ssl_dhparam directive is duplicate in /etc/nginx/conf.d/perfect_forward_secrecy.conf

[diablodale]

Hello. Thank you for this nginx docker. I recently experimented with PFS and found errant behavior in the current script nginx.sh when PFS is enabled and the nginx service is restarted. It will fail with repeating fatal error

2020/09/13 23:01:14 [emerg] 6#6: "ssl_dhparam" directive is duplicate in /etc/nginx/conf.d/perfect_forward_secrecy.conf:6
nginx: [emerg] "ssl_dhparam" directive is duplicate in /etc/nginx/conf.d/perfect_forward_secrecy.conf:6

This is due to the persistent docker volume you create in the Dockerfile, therefore perfect_forward_secrecy.conf persists between restarts, therefore when the nginx.sh script runs on restart, line 142 appends another copy of ssl_dhparam and other lines.

Repro

1. Create a docker-compose.yml with a service nginx using dperson/nginx image with various settings including PFS=1
2. docker-compose up -d
3. docker-compose restart nginx
4. docker container ls and notice the constantly restarting container for nginx
5. docker logs xxxxxxx with the containerID of the ever restarting nginx container to see the repeating error

Fix

nginx/nginx.sh

Line 142 in aff6c52

echo "ssl_dhparam $cert;" >>$file

A quick fix might be to change line 142 to be a single > instead of the current >> so that the file is created clean on each restart. Otherwise, a search/replace for a pre-existing ssl_dhparam and other settings could be done with a tool like sed.