0

I've been trying for a while to get a Python (Sanic) application working with Nginx. The application itself is running on 0.0.0.0:5000. The server is on a local network and only used to host/serve the projects. We have a main (public facing) web server that we reverse proxy each project in. To that extent the server running the Python application doesn't have a domain name since it doesn't serve projects directly (our proxy server does have a domain name and is publicly accessible). In the proxy server I just reference the host servers from their local IP. This method has worked for several of our other servers (Apache based), but we acquired this one fairly recently and I wanted to give Nginx a shot.

For context I did try Apache, but I was not able to get it working so I suspect there might be an underlying issue I am missing. I just want to check that my nginx.conf makes sense (since I am fairly new to Nginx) and to see if anyone has any suggestions as to what could be giving me trouble.

Final piece of context. I can access the service locally on the project host machine by doing curl http://0.0.0.0:5000/my_app or curl http://(machine’s-local-ip):5000/my_app; note that I have to specify the port else it doesn't work. From the proxy server I can only access the project host machine by doing curl http://(machine’s-local-ip)/, which returns the default Nginx html response. Any attempt to communicate with the endpoint /my_app results in a 50X error.

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80 default_server;
        listen       [::]:80 default_server;
        server_name  _;
        root         /usr/share/nginx/html;

        include /etc/nginx/default.d/*.conf;

        location / {
        }

        location /my_app/ {
            proxy_pass http://0.0.0.0:5000/my_app/;
            proxy_redirect off;
            proxy_buffering off;

            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header Host "machine’s-local-ip";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }
}
  • It looks like you’re saying that you have a public-facing web server that doesn’t have a domain name.   I guess that you could do this by publicizing the IP address, but that’s fairly impractical.   If that’s not what you meant, please edit your question to make it clearer and more complete. – Scott May 9 at 6:01
0

So after some more investigation and looking at the nginx logs, it turns out it was a SELinux issue. Following the steps at http://alfredoroca.github.io/nginx/selinux/2017/03/13/Allowing-Nginx-to-use-a-Puma-Unicorn-UNIX-socket-with-SELinux fixed the issue. I'll post them below for completeness.

$ sudo grep nginx /var/log/audit/audit.log | audit2allow -m nginx > nginx.te
$ cat nginx.te
# cat output
# require {
#     type unconfined_t;
#     type httpd_t;
#     type httpd_sys_content_t;
#     class sock_file write;
#     class unix_stream_socket connectto;
#     class capability2 block_suspend;
# }
#
# ============= httpd_t ==============
# allow httpd_t httpd_sys_content_t:sock_file write;
# allow httpd_t self:capability2 block_suspend;
# allow httpd_t unconfined_t:unix_stream_socket connectto; 
$ checkmodule -M -m -o nginx.mod nginx.te
$ semodule_package -o nginx.pp -m nginx.mod
$ sudo semodule -i nginx.pp
$ sudo systemctl restart nginx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.