problem with default fcgiwrap socket access rights and nginx (Alpine Linux)
4
votes
1
answer
3604
views
I want to run git-daemon (git-http-backend) in Alpine Linux using nginx and fcgiwrap. However, the default installation of nginx and fcgiwrap leads to a 502 Bad Gateway error. Apparently the group access rights seem to miss the write rights for the fcgiwrap socket.
When I grant write access for group on the fcgiwrap socket, everything works beautifully. What would be the proper way to make that work? The socket file is created when fcgiwrap is started, so I cannot adjust the rights before it runs.
**Details:**
I'm using Alpine Linux 3.10. Among others I installed the packages nginx, fcgiwrap and git-daemon. For a simple fcgiwrap test I added perl and a test script
f.pl
.
These are the rights of the fcgiwrap socket after the service is started:
gitsrv-dev:~# ls -la /run/fcgi*
total 0
drwxrwsr-x 2 fcgiwrap www-data 60 Feb 21 08:52 .
drwxr-xr-x 7 root root 320 Feb 17 19:03 ..
srwxr-xr-x 1 fcgiwrap www-data 0 Feb 21 08:52 fcgiwrap.sock
The services run as these users:
gitsrv-dev:~# ps axu | grep -E '(nginx|fcgiwrap)'
3436 root 0:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
3443 nginx 0:00 nginx: worker process
3490 fcgiwrap 0:00 /usr/bin/fcgiwrap -f -c 1 -s unix:/run/fcgiwrap/fcgiwrap.sock
3554 root 0:00 grep -E (nginx|fcgiwrap)
My test perl script run by fcgiwrap:
gitsrv-dev:~# cat /repos/f/f.pl
#!/usr/bin/perl
print "Content-Type: text/html\n\n";
print "f.pl is working
"; The configuration to run the f.pl script in nginx: gitsrv-dev:~# vi /etc/nginx/conf.d/f.conf server { listen *:82; location ~ /f(/.*) { gzip off; root /repos/f; client_max_body_size 0; include fastcgi_params; fastcgi_param SCRIPT_FILENAME /repos/f/f.pl; fastcgi_param PATH_INFO $1; fastcgi_param REMOTE_USER $remote_user; fastcgi_pass unix:/run/fcgiwrap/fcgiwrap.sock; } } As mentioned, this default configuration leads to a 502 Bad Gateway error (URLhttp://192.168.1.221:82/f/
).
When I grant g+w
rights, it works:
gitsrv-dev:~# chmod g+w /run/fcgiwrap/fcgiwrap.sock
gitsrv-dev:~# ls -la /run/fcgi*
total 0
drwxrwsr-x 2 fcgiwrap www-data 60 Feb 21 08:52 .
drwxr-xr-x 7 root root 320 Feb 17 19:03 ..
srwxrwxr-x 1 fcgiwrap www-data 0 Feb 21 08:52 fcgiwrap.sock
Reloading the browser now leads to the output f.pl is working
.
I'm using Alpine Linux for a few internal servers - all running nicely in a VM. These are set up using vagrant / puppet and I would like to create a git server now. So I'd like to keep things simple and rather not modify the default script files. Did I miss some obvious configuration options to let fcgiwrap and nginx play nicely together?
Asked by Rainer Schwarze
(93 rep)
Feb 21, 2021, 05:26 PM
Last activity: Feb 24, 2021, 11:11 PM
Last activity: Feb 24, 2021, 11:11 PM