Fix nginx collab resolver to work under podman/netavark

The /collab/ resolver was hardcoded to Docker's embedded DNS
(127.0.0.11), which doesn't exist under podman/netavark where
aardvark-dns listens on the network gateway instead. This silently
502s every /collab/ request after a 30s timeout on podman stacks.
Read the real nameserver from the container's own /etc/resolv.conf
at startup instead.

Author: Che4ter

docker/nginx/entrypoint.sh

@@ -46,9 +46,18 @@ if [ -n "${SERVER_NAME:-}" ]; then
     export SERVER_NAME
 fi
 
+# The /collab/ location resolves its upstream at request time so nginx
+# doesn't refuse to start when the (optional) collab service is absent.
+# The resolver address is container-runtime-specific: Docker's embedded
+# DNS is always 127.0.0.11, but podman/netavark's aardvark-dns listens on
+# the network gateway instead. Read the real nameserver out of this
+# container's own /etc/resolv.conf so both runtimes work.
+DNS_RESOLVER=$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf)
+export DNS_RESOLVER="${DNS_RESOLVER:-127.0.0.11}"
+
 # envsubst will make a substitution on every $variable in a file, since the nginx file contains nginx variable like $host, we have to limit the substitution to this set
 # otherwise, each nginx variable will be replaced by an empty string
-envsubst '${INTERFACE_HTTPS_PORT} ${IRIS_UPSTREAM_SERVER} ${IRIS_UPSTREAM_PORT} ${SERVER_NAME} ${KEY_FILENAME} ${CERT_FILENAME} ${IRIS_FRONTEND_SERVER} ${IRIS_FRONTEND_PORT}' < /etc/nginx/nginx.conf > /tmp/nginx.conf
+envsubst '${INTERFACE_HTTPS_PORT} ${IRIS_UPSTREAM_SERVER} ${IRIS_UPSTREAM_PORT} ${SERVER_NAME} ${KEY_FILENAME} ${CERT_FILENAME} ${IRIS_FRONTEND_SERVER} ${IRIS_FRONTEND_PORT} ${DNS_RESOLVER}' < /etc/nginx/nginx.conf > /tmp/nginx.conf
 cp /tmp/nginx.conf /etc/nginx/nginx.conf
 rm /tmp/nginx.conf
 

docker/nginx/nginx.conf

@@ -155,13 +155,21 @@ http {
         }
 
         location /collab/ {
-            # Resolve at request time (Docker's embedded DNS) instead of at
-            # nginx startup: the collab service is a BV-only optional
-            # feature and isn't present in every compose stack (e.g. the
-            # upstream-derived dev/CI stack). A static proxy_pass hostname
-            # would make nginx refuse to start entirely when "collab" can't
-            # be resolved; this way only /collab/ requests fail if it's absent.
-            resolver 127.0.0.11 valid=30s;
+            # Resolve at request time (the container's own DNS resolver)
+            # instead of at nginx startup: the collab service is a BV-only
+            # optional feature and isn't present in every compose stack (e.g.
+            # the upstream-derived dev/CI stack). A static proxy_pass
+            # hostname would make nginx refuse to start entirely when
+            # "collab" can't be resolved; this way only /collab/ requests
+            # fail if it's absent.
+            #
+            # ${DNS_RESOLVER} is templated by entrypoint.sh from the
+            # container's /etc/resolv.conf. It is NOT hardcoded to Docker's
+            # embedded-DNS address (127.0.0.11) because that address doesn't
+            # exist under podman/netavark, where aardvark-dns listens on the
+            # network gateway instead — a hardcoded 127.0.0.11 here silently
+            # 502s every /collab/ request after a 30s resolver timeout.
+            resolver ${DNS_RESOLVER} valid=30s;
             set $collab_upstream collab;
 
             proxy_set_header Host $http_host;