I am trying to get nginx, Django, and uwsgi to work 'as specified' in the docs (well, ok, https://uwsgi.readthedocs.io/en/latest/tutorials/Django_and_nginx.html anyway). Everything works perfectly as long as I start uwsgi as NON-root user.
In trying to get past this, I created a little script (the commented-out commands are things I've tested, sorry if they are confusing):
#!/bin/bash
cd /home/lunchspace/FridayLunch/
uwsgi --ini lunchspace_uswgi.ini
#uwsgi --socket /home/lunchspace/lunchspace.sock --module FridayLunches.wsgi
#uwsgi --emperor /etc/uwsgi/vassals
Running the above as the user 'lunchspace', I get:
lunchspace@lunchspace:~/FridayLunch$ ../runuwsgi
[uWSGI] getting INI configuration from lunchspace_uswgi.ini
*** Starting uWSGI 2.0.20 (64bit) on [Fri Sep 23 19:29:55 2022] ***
compiled with version: 7.5.0 on 13 September 2022 22:35:31
os: Linux-4.15.0 #1 SMP Tue Jan 25 12:49:12 MSK 2022
nodename: lunchspace.org
machine: x86_64
clock source: unix
detected number of CPU cores: 1
current working directory: /home/lunchspace/FridayLunch
detected binary path: /usr/local/bin/uwsgi
!!! no internal routing support, rebuild with pcre support !!!
chdir() to /home/lunchspace/FridayLunch
your processes number limit is 62987
your memory page size is 4096 bytes
detected max file descriptor number: 1024
lock engine: pthread robust mutexes
thunder lock: disabled (you can enable it with --thunder-lock)
uwsgi socket 0 bound to UNIX address /home/lunchspace/FridayLunch/lunchspace.sock fd 3
Python version: 3.6.9 (default, Jun 29 2022, 11:45:57) [GCC 8.4.0]
*** Python threads support is disabled. You can enable it with --enable-threads ***
Python main interpreter initialized at 0x5624343e7df0
your server socket listen backlog is limited to 100 connections
your mercy for graceful operations on workers is 60 seconds
mapped 801944 bytes (783 KB) for 10 cores
*** Operational MODE: preforking ***
at 1
at 2
at 3
at 4
WSGI app 0 (mountpoint='') ready in 0 seconds on interpreter 0x5624343e7df0 pid: 21227 (default app)
*** uWSGI is running in multiple interpreter mode ***
spawned uWSGI master process (pid: 21227)
spawned uWSGI worker 1 (pid: 21229, cores: 1)
spawned uWSGI worker 2 (pid: 21230, cores: 1)
spawned uWSGI worker 3 (pid: 21231, cores: 1)
spawned uWSGI worker 4 (pid: 21232, cores: 1)
spawned uWSGI worker 5 (pid: 21233, cores: 1)
spawned uWSGI worker 6 (pid: 21234, cores: 1)
spawned uWSGI worker 7 (pid: 21235, cores: 1)
spawned uWSGI worker 8 (pid: 21236, cores: 1)
spawned uWSGI worker 9 (pid: 21237, cores: 1)
spawned uWSGI worker 10 (pid: 21238, cores: 1)
Request is
<WSGIRequest: GET '/'>
GET
<QueryDict: {}>
request.user
rustycar54@descomp.com
request.user.is_authenticated
True
Restaurantlist:
None Haji Baba's
None Haji Baba's
[pid: 21232|app: 0|req: 1/1] 172.56.80.241 () {46 vars in 810 bytes} [Fri Sep 23 12:29:58 2022] GET / => generated 53021 bytes in 119 msecs (HTTP/1.1 200) 5 headers in 287 bytes (2 switches on core 0)
^CSIGINT/SIGTERM received...killing workers...
worker 1 buried after 9 seconds
worker 2 buried after 9 seconds
worker 3 buried after 9 seconds
worker 4 buried after 9 seconds
worker 5 buried after 9 seconds
worker 6 buried after 9 seconds
worker 7 buried after 9 seconds
worker 8 buried after 9 seconds
worker 9 buried after 9 seconds
worker 10 buried after 9 seconds
goodbye to uWSGI.
VACUUM: unix socket /home/lunchspace/FridayLunch/lunchspace.sock removed.
And the web site works fine.
changing to root and running as lunchspace via sudo -u, I get:
root@lunchspace:~# echo foo;sudo -iu lunchspace /home/lunchspace/runuwsgi
foo
[uWSGI] getting INI configuration from lunchspace_uswgi.ini
*** Starting uWSGI 2.0.20 (64bit) on [Fri Sep 23 19:30:27 2022] ***
compiled with version: 7.5.0 on 13 September 2022 22:35:31
os: Linux-4.15.0 #1 SMP Tue Jan 25 12:49:12 MSK 2022
nodename: lunchspace.org
machine: x86_64
clock source: unix
detected number of CPU cores: 1
current working directory: /home/lunchspace/FridayLunch
detected binary path: /usr/local/bin/uwsgi
!!! no internal routing support, rebuild with pcre support !!!
chdir() to /home/lunchspace/FridayLunch
your processes number limit is 62987
your memory page size is 4096 bytes
detected max file descriptor number: 1024
lock engine: pthread robust mutexes
thunder lock: disabled (you can enable it with --thunder-lock)
uwsgi socket 0 bound to UNIX address /home/lunchspace/FridayLunch/lunchspace.sock fd 3
Python version: 3.6.9 (default, Jun 29 2022, 11:45:57) [GCC 8.4.0]
*** Python threads support is disabled. You can enable it with --enable-threads ***
Python main interpreter initialized at 0x562b734334e0
your server socket listen backlog is limited to 100 connections
your mercy for graceful operations on workers is 60 seconds
mapped 801944 bytes (783 KB) for 10 cores
*** Operational MODE: preforking ***
at 1
at 2
at 3
at 4
WSGI app 0 (mountpoint='') ready in 0 seconds on interpreter 0x562b734334e0 pid: 21362 (default app)
*** uWSGI is running in multiple interpreter mode ***
spawned uWSGI master process (pid: 21362)
spawned uWSGI worker 1 (pid: 21364, cores: 1)
spawned uWSGI worker 2 (pid: 21365, cores: 1)
spawned uWSGI worker 3 (pid: 21366, cores: 1)
spawned uWSGI worker 4 (pid: 21367, cores: 1)
spawned uWSGI worker 5 (pid: 21368, cores: 1)
spawned uWSGI worker 6 (pid: 21369, cores: 1)
spawned uWSGI worker 7 (pid: 21370, cores: 1)
spawned uWSGI worker 8 (pid: 21371, cores: 1)
spawned uWSGI worker 9 (pid: 21372, cores: 1)
spawned uWSGI worker 10 (pid: 21373, cores: 1)
^CSIGINT/SIGTERM received...killing workers...
worker 1 buried after 2 seconds
worker 2 buried after 2 seconds
worker 3 buried after 2 seconds
worker 4 buried after 2 seconds
worker 5 buried after 2 seconds
worker 6 buried after 2 seconds
worker 7 buried after 2 seconds
worker 8 buried after 2 seconds
worker 9 buried after 2 seconds
worker 10 buried after 2 seconds
goodbye to uWSGI.
VACUUM: unix socket /home/lunchspace/FridayLunch/lunchspace.sock removed.
root@lunchspace:~#
and the web site says '502 Bad Gateway'
I looked at the nginx log and saw
<blah> request: "GET / HTTP/1.1", upstream: "uwsgi://unix:///home/lunchspace/FridayLunch/lunchspace.sock:", host: <blah>
So, I says to myself - OH, easy, there's no lunchspace.sock socket file. But, behold, it is there:
root@lunchspace:~# ls -l /home/lunchspace/FridayLunch/lunchspace.sock
srwxr-xr-x 1 lunchspace lunchspace 0 Sep 23 19:39 /home/lunchspace/FridayLunch/lunchspace.sock
root@lunchspace:~#
Oops. Note the permissions! I changed them to 777 (not good in the long term, I know), and viola! It works.
So, at the risk of being flagged as an idiot for answering my own question in the question post, I'm going to go ahead and post this in hopes it will save someone else a lot of time and frustration.
Short answer:
Make sure the permissions of the socket file allow the nginx process to write to and read from it.
(In my case, I needed 664 since the nginx process was in the correct group. Set that in your *.ini file)