Defining correctly Nginx server block for two djan

问题:

I have been following the Digital Ocean tutorial How To Serve Django Applications with uWSGI and Nginx on Ubuntu 14.04, so that later i can deploy my own django application using Nginx+uWSGI.

In this tutorial they create 2 basic Django apps to be later served by Nginx. I have tested that the apps were working using the Django server and uWSGI alone.

When i passed to the Nignx part i ran into a problem, basically i dont have a server_name for now only have an IP to work with, and i tried to differentiate between Django apps using the port number.

The default Nginx server (xxx.xxx.xxx.xxx:80) is responding correctly, but when i try to access the Django apps using (xxx.xxx.xxx.xxx:8080 or xxx.xxx.xxx.xxx:8081) i get 502 bad gateway.

I think i have a problem in the way or logic i am defining my listen inside the server block. What would be the correct way of doing this, or what might i be doing incorrectly.

This are my server blocks (in sites-enabled):

firstsite app

server {
    listen xxx.xxx.xxx.xxx:8080;
    #server_name _;

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /root/firstsite;
    }

    location / {
        include         uwsgi_params;
        uwsgi_pass      unix:/root/firstsite/firstsite.sock;
    }
}

econdsite app

server {
    listen xxx.xxx.xxx.xxx:8081;
    #server_name _;

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /root/secondsite;
   }

    location / {
        include         uwsgi_params;
        uwsgi_pass      unix:/root/secondsite/secondsite.sock;
   }
}

default Nginx

server {
    listen 80 default_server;
    #listen [::]:80 default_server ipv6only=on;

    root /usr/share/nginx/html;
    index index.html index.htm;

    # Make site accessible from http://localhost/
    server_name localhost;

    location / {
            # First attempt to serve request as file, then
            # as directory, then fall back to displaying a 404.
            try_files $uri $uri/ =404;
            # Uncomment to enable naxsi on this location
            # include /etc/nginx/naxsi.rules
    }
}

UPDATE:

I was checking the error log under /var/log/nginx and when i try to connect to firstsite i get the following error:

2016/02/05 15:55:23 [crit] 11451#0: *6 connect() to unix:/root/firstsite/firstsite.sock failed (13: Permission denied) while connecting to upstream, client: 188.37.180.101, server: , request: "GET / HTTP/1.1", upstream: "uwsgi://unix:/root/firstsite/firstsite.sock:", host: "178.62.229.183:8080"

回答1:

Nginx server on ubuntu will run on www-data user by default, uWSGI server won't (which is actually a good thing, unless it runs on root). If you're creating unix socket for uWSGI, access to it will be defined as for any system file. And by default, access to it might be restricted only to user that created socket.

More on that, you're creating your sockets in /root/ directory. That directory is readable only by root user and some of Linux distributions won't allow accessing anything inside even if permissions are set correctly.

So what you have to do is:

1. put sockets outside of /root/ directory (/var/run is good place for that)
2. Make sure that nginx will have access to that sockets (put --chmod-socket 666 or `--chown-socket yourusername:www-data into your uWSGI startup line)

And if you're running that uWSGI server on root, be aware that this is really dangerous. Any process running on root can do anything with your system, so if you will make mistake in your code or someone will hack in, he can inject any malicious software into your server, steal some data from it or just destroy everything.