wsgi nginx error: permission denied while connecting to upstream
After following all the advice in this thread I was still getting permission errors. The finally missing piece was to correct the nginx user
in the /etc/nginx/nginx.conf
file:
# old: user nginx;
user www-data;
To summarize what others have said to solve permission denied error in nginx (which you can look into /var/log/nginx/error.log
is usually due to the following:
- you are writing
.sock
file at a place nginx does not have permission - SELinux is causing the problem
To solve 1: First, don't write .sock
file at /tmp
as suggested here server fault answer because different services see different /tmp
in fedora. You can write at some place such as ~/myproject/mysocket.sock
. The nginx user must have access to our application directory in order to access the socket file there. By default, CentOS locks down each user's home directory very restrictively, so we will add the nginx user to our user's group so that we can then open up the minimum permissions necessary to grant access.
You can add the nginx user to your user group with the following command. Substitute your own username for the user in the command:
sudo usermod -a -G $USER nginx
Now, we can give our user group execute permissions on our home directory. This will allow the Nginx process to enter and access content within:
chmod 710 /path/to/project/dir
If the permission denied
error is still there:
then the hack sudo setenforce 0
will do the trick.
I also followed that tutorial and ran into the same issue. After quite a bit of trial and error, the following steps allowed me to run uWSGI and nginx successfully:
My nginx.config
file:
server {
listen 80;
server_name localhost;
location / { try_files @yourapplication; }
location @yourapplication; {
include uwsgi_params;
uwsgi_pass unix:/PATH_TO_PROJECT/PROJECT.sock;
}
}
My .ini
file wasn't working very well, so I decided to take advantage of uWSGI's extensive arguments that are available. Here's what I used:
uwsgi -s /PATH_TO_PROJECT/PROJECT.sock -w wsgi:app -H /PATH_TO_PROJECT/venv --http-processes=4 --chmod-socket=666 --master &
Where:
-s /PATH_TO_PROJECT/PROJECT.sock
= the location of my .sock
file
-w wsgi:app
= the location of my wsgi.py
file and app
being the name of my Flask object
-H /PATH_TO_PROJECT/venv
= the location of my virtual environment
--http-processes=4
= the number of http processes for uWSGI to create
--chmod-socket=666
= the permissions to set on the socket
--master
= allow uWSGI to run with its master process manager
&
= run uWSGI in the background
The path: unix:/PATH_TO_PROJECT/PROJECT.sock
should be placed in /tmp
this fixed my problem.