feat(entrypoint): add toggle to force http 1.1

from rpardini#128

nginx does not support http2 as a client; this alleviates registries that return 426 when using http2

Author: ChandonPierre

Diff for: Dockerfile

@@ -110,6 +110,9 @@ ENV ALLOW_PUSH="false"
 # Default is true to not change default behavior.
 ENV PROXY_REQUEST_BUFFERING="true"
 
+# Force HTTP/1.1 upstream connections, for http2 upstream that returns 426 Upgrade Required
+ENV FORCE_UPSTREAM_HTTP_1_1="false"
+
 # Stream data; reduce TTFB
 # Effectively disables caching
 # Default is true to not change default behavior.

Diff for: entrypoint.sh

@@ -358,6 +358,20 @@ echo -e "\nRequest buffering: ---"
 cat /etc/nginx/proxy.request.buffering.conf
 echo -e "---\n"
 
+# force upstream to use http 1.1
+echo "" > /etc/nginx/http1.1.upstream.conf
+if [[ "a${FORCE_UPSTREAM_HTTP_1_1}" == "atrue" ]]; then
+  cat << EOD > /etc/nginx/http1.1.upstream.conf
+  proxy_http_version 1.1;
+  proxy_set_header Upgrade \$http_upgrade;
+  proxy_set_header Connection "upgrade";
+EOD
+fi
+
+echo -e "\nConfigure upstream http version support: ---"
+cat /etc/nginx/http1.1.upstream.conf
+echo -e "---\n"
+
 # Upstream SSL verification.
 echo "" > /etc/nginx/docker.verify.ssl.conf
 if [[ "a${VERIFY_SSL}" == "atrue" ]]; then

Diff for: nginx.conf

@@ -263,6 +263,9 @@ echo "Docker configured with HTTPS_PROXY=$scheme://$http_host/"
         # Use SNI during the TLS handshake with the upstream.
         proxy_ssl_server_name on;
 
+        # force upstream to use http 1.1
+        include /etc/nginx/http1.1.upstream.conf;
+
         # This comes from a include file generated by the entrypoint.
         include /etc/nginx/docker.verify.ssl.conf;