Merge branch 'rig-work'

rig/.version

@@ -1 +1 @@
-0.1.2
+0.1.3

rig/ctrl/docs.sh

@@ -22,17 +22,26 @@ serve() {
     fi
     # One worker and no access log: a few static pages need no more, and the
     # terminal then shows only real errors. The config is a temp file, gone on exit.
+    # nginx runs as the caller, not as its own user: it reads what the caller can read,
+    # whatever the umask (a 027 one leaves files unreadable to "others", which is a 403).
+    # So no port below 1024 inside, and pid and temp files go to /tmp.
     # Global, not local: the trap runs after serve() has returned.
     DOCS_CONF=$(mktemp)
     trap 'rm -f "$DOCS_CONF"' EXIT
     cat > "$DOCS_CONF" <<'NGINX'
 worker_processes 1;
 error_log stderr error;
+pid /tmp/nginx.pid;
 events { worker_connections 64; }
 http {
     include /etc/nginx/mime.types;
     access_log off;
-    server { listen 80; root /usr/share/nginx/html; }
+    client_body_temp_path /tmp/client_body;
+    proxy_temp_path /tmp/proxy;
+    fastcgi_temp_path /tmp/fastcgi;
+    uwsgi_temp_path /tmp/uwsgi;
+    scgi_temp_path /tmp/scgi;
+    server { listen 8080; root /usr/share/nginx/html; }
 }
 NGINX
     chmod 644 "$DOCS_CONF"
@@ -41,11 +50,12 @@ NGINX
     echo "  (ctrl-c to stop; nothing is installed and nothing persists)"
     docker run --rm \
         --name "${CLUSTER}-docs" \
-        -e NGINX_ENTRYPOINT_QUIET_LOGS=1 \
+        --user "$(id -u):$(id -g)" \
-        -p "${DOCS_PORT}:80" \
+        --entrypoint nginx \
+        -p "${DOCS_PORT}:8080" \
         -v "$DOCS:/usr/share/nginx/html:ro" \
         -v "$DOCS_CONF:/etc/nginx/nginx.conf:ro" \
-        nginx:alpine
+        nginx:alpine -g 'daemon off;'
 }
 
 graphs() {

rig/docs/notes/docs.md

@@ -8,6 +8,12 @@ out `python -m http.server` too — a minimal Debian has no python3. What it doe
 have, by definition, is Docker: the single prerequisite rig already demands. So a
 throwaway nginx container serves a read-only bind mount.
 
+nginx runs as the caller (`--user`), not as its own `nginx` user. A machine whose umask is
+027 creates files readable by their owner and group only, and nginx's own user would get a
+403 on every page. As the caller it reads whatever the caller can, so nobody has to chmod
+their docs. Unprivileged, it listens on 8080 inside the container and keeps its pid and temp
+files in /tmp.
+
 It runs with a config of its own: one worker (nginx's `auto` starts one per core,
 twelve on an ordinary laptop, for a handful of static pages), no access log and a
 quiet entrypoint, so the terminal shows the URL and nothing else unless something