[gotshell]

Fixes #488

Since #430, misp-nginx runs as uid/gid 101 with ./ssl mounted read-only. A key.pem owned by root with mode 600 is therefore not readable by nginx and HTTPS does not work.

Changes

• README (Breaking changes): add a note stating that cert.pem and key.pem must be readable by uid/gid 101, with chgrp/chmod and setfacl examples (gid 101 may map to an unrelated group on the host, e.g. ssh_keys on RHEL).
• nginx/files/04-ssl.sh: the script only checked that the certificate files exist (-f). It now also checks that they are readable (-r) and, if not, exits with an explicit error message instead of generating an SSL config that nginx cannot load.

Testing

Ran a copy of 04-ssl.sh (with the certs path pointed to a temporary directory) as a non-root user:

• sh -n: no syntax errors
• cert.pem not readable: error message referencing cert.pem, exit code 1
• key.pem not readable: error message referencing key.pem, exit code 1
• both readable: no error, ssl.conf generated as before, exit code 0

The check stops at the first unreadable file, so if both are unreadable only cert.pem is reported; the second one shows up after fixing the first and restarting.

Not tested inside a built misp-nginx image.