updated make docs

rig/ctrl/docs.sh

@@ -22,17 +22,26 @@ serve() {
     fi
     # One worker and no access log: a few static pages need no more, and the
     # terminal then shows only real errors. The config is a temp file, gone on exit.
+    # nginx runs as the caller, not as its own user: it reads what the caller can read,
+    # whatever the umask (a 027 one leaves files unreadable to "others", which is a 403).
+    # So no port below 1024 inside, and pid and temp files go to /tmp.
     # Global, not local: the trap runs after serve() has returned.
     DOCS_CONF=$(mktemp)
     trap 'rm -f "$DOCS_CONF"' EXIT
     cat > "$DOCS_CONF" <<'NGINX'
 worker_processes 1;
 error_log stderr error;
+pid /tmp/nginx.pid;
 events { worker_connections 64; }
 http {
     include /etc/nginx/mime.types;
     access_log off;
-    server { listen 80; root /usr/share/nginx/html; }
+    client_body_temp_path /tmp/client_body;
+    proxy_temp_path /tmp/proxy;
+    fastcgi_temp_path /tmp/fastcgi;
+    uwsgi_temp_path /tmp/uwsgi;
+    scgi_temp_path /tmp/scgi;
+    server { listen 8080; root /usr/share/nginx/html; }
 }
 NGINX
     chmod 644 "$DOCS_CONF"
@@ -41,11 +50,12 @@ NGINX
     echo "  (ctrl-c to stop; nothing is installed and nothing persists)"
     docker run --rm \
         --name "${CLUSTER}-docs" \
-        -e NGINX_ENTRYPOINT_QUIET_LOGS=1 \
-        -p "${DOCS_PORT}:80" \
+        --user "$(id -u):$(id -g)" \
+        --entrypoint nginx \
+        -p "${DOCS_PORT}:8080" \
         -v "$DOCS:/usr/share/nginx/html:ro" \
         -v "$DOCS_CONF:/etc/nginx/nginx.conf:ro" \
-        nginx:alpine
+        nginx:alpine -g 'daemon off;'
 }
 
 graphs() {