2

Context

I'm running an nginx instance in an alpine docker container (nginx:stable-alpine). The goal is to use nginx as a reverse proxy for one (or multiple) docker containers which only have HTTP and turn them into HTTPS with this outside-facing nginx instance.

Configs/environment

I did not alter the standard config from the Docker container which is:

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

Furthermore, I have two files in the conf.d sub-folder:

ssl-forward.conf

server {
    listen 80;
    server_tokens off;

    server_name sub.example.com;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

django.conf

server {
    listen 443 ssl;
    server_name sub.example.com;
    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/$server_name/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$server_name/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        proxy_pass         http://127.0.0.1:8000;
        proxy_redirect     off;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

The letsencrypt certificate folder has the following folder/file permissions, which means the certificates are only readable as a root user, the files come from a mounted volume:

drwxr-xr-x    3 root     root          4096 May 15 10:09 accounts
drwx------    3 root     root          4096 May 15 10:09 archive
drwxr-xr-x    2 root     root          4096 May 15 10:09 csr
drwx------    2 root     root          4096 May 15 10:09 keys
drwx------    3 root     root          4096 May 15 10:09 live
-rw-r--r--    1 root     root           721 May 16 11:20 options-ssl-nginx.conf
drwxr-xr-x    2 root     root          4096 May 15 10:09 renewal
drwxr-xr-x    5 root     root          4096 May 15 10:09 renewal-hooks
-rw-r--r--    1 root     root           424 May 16 11:20 ssl-dhparams.pem

The main process of nginx is under the user root, the sub-processes under the user nginx:

   13    11 nginx    S    16788   2%   0   0% nginx: worker process
   11     1 root     S    16304   2%   0   0% nginx: master process nginx -g daemon off;

Nginx config test gives me:

# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Problem

Despite all that, when I try to access https://sub.example.com, I get

13#13: *9 cannot load certificate "/etc/letsencrypt/live/sub.example.com/fullchain.pem": BIO_new_file() failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/letsencrypt/live/sub.example.com/fullchain.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib) while SSL handshaking, client: ..., server: 0.0.0.0:443

Why is that/how can I fix it? Is it because it's a sub-config in conf.d and nginx tries to access the certificates through a worker process instead of the main process (and therefore as the user nginx)? Does it have something to do with the fact that the include happens in the http{} directive in the main config?

h345k34cr
  • 121
  • 1
  • 3
  • Were you able to resolve this ? I'm also banging my head for the past 3 hours – Buddybear Apr 30 '21 at 15:45
  • 1
    `user root;`. Since I run it in a docker container, I figured it should not be too terrible. But I'm not happy with this solution. An alternative could be putting the certificates somewhere else/chmod them so that you can access them as the nginx user? – h345k34cr May 02 '21 at 10:18

1 Answers1

0

Old Question, but here we go:

I create / use a group like ssl-cert to which root and the nginx user like for example www-data both belong.

Then I set the rights in the /etc/letsencrypt/archive directories and files like demonstrated here in this ansible snippet. Note the large `X'

- name: "Fix the access rights of the certificates"
  become: true
  ansible.builtin.file:
    path: "/etc/letsencrypt/archive/{{ cert_domain }}"
    owner: root
    group: ssl-cert
    mode: "u=rwX,g=rX,o="
    recurse: true
NorbertK
  • 1
  • 2