Supervisord set user:group for program

user_7034796 0
Viewed 4000

I am running Nginx, Gunicorn with Supervisord. After Supervisord starts it creates gunicorn.sock file with user and group my_user:my_user. I need Nginx to be able to connect to the socket file gunicorn.sock is there any proper method to set socket file user and group to my_user:nginx?

I have tried to set this settings bellow to [myprogram:program] but it does not work:

socket_owner=my_user:nginx
chown=my_user:nginx

My supervisord.conf program:

[myprogram:program]
command = /var/www/project/virtual_env/bin/gunicorn -k gevent --worker-connections 1001 --bind=unix:gunicorn.sock -m 007 wsgi:application
directory = /var/www/project/
autostart=true
autorestart=unexpected
supervisord
3 Answers

It's already 2021 but I believe this answer may help someone. Nginx uses the user "www-data". The solution to this is to add this user to your user's group.

sudo usermod -a -G my_user www-data

Remember to change "my_user" with the group name for your current user.

Restart the supervisor service for your app.

user_70275650

One way to get around this, while keeping the nginx and gunicorn users separate, and thus without giving away too many permissions, is to use systemd instead of supervisor for gunicorn.

In the current docs https://docs.gunicorn.org/en/20.1.0/deploy.html#systemd it gives this setup+comment for the socket unit file:

[Unit]
Description=gunicorn socket

[Socket]
ListenStream=/run/gunicorn.sock
# Our service won't need permissions for the socket, since it
# inherits the file descriptor by socket activation
# only the nginx daemon will need access to the socket
SocketUser=www-data
# Optionally restrict the socket permissions even more.
# SocketMode=600

[Install]
WantedBy=sockets.target
user_17260260
Related