content/blog/2022-11-11-nginx-tmp-errors.org

 1#+date:        <2022-11-11 Fri 00:00:00>
 2#+title:       Resolution of Permission Denied Errors in /var/lib/nginx Directory
 3#+description: Step-by-step remediation for addressing permission denied errors encountered by Nginx in the /var/lib/nginx directory to restore temporary file caching functionality.
 4#+slug:        nginx-tmp-errors
 5#+filetags:    :nginx:permissions:errors:
 6
 7/This is a brief post so that I personally remember the solution as it
 8has occurred multiple times for me./
 9
10* The Problem
11
12After migrating to a new server OS, I started receiving quite a few
13permission errors like the one below. These popped up for various
14different websites I'm serving via Nginx on this server, but did not
15prevent the website from loading.
16
17I found the errors in the standard log file:
18
19#+begin_src sh
20cat /var/log/nginx/error.log
21#+end_src
22
23#+begin_src sh
242022/11/11 11:30:34 [crit] 8970#8970: *10 open() "/var/lib/nginx/tmp/proxy/3/00/0000000003" failed (13: Permission denied) while reading upstream, client: 169.150.203.10, server: cyberchef.example.com, request: "GET /assets/main.css HTTP/2.0", upstream: "http://127.0.0.1:8111/assets/main.css", host: "cyberchef.example.com", referrer: "https://cyberchef.example.com/"
25#+end_src
26
27You can see that the error is =13: Permission denied= and it occurs in
28the =/var/lib/nginx/tmp/= directory. In my case, I had thousands of
29errors where Nginx was denied permission to read/write files in this
30directory.
31
32So how do I fix it?
33
34* The Solution
35
36In order to resolve the issue, I had to ensure the =/var/lib/nginx=
37directory is owned by Nginx. Mine was owned by the =www= user and Nginx
38was not able to read or write files within that directory. This
39prevented Nginx from caching temporary files.
40
41#+begin_src sh
42# Alpine Linux
43doas chown -R nginx:nginx /var/lib/nginx
44
45# Other Distros
46sudo chown -R nginx:nginx /var/lib/nginx
47#+end_src
48
49You /may/ also be able to change the =proxy_temp_path= in your Nginx
50config, but I did not try this. Here's a suggestion I found online that
51may work if the above solution does not:
52
53#+begin_src sh
54nano /etc/nginx/http.d/example.com.conf
55#+end_src
56
57#+begin_src conf
58server {
59  ...
60
61  # Set the proxy_temp_path to your preference, make sure it's owned by the
62  # `nginx` user
63  proxy_temp_path /tmp;
64
65  ...
66}
67#+end_src
68
69Finally, restart Nginx and your server should be able to cache temporary
70files again.
71
72#+begin_src sh
73# Alpine Linux (OpenRC)
74doas rc-service nginx restart
75
76# Other Distros (systemd)
77sudo systemctl restart nginx
78#+end_src