4

I want to run git-daemon (git-http-backend) in Alpine Linux using nginx and fcgiwrap. However, the default installation of nginx and fcgiwrap leads to a 502 Bad Gateway error. Apparently the group access rights seem to miss the write rights for the fcgiwrap socket.

When I grant write access for group on the fcgiwrap socket, everything works beautifully. What would be the proper way to make that work? The socket file is created when fcgiwrap is started, so I cannot adjust the rights before it runs.

Details:

I'm using Alpine Linux 3.10. Among others I installed the packages nginx, fcgiwrap and git-daemon. For a simple fcgiwrap test I added perl and a test script f.pl.

These are the rights of the fcgiwrap socket after the service is started:

gitsrv-dev:~# ls -la /run/fcgi*
total 0
drwxrwsr-x    2 fcgiwrap www-data        60 Feb 21 08:52 .
drwxr-xr-x    7 root     root           320 Feb 17 19:03 ..
srwxr-xr-x    1 fcgiwrap www-data         0 Feb 21 08:52 fcgiwrap.sock

The services run as these users:

gitsrv-dev:~# ps axu | grep -E '(nginx|fcgiwrap)'
 3436 root      0:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
 3443 nginx     0:00 nginx: worker process
 3490 fcgiwrap  0:00 /usr/bin/fcgiwrap -f -c 1 -s unix:/run/fcgiwrap/fcgiwrap.sock
 3554 root      0:00 grep -E (nginx|fcgiwrap)

My test perl script run by fcgiwrap:

gitsrv-dev:~# cat /repos/f/f.pl
#!/usr/bin/perl
print "Content-Type: text/html\n\n";
print "<h1>f.pl is working</h1>";

The configuration to run the f.pl script in nginx:

gitsrv-dev:~# vi /etc/nginx/conf.d/f.conf
    server {
            listen *:82;
            location ~ /f(/.*) {
                    gzip off;
                    root /repos/f;
                    client_max_body_size 0;
                    include fastcgi_params;
                    fastcgi_param SCRIPT_FILENAME /repos/f/f.pl;
                    fastcgi_param PATH_INFO $1;
                    fastcgi_param REMOTE_USER $remote_user;
                    fastcgi_pass unix:/run/fcgiwrap/fcgiwrap.sock;
            }
    }

As mentioned, this default configuration leads to a 502 Bad Gateway error (URL http://192.168.1.221:82/f/).

When I grant g+w rights, it works:

gitsrv-dev:~# chmod g+w /run/fcgiwrap/fcgiwrap.sock
gitsrv-dev:~# ls -la /run/fcgi*
total 0
drwxrwsr-x    2 fcgiwrap www-data        60 Feb 21 08:52 .
drwxr-xr-x    7 root     root           320 Feb 17 19:03 ..
srwxrwxr-x    1 fcgiwrap www-data         0 Feb 21 08:52 fcgiwrap.sock

Reloading the browser now leads to the output f.pl is working.

I'm using Alpine Linux for a few internal servers - all running nicely in a VM. These are set up using vagrant / puppet and I would like to create a git server now. So I'd like to keep things simple and rather not modify the default script files. Did I miss some obvious configuration options to let fcgiwrap and nginx play nicely together?

3
  • I feel like I'm missing something (maybe I didn't read carefully enough). What is creating the socket, fcgiwrap is just using the socket right? Feb 24, 2021 at 11:05
  • I'd assume fcgiwrap is creating the socket. A search for the sources brought up github.com/gnosek/fcgiwrap/blob/master/fcgiwrap.c . Feb 24, 2021 at 22:37
  • you haven't mentioned how you are configuring / starting fcgiwrap. I've written an answer based on some assumptions, I'll be happy to edit if those assumptions were wrong. Feb 24, 2021 at 23:16

1 Answer 1

1
+50

This is a little bit of guesswork...

The manual for fcgiwrap mentions this:

Most probably you will want to launch fcgiwrap by spawn-fcgi using a configuration like this:

FCGI_SOCKET=/var/run/fcgiwrap.sock 
FCGI_PROGRAM=/usr/sbin/fcgiwrap
FCGI_USER=nginx 
FCGI_GROUP=www 
FCGI_EXTRA_OPTIONS="-M 0700"
ALLOWED_ENV="PATH"

Looking around it seems that on alpine you may have installed fcgiwrap and it's configuration file on Alpine is /etc/conf.d/spawn-fcgi (mentioned here). You didn't mention in your question how you start fcgiwrap, so I guess this is how you started it.

So edit this file and find the commented out line:

# Additional options you might want to pass to spawn-fcgi
#
#FCGI_EXTRA_OPTIONS=

Change this to say:

# Additional options you might want to pass to spawn-fcgi
#
FCGI_EXTRA_OPTIONS="-M 0770"

This should change permissions (mode) on the socket. The option -m is documented here.

5
  • Thanks for the pointers. So far I just started fcgiwrap without spawn-fcgi, but it looks like this is the way to go. I'll test it and post updates here. Feb 24, 2021 at 23:22
  • Okay. In that case then I guess what is happening is the socket file is getting created implicitly. When fcgiwrap tries to bind to the socket Linux will just create a new one. When that happens, I think the umask value will take effect. But if you change this then it might change your perl's behaviour script also. Feb 25, 2021 at 0:07
  • @RainerSchwarze Irritatingly the function mknod can programatically create a socket for you, yet the authors of the command line tool mknod didn't give an option for sockets. Feb 25, 2021 at 0:09
  • Thanks for the answer, it put me on the right track. If you like, you might want to add some more details, otherwise I would add them to my question. To use spawn-fcgi in Alpine Linux one must create a copy of the config file (in /etc/conf.d/: spawn-fcgi -> spawn-fcgi.git) and link the startup script (/etc/init.d/: link spawn-fcgi.git to spawn-fcgi) and use the spawn-fcgi.git to start it. Also the actual socket file gets -1 appended for the child process index. So if one specifies /run/fcgiwrap/fcgiwrap.sock it will end up as /run/fcgiwrap/fcgiwrap.sock-1. Feb 27, 2021 at 11:49
  • Could you edit your comment by adding instructions on how to configure and run spawn-fcgi? When I make a symlink spawn-fcgi.git to spawn-fcgi I can't run it: sh: /etc/init.d/spawn-fcgi.git not found while the file exists. Aug 27, 2021 at 6:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .