502 Bad Gateway Using Nginx, Gunicorn and Flask - amazon-web-services

Question

I'm learning to deploy my Flask app onto an Ubuntu AWS EC2 instance and am following the Digital Ocean tutorial. I'm and am encountering one final issue: I'm got my Gunicorn booted up and working using this command: gunicorn --workers 3 --bind unix:project.sock -m 007 wsgi:app to create 3 worker threads and a socket called project.sock.
[2018-02-23 17:14:49 +0000] [INFO] Booting worker with pid: X
[2018-02-23 17:14:49 +0000] [INFO] Booting worker with pid: X
[2018-02-23 17:14:49 +0000] [INFO] Booting worker with pid: X
Connection initialized.
Connection initialized.
Connection initialized.
But I'm encountering errors when attempting to have Nginx connect to my project.sock from Gunicorn- a 502 Bad Gateway error.
Here's my /etc/nginx/sites-available/project configurations:
server {
listen 80;
server_name MY_SERVER_DNS;
location / {
include proxy_params;
proxy_pass http://unix:/home/ubuntu/flaskapp_dev/my_project/project.sock;
}
}
A check of the Nginx error logs shows that it's getting a Permission denied error attempting to connect to my project.sock:
2018/02/23 17:26:46 [crit] 10822#10822: *4 connect() to unix:/home/ubuntu/myproject/myproject/myproject.sock failed
(13: Permission denied) while connecting to upstream,
client: CLIENT_IP, server: MY_SERVER_DNS,
request: "GET / HTTP/1.1",
upstream: "http://unix:/home/ubuntu/myproject/myproject/project.sock:/", host: "MY_SERVER_DNS"
I know there's been plenty of SO posts on this question, but I'm noticing that most of them revolve around uwsgi, which I'm not using here. I suspect that it's obviously a permission issue, so I tried chmod 711 /home/ubuntu/myproject/project and restarting nginx, but that results in the same 502 Bad Gateway error.
The closest SO post to my issue appears to be this one, but it has no answers or comments.

Answer 1

This is just a permissions issue. Nginx that's running under one user cannot get access to unix socket that's owned by another user. I recommend to run nginx server and gunicorn under the same user so unix socket created by gunicron will be accessed by nginx without any problems. chmod 777 is a temporal solution that can show that there is only permission issue if after executing this command the described problem has gone, but it's better to initially run nginx and gunicorn under the same user. Also it's better to specify full path to unix socket to avoid "no such file or directory" possible issue: gunicorn --workers 3 --bind <full_path_to_unix_socket_to_be_created>