndk
+			NGX_HTTP_CONFLOAD=$(append_list "${NGX_HTTP_CONFLOAD}" v2)
-	## angie-module-set-misc: depends on angie-module-ndk
-	if [ -n "${http_modules:-}" ] ; then
-		unset want_ndk
-		want_ndk=0
-		if list_have_item "${http_modules}" lua ; then
-			want_ndk=1
-		elif list_have_item "${http_modules}" set-misc ; then
-			want_ndk=1
 		fi
-		if [ ${want_ndk} = 1 ] ; then
+		unset want_http2
-			## forcefully move 'ndk' to beginning of list
-			http_modules=$(printf '%s' " ${http_modules} " | sed -zE 's/ ndk / /;s/^/ndk/;s/ $//')
-		fi
-		unset want_ndk
 	fi
 
 	set -a
@@ -74,19 +85,20 @@ else
 	## quirk: angie-module-modsecurity
 	unset NGX_HTTP_WITH_MODSECURITY
 	NGX_HTTP_WITH_MODSECURITY=0
-	if list_have_item "${NGX_HTTP_MODULES}" modsecurity ; then
+	while : ; do
-		unset d f
+		if ! list_have_item "${NGX_HTTP_MODULES}" modsecurity ; then
+			break
+		fi
+
 		for d in /angie/modules /etc/angie/modules /etc/angie/modules.dist ; do
 			[ -d "$d" ] || continue
-			f="$d/ngx_http_modsecurity_module.so"
+			[ -f "$d/ngx_http_modsecurity_module.so" ] || continue
-			[ -f "$f" ] || continue
+			if ! [ -h "$d/ngx_http_modsecurity_module.so" ] ; then
-			if ! [ -h "$f" ] ; then
 				NGX_HTTP_WITH_MODSECURITY=1
 				break
 			fi
-		done
+		done ; unset d
-		unset d f
+	break ; done
-	fi
 	export NGX_HTTP_WITH_MODSECURITY
 
 	if [ "${NGX_HTTP_WITH_MODSECURITY}" = 1 ] ; then

image-entry.d/24-http-forward-headers.envsh

@@ -25,9 +25,7 @@ else
 		NGX_HTTP_X_FORWARDED=remove
 	fi
 
-	if [ -z "${NGX_HTTP_X_FORWARDED:-}" ] ; then
+	[ -n "${NGX_HTTP_X_FORWARDED:-}" ] || NGX_HTTP_X_FORWARDED=${_NGX_HTTP_X_FORWARDED}
-		NGX_HTTP_X_FORWARDED=${_NGX_HTTP_X_FORWARDED}
-	else
 	case "${NGX_HTTP_X_FORWARDED}" in
 	[Pp][Aa][Ss][Ss] )
 		## adjust
@@ -52,7 +50,6 @@ else
 		unset x
 	;;
 	esac
-	fi
 	export NGX_HTTP_X_FORWARDED
 
 	unset _NGX_HTTP_FAKE_UA _NGX_HTTP_X_FORWARDED

image-entry.d/99-cleanup-env.envsh

@@ -41,7 +41,7 @@ else
 fi <<-EOF
 $(
 	set +e
-	cat /proc/$$/environ \
+	cat /proc/self/environ \
 	| sed -zEn '/^([^=]+).*$/s//\1/p' \
 	| xargs -0r printf '%q\n' \
 	| {

requirements.txt

@@ -2,4 +2,4 @@ jinja2==3.1.4
 netaddr==1.3.0
 psutil==6.0.0
 pyyaml==6.0.2
-wcmatch==10.0
+wcmatch==9.0

scripts/apt-clean.sh

@@ -23,15 +23,11 @@ find /var/cache/debconf/ ! -type d -wholename '/var/cache/debconf/*-old' -delete
 
 __t=$(mktemp) ; : "${__t:?}"
 debconf_trim_i18n() {
-	mawk 'BEGIN { m = 0; }
+    mawk 'BEGIN { m = 0 }
-	$0 == "" { print; }
+    $0 == "" { print }
     /^[^[:space:]]/ {
-	    if ($1 ~ "\.[Uu][Tt][Ff]-?8:") {
+        if ($1 ~ "\.[Uu][Tt][Ff]-?8:") { m = 1; next; }
-	        m = 1;
+        m = 0; print $0;
-	        next;
-	    }
-	    m = 0;
-	    print $0;
     }
     /^[[:space:]]/ {
         if (m == 1) next;

scripts/apt-install-angie-mod.sh

@@ -37,15 +37,16 @@ normalize_list() {
 	[ -n "$1" ] || return 0
 
 	printf '%s' "$1" \
-	| sed -zE 's/[[:space:]]+/ /g;s/^ //;s/ $//'
+	| tr -s '[:space:]' ' ' \
+	| sed -zE 's/^ //;s/ $//'
 }
 
 sort_dedup_list() {
 	[ -n "$1" ] || return 0
 
 	printf '%s' "$1" \
-	| tr -s '[:space:]' '\n' | sort -uV \
+	| tr -s '[:space:]' '\n' | sort -uV | paste -sd ' ' \
-	| sed -zE 's/[[:space:]]+/ /g;s/^ //;s/ $//'
+	| sed -zE 's/^\s+//;s/\s+$//'
 }
 
 pkgs=$(sort_dedup_list "${pkgs}")

scripts/apt-install.sh

@@ -22,9 +22,8 @@ _apt_update() {
 }
 
 _dpkg_avail_hack() {
-	: "${DPKG_ADMINDIR:=/var/lib/dpkg}"
 	VERSION_CODENAME=$(. /etc/os-release ; printf '%s' "${VERSION_CODENAME}") || :
-	f="${DPKG_ADMINDIR}/available"
+	f="${DPKG_ADMINDIR:-/var/lib/dpkg}/available"
 	# if ${VERSION_CODENAME} is empty then we're on Debian sid or so :)
 	case "${VERSION_CODENAME}" in
 	stretch | buster | bionic | focal )
@@ -32,7 +31,7 @@ _dpkg_avail_hack() {
 		if [ -s "$f" ] ; then
 			return
 		fi
-		/usr/lib/dpkg/methods/apt/update "${DPKG_ADMINDIR}" apt apt
+		/usr/lib/dpkg/methods/apt/update "${DPKG_ADMINDIR:-/var/lib/dpkg}" apt apt
 	;;
 	* )
 		touch "$f"

scripts/envsubst-args.sh

@@ -1,18 +1,20 @@
 #!/bin/sh
 set -f
 
-sed -znE '/^([^=]+)=.*$/s,,\1,p' /proc/$$/environ \
+sed -znE '/^([^=]+)=.*$/s,,\1,p' /proc/self/environ \
 | sed -zE \
     -e '/^_$/d;/^ENVSUBST_/d;' \
     -e '/^__IEP_/d;/^IEP_$/d' \
 | {
 	if [ -n "${ENVSUBST_EXCLUDE_REGEX:-}" ] ; then
 		grep -zEv -e "${ENVSUBST_EXCLUDE_REGEX}"
-	elif [ -n "${ENVSUBST_INCLUDE_REGEX:-}" ] ; then
+	else
+		if [ -n "${ENVSUBST_INCLUDE_REGEX:-}" ] ; then
 			grep -zE -e "${ENVSUBST_INCLUDE_REGEX}"
 		else
 			cat
 		fi
+	fi
 } \
 | sort -zV \
 | xargs -0 -r printf '${%s} ' \

scripts/openssl-cert-auto-pem.sh

@@ -20,16 +20,11 @@ w_cleanup() {
 }
 
 bundle_offsets() {
-	mawk 'BEGIN { OFS = ","; i_begin = 0; }
+	awk '
-	$0 == "-----BEGIN CERTIFICATE-----" {
+	BEGIN { OFS = "," ; i_begin = 0 ; }
-	    i_begin = NR;
+	$0 == "-----BEGIN CERTIFICATE-----" { i_begin = NR ; }
-	}
+	$0 == "-----END CERTIFICATE-----"   { if (i_begin > 0) { print i_begin,NR ; i_begin = 0 ; } }
-	$0 == "-----END CERTIFICATE-----" {
+	' "$1"
-	    if (i_begin > 0) {
-	        print i_begin, NR;
-	        i_begin = 0;
-	    }
-	}' "$1"
 }
 
 bundle_fingerprints() {

scripts/python-rm-cache.sh

@@ -1,8 +1,6 @@
 #!/bin/sh
 set -f
 for i ; do
-	[ -n "$i" ] || continue
-	[ -d "$i" ] || continue
     find "$i/" -name __pycache__ -exec rm -rf {} +
     find "$i/" ! -type d -name '*.py[co]' -exec rm -f {} +
 done

scripts/static-compress.sh

@@ -1,41 +1,52 @@
 #!/bin/sh
 set -f
 
+COMPRESS_MIN_RATIO=90
+
 if command -V gzip   >/dev/null ; then has_gzip=1   ; fi
 if command -V brotli >/dev/null ; then has_brotli=1 ; fi
 if command -V zstd   >/dev/null ; then has_zstd=1   ; fi
 
-do_gzip()   { [ -s "$1.gz"  ] || gzip   -1kf "$1" || return ; comp_fixup "$1" "$1.gz"  || rm -f "$1.gz" ; }
+do_gzip()   { [ -s "$1.gz"  ] || gzip   -1kf "$1" ; comp_fixup "$1" "$1.gz"  ; }
-do_brotli() { [ -s "$1.br"  ] || brotli -1kf "$1" || return ; comp_fixup "$1" "$1.br"  || rm -f "$1.br" ; }
+do_brotli() { [ -s "$1.br"  ] || brotli -1kf "$1" ; comp_fixup "$1" "$1.br"  ; }
-do_zstd()   { [ -s "$1.zst" ] || zstd  -q1kf "$1" || return ; comp_fixup "$1" "$1.zst" || rm -f "$1.zst" ; }
+do_zstd()   { [ -s "$1.zst" ] || zstd  -q1kf "$1" ; comp_fixup "$1" "$1.zst" ; }
-
-float_div() {
-	mawk -v "a=$1" -v "b=$2" 'BEGIN{print a/b;exit;}' </dev/null
-}
 
 comp_fixup() {
-	[ -f "$1" ] || return 1
+	size1=$(env stat -c '%s' "$1") || return
-	size1=$(env stat -Lc '%s' "$1") || return 1
-	[ -n "${size1}" ] || return 1
-	[ "${size1}" != 0 ] || return 1
 
-	[ -f "$2" ] || return 1
+	[ -f "$2" ] || return
-	size2=$(env stat -c '%s' "$2") || return 1
+	[ -s "$2" ] || { rm -f "$2" ; return ; }
-	[ -n "${size2}" ] || return 1
+	size2=$(env stat -c '%s' "$2") || return
-	[ "${size2}" != 0 ] || return 1
 
-	ratio=$(float_div "${size2}" "${size1}") || return 1
+	pow1=${#size1} ; pow2=${#size2}
-	case "${ratio}" in
+
-	[0-9]*e-[0-9]* )
+	## if size2 is _longer_ than size1 - compression did something wrong (file is bigger)
+	if [ ${pow2} -gt ${pow1} ] ; then
+		rm -f "$2" ; return
+	fi
+
+	## if size1 is _longer_ size2 more than 2 digits - compression was done very successful
 	## doubtful but okay (c) Oleg Tinkov
-	;;
+	if [ $(( pow1 - pow2 )) -gt 2 ] ; then
-	0.[0-8]* | 0.90* )
+		return
-		## compression ratio below 90% is fine
+	fi
-	;;
-	* ) return 1 ;;
-	esac
 
-	return 0
+	## math hack!
+	if [ ${pow1} -gt 7 ] ; then
+		skew=$(( pow1 - 4 ))
+		pow1=$(( pow1 - skew ))
+		pow2=$(( pow2 - skew ))
+		size1=$(printf '%s' "${size1}" | cut -c 1-${pow1})
+		size2=$(printf '%s' "${size2}" | cut -c 1-${pow2})
+	fi
+
+	ratio=$(( (100 * size2) / size1 ))
+	if [ ${ratio} -ge ${COMPRESS_MIN_RATIO} ] ; then
+		rm -f "$2"
+	else
+		## seems to be excessive
+		: touch -r "$1" -m "$2"
+	fi
 }
 
 for i ; do