Running Gunicorn behind chrooted nginx inside virtualenv

4
votes

I can this setup to work if I start gunicorn manually or if I add gunicorn to my django installed apps. But when I try to start gunicorn with systemd the gunicorn socket and service start fine but they don't serve anything to Nginx; I get a 502 bad gateway.

Nginx is running under the "http" user/group, chroot jail. I used pythonbrew to setup the virtualenvs so gunicorn is installed in my home directory under .pythonbrew. The vitualenv directory is owned by my user and the adm group.

I'm pretty sure there is a permission issue somewhere, because everything works if I start gunicorn but not if systemd starts it. I've tried changing the user and group directives inside the gunicorn.service file, but nothing worked; if root start the server then I get no errors and a 502, if my user starts it I get no errors and 504.

I have checked the Nginx logs and there are no errors, so I'm sure it's a gunicorn issue. Should I have the virtualenv in the app directory? Who should be the owner of the app directory? How can I narrow down the issue?

/usr/lib/systemd/system/gunicorn-app.service

#!/bin/sh

[Unit]
Description=gunicorn-app

[Service]
ExecStart=/home/noel/.pythonbrew/venvs/Python-3.3.0/nlp/bin/gunicorn_django
User=http
Group=http
Restart=always
WorkingDirectory = /home/noel/.pythonbrew/venvs/Python-3.3.0/nlp/bin

[Install]
WantedBy=multi-user.target

/usr/lib/systemd/system/gunicorn-app.socket

[Unit] 
Description=gunicorn-app socket 

[Socket] 
ListenStream=/run/unicorn.sock 
ListenStream=0.0.0.0:9000 
ListenStream=[::]:8000 

[Install] 
WantedBy=sockets.target

I realize this is kind of a sprawling question, but I'm sure I can pinpoint the issue with a few pointers. Thanks.

Update

I'm starting to narrow this down. When I run gunicorn manually and then run ps aux|grep gunicorn then I see two processes that are started: master and worker. But when I start gunicorn with systemd there is only one process started. I tried adding Type=forking to my gunicorn.services file, but then I get an error when loading service. I thought that maybe gunicorn wasn't running under the virtualenv or the venv isn't getting activated?

Does anyone know what I'm doing wrong here? Maybe gunicorn isn't running in the venv?

2
djangonginxpermissionsgunicorn

2 Answers

0
votes

I had a similar problem on OSX with launchd. The issue was I needed to allow for the process to spawn sub processes.

Try adding Type=forking:

[Unit]
Description=gunicorn-app

[Service]
Type=forking
0
votes

I know this isn't the best way, but I was able to get it working by adding gunicorn to the list of django INSTALLED_APPS. Then I just created a new systemd service:

[Unit]
Description=hack way to start gunicorn and django

[Service]
User=http
Group=http
ExecStart=/srv/http/www/nlp.com/nlp/bin/python /srv/http/www/nlp.com/nlp/nlp/manage.py run_gunicorn
Restart=always
[Install]
WantedBy=multi-user.target

There must be a better way, but judging by the lack of responses not many people know what that better way is.