fix: prevent concurrent nginx configuration reloads

nginx/.reload-in-container.sh

@@ -8,6 +8,21 @@ readonly TEMPLATE_SUFFIX="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}"
 readonly OUTPUT_DIR="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx}"
 readonly ENVSUBST_SCRIPT="${NGINX_RELOAD_ENVSUBST_SCRIPT:-/docker-entrypoint.d/20-envsubst-on-templates.sh}"
 readonly MANAGED_DIRS="conf.d snippets"
+readonly LOCK_FILE="${NGINX_RELOAD_LOCK_FILE:-/tmp/nginx-reload.lock}"
+
+acquire_lock() {
+	if ! command -v flock >/dev/null 2>&1; then
+		echo "Error: flock is required to serialize configuration reloads." >&2
+		return 1
+	fi
+
+	# Keep FD 9 open through rollback and cleanup; never unlink the lock file.
+	exec 9>"$LOCK_FILE"
+	if ! flock -n 9; then
+		echo "Error: cannot acquire reload lock; another reload may be running: $LOCK_FILE" >&2
+		return 1
+	fi
+}
 
 is_managed_template() {
 	for managed_dir in $MANAGED_DIRS; do
@@ -107,6 +122,7 @@ finish() {
 }
 
 main() {
+	acquire_lock
 	validate_templates
 	backup_dir="$(mktemp -d /tmp/nginx-reload.XXXXXX)"
 	transaction_state=backing_up