docker-entrypoint.sh

#!/bin/bash
set -euo pipefail

# ---------------------------------------------------------------------------
# Process graph:
#
#   client -> nginx (:7860) -> key agent (:5001) -> upstream (:5000)
#
# nginx holds no secret. The key agent resolves the key into memory at
# startup and attaches it on the way through. Nothing is written to disk.
# ---------------------------------------------------------------------------
echo "[entrypoint] starting demo upstream on :5000"
python3 /opt/demo_upstream.py &

echo "[entrypoint] starting key agent on :5001"
python3 /opt/key_agent.py &
AGENT_PID=$!

# Wait for the agent to accept connections before nginx starts proxying.
for _ in $(seq 1 30); do
  if (exec 3<>/dev/tcp/127.0.0.1/5001) 2>/dev/null; then
    exec 3<&- 3>&-
    echo "[entrypoint] key agent is up"
    break
  fi
  sleep 0.5
done

if ! kill -0 "$AGENT_PID" 2>/dev/null; then
  echo "[entrypoint][fatal] key agent exited" >&2
  exit 1
fi

echo "[entrypoint] validating nginx config"
/usr/local/nginx/sbin/nginx -t

echo "[entrypoint] starting nginx in foreground"
exec /usr/local/nginx/sbin/nginx -g 'daemon off;'