David Wilkins <dwilkins at conecuh.com> wrote:> Folks,
>
> It seems that it''s pretty common to use /tmp for the directory
where
> you store the Unicorn unix: socket file. I''m a Fedora user and
our
> lovable systemd (by default) gives nginx a private /tmp directory (see
> "PrivateTmp=true" in system configuration file example below).
> That''s the kind of thing that *could* take a while to figure out.
>
> Could you put a note somewhere near the listen docs warning Fedora /
> systemd users to locate the socket file somewhere else? I know
it''s
> not your problem, but I''ll bet that more than a few Fedora users
are
> using TCP sockets instead of unix sockets with Unicorn because of
> this.
Thanks, I''ll queue up something like the following patch.
Comments/corrections greatly appreciated:
------------------------------8<-------------------------------
From: Eric Wong <normalperson at yhbt.net>
Subject: [PATCH] doc: update documentation for systemd + PrivateTmp users
The PrivateTmp feature of systemd breaks the usage of /tmp for the
shared Unix domain socket between nginx and unicorn, so discourage the
use of /tmp in that case.
While we''re at it, use consistent paths for everything and use an
obviously intended-for-user-customization "/path/to" prefix instead
of "/tmp"
ML-Ref: CAKLVLx_t+9zWMhquMWDfStrxS7xrNoGmN0ZDsjSCUE=VxU+oyQ at mail.gmail.com
Reported-by: David Wilkins <dwilkins at conecuh.com>
---
examples/nginx.conf | 8 ++++----
examples/unicorn.conf.rb | 2 +-
lib/unicorn/configurator.rb | 10 ++++++++--
3 files changed, 13 insertions(+), 7 deletions(-)
diff --git a/examples/nginx.conf b/examples/nginx.conf
index 66ac0aa..a68fe6f 100644
--- a/examples/nginx.conf
+++ b/examples/nginx.conf
@@ -24,8 +24,8 @@ user nobody nogroup; # for systems with a "nogroup"
# user nobody nobody; # for systems with "nobody" as a group instead
# Feel free to change all paths to suite your needs here, of course
-pid /tmp/nginx.pid;
-error_log /tmp/nginx.error.log;
+pid /path/to/nginx.pid;
+error_log /path/to/nginx.error.log;
events {
worker_connections 1024; # increase if you have lots of clients
@@ -42,7 +42,7 @@ http {
default_type application/octet-stream;
# click tracking!
- access_log /tmp/nginx.access.log combined;
+ access_log /path/to/nginx.access.log combined;
# you generally want to serve static files with nginx since neither
# Unicorn nor Rainbows! is optimized for it at the moment
@@ -74,7 +74,7 @@ http {
# single worker for timing out).
# for UNIX domain socket setups:
- server unix:/tmp/.sock fail_timeout=0;
+ server unix:/path/to/.unicorn.sock fail_timeout=0;
# for TCP setups, point these to your backend servers
# server 192.168.0.7:8080 fail_timeout=0;
diff --git a/examples/unicorn.conf.rb b/examples/unicorn.conf.rb
index 4042d9c..9dce58a 100644
--- a/examples/unicorn.conf.rb
+++ b/examples/unicorn.conf.rb
@@ -25,7 +25,7 @@
# listen on both a Unix domain socket and a TCP port,
# we use a shorter backlog for quicker failover when busy
-listen "/tmp/.sock", :backlog => 64
+listen "/path/to/.unicorn.sock", :backlog => 64
listen 8080, :tcp_nopush => true
# nuke workers after 30 seconds instead of 60 seconds (the default)
diff --git a/lib/unicorn/configurator.rb b/lib/unicorn/configurator.rb
index 7651093..0d0eac7 100644
--- a/lib/unicorn/configurator.rb
+++ b/lib/unicorn/configurator.rb
@@ -188,7 +188,7 @@ def before_exec(*args, &block)
# # on nginx upstream configuration:
# upstream unicorn_backend {
# # for UNIX domain socket setups:
- # server unix:/path/to/unicorn.sock fail_timeout=0;
+ # server unix:/path/to/.unicorn.sock fail_timeout=0;
#
# # for TCP setups
# server 192.168.0.7:8080 fail_timeout=0;
@@ -229,9 +229,15 @@ def listeners(addresses) # :nodoc:
#
# listen 3000 # listen to port 3000 on all TCP interfaces
# listen "127.0.0.1:3000" # listen to port 3000 on the loopback
interface
- # listen "/tmp/.unicorn.sock" # listen on the given Unix domain
socket
+ # listen "/path/to/.unicorn.sock" # listen on the given Unix
domain socket
# listen "[::1]:3000" # listen to port 3000 on the IPv6 loopback
interface
#
+ # When using Unix domain sockets, be sure:
+ # 1) the path matches the one used by nginx
+ # 2) uses the same filesystem namespace as the nginx process
+ # For systemd users using PrivateTmp=true (for either nginx or unicorn),
+ # this means Unix domain sockets must not be placed in /tmp
+ #
# The following options may be specified (but are generally not needed):
#
# [:backlog => number of clients]
--
Eric Wong