docker: support IPv6 nameservers in nginx resolver derivation

[ashbrener]

Problem

docker/40-openconcho-config.sh derives nginx's resolver from the container's /etc/resolv.conf, but writes nameserver addresses verbatim. Two issues:

1. IPv6 nameservers crash nginx at startup. nginx requires IPv6 resolver addresses in brackets; unbracketed, it parses everything after the last colon as a port. On any host whose resolv.conf carries an IPv6 nameserver — e.g. Fly.io machines, where the resolver is fdaa::3 — the container crash-loops with:

   nginx: [emerg] invalid port in resolver "fdaa::3" in /etc/nginx/conf.d/00-resolver.conf:1
   

2. Hardcoded ipv6=off breaks IPv6-only upstreams. With ipv6=off, nginx discards AAAA answers, so the header-driven /api proxy can never reach upstreams that only resolve to IPv6 — e.g. Fly.io private .flycast addresses.

Fix

• Bracket any nameserver containing a colon when rendering 00-resolver.conf (fdaa::3 → [fdaa::3]), so nginx parses it as an IPv6 address instead of host:port.
• Drop the hardcoded ipv6=off so AAAA resolution works for IPv6-only upstreams. IPv4-only environments are unaffected: happy-eyeballs-style fallback still resolves A records as before.

Testing

Ran the patched script inside nginxinc/nginx-unprivileged:alpine (busybox awk, same as the image build) followed by nginx -t:

/etc/resolv.conf nameservers	rendered 00-resolver.conf	nginx -t
fdaa::3 (Fly.io)	resolver [fdaa::3] valid=10s;	ok
fdaa::3 + 8.8.8.8	resolver [fdaa::3] 8.8.8.8 valid=10s;	ok
(empty)	resolver 127.0.0.11 valid=10s; (fallback)	ok

Previously the first case rendered resolver fdaa::3 ipv6=off valid=10s; and nginx failed with the emerg above.

We hit this deploying the image on Fly.io; currently working around it with an extra entrypoint script that post-processes 00-resolver.conf, but the derivation should be fixed at the source.

[ashbrener]

Friendly bump on this one — happy to rebase or split it if that helps.

Quick recap of what it fixes: docker/40-openconcho-config.sh derives nginx's
resolver from /etc/resolv.conf but writes IPv6 nameservers unbracketed, so on
any host with an IPv6 resolver (Fly.io hands out fdaa::3) nginx dies at boot
with [emerg] invalid port in resolver "fdaa::3" and the container crash-loops.
The same line hardcodes ipv6=off, which then breaks proxying to IPv6-only
upstreams.

The change is 5 lines in that script — bracket nameservers containing a colon,
and drop the hardcoded ipv6=off. Verified inside nginxinc/nginx-unprivileged:alpine
(busybox awk) across IPv6-only, mixed v4/v6, and empty resolv.conf, all passing
nginx -t; the empty case still falls back to 127.0.0.11.

No rush at all if it's not a priority — mainly flagging it since it's a silent
crash-loop for anyone deploying on a host with an IPv6 resolver.

[voidzero]

Tested this on a rootless Podman host (Ubuntu) whose container resolv.conf includes IPv6 nameservers (addresses below replaced with documentation prefixes). It fixes the crash.

Before (current main): the container exits right away with
[emerg] invalid port in resolver "2001:db8:1400::1".

With this PR applied on main: the container starts and renders

resolver 192.0.2.1 192.0.2.2 192.0.2.3 [2001:db8:1400::1] [2001:db8:1410::1] valid=10s;

and /healthz returns 200.

The awk change is minimal and correct for plain IPv6 addresses. Dropping ipv6=off makes sense for IPv6-only upstreams. A small side effect: on hosts without IPv6 egress, nginx will also try AAAA addresses for dual-stack upstreams. It falls back to the next address, so this looks acceptable to me.

LGTM. It would be great to get this merged, because anyone with an IPv6 resolver currently can't start the image.