我想在docker上使用nginx反向代理（使用docker compose）部署一个SSL认证的angular应用程序。我已经使用openssl生成了自签名证书，并对nginx配置文件进行了配置。但我在docker容器中收到错误消息：

[emerg] 1#1: cannot load certificate key "/etc/ssl/private/aims.key": BIO_new_file() failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/ssl/private/aims.key','r') error:2006D002:BIO routines:BIO_new_file:system lib)
nginx: [emerg] cannot load certificate key "/etc/ssl/private/aims.key": BIO_new_file() failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/ssl/private/aims.key','r') error:2006D002:BIO routines:BIO_new_file:system lib)

我用这个命令生成了密钥，要点如下：

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout aims.key -out aims.crt -config aims.conf -passin pass:[...]

这是 Docker 谱写的：

version: "3.8"
name: aims

services:
  ...

  web-app-proxy:
    image: nginx:alpine
    container_name: web_app_proxy
    ports:
      - 443:443
      - 80:80
    volumes:
      - ./web_app_proxy.nginx:/etc/nginx/nginx.conf:ro
      - ./aims.crt:/etc/ssl/certs/aims.crt
      - ./aims.key:/etc/ssl/private/aims.key

这是nginx配置文件（web应用服务来自另一个docker compose）：

worker_processes 1;

events { worker_connections 1024; }
http {
    sendfile on;
    large_client_header_buffers 4 32k;

    upstream web-app {
        server web-app:4200;
    }

    server {
        listen 80;
        server_name web-app;

        location / {
            return 301 https://$host$request_uri;
        }
    }

    server {
        listen 443 ssl;
        server_name web-app;

        ssl_certificate /etc/ssl/certs/aims.crt;
        ssl_certificate_key /etc/ssl/private/aims.key;

        location / {
            proxy_pass         http://web-app;
            proxy_redirect     off;
            proxy_http_version 1.1;
            proxy_cache_bypass $http_upgrade;
            proxy_set_header   Upgrade $http_upgrade;
            proxy_set_header   Connection keep-alive;
            proxy_set_header   Host $host;
            proxy_set_header   X-Real-IP $remote_addr;
            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;
            proxy_set_header   X-Forwarded-Host $server_name;
            proxy_buffer_size           128k;
            proxy_buffers               4 256k;
            proxy_busy_buffers_size     256k;
        }
    }
}

我看到这个问题与running the docker container as root有关，但我不知道如何处理。（仅使用docker compose或compose + docker file，而不是docker run / docker exec）。
如果我创建一个dockerfile并将其与compose分开，则在部署时会得到：

PEM_read_bio_PrivateKey() failed (SSL: error:0909006C:PEM routines:get_name:no start line:Expecting: ANY PRIVATE KEY)

当我看到aims.key编码是ASCII，我不能按照this post中的建议进行转换（即使使用sudo）。