cmc/cleberg.net

 1#+date:        [2022-11-11 Fri 00:00:00]
 2#+title:       Fixing Nginx Permission Denied Errors on /var/lib/nginx
 3#+description: Fixing permission denied errors on /var/lib/nginx in Nginx.
 4#+slug:        nginx-tmp-errors
 5#+filetags:    :web:
 6
 7/This is a brief post so that I personally remember the solution as it
 8has occurred multiple times for me./
 9
10* The Problem
11
12After migrating to a new server operating system (OS), I started receiving quite
13a few permission errors like the one below. These popped up for various
14different websites I'm serving via Nginx on this server, but did not prevent the
15website from loading.
16
17I found the errors in the standard log file:
18
19#+begin_src sh
20cat /var/log/nginx/error.log
21#+end_src
22
23#+begin_src sh
242022/11/11 11:30:34 [crit] 8970#8970: *10 open() "/var/lib/nginx/tmp/proxy/3/00/0000000003" failed (13: Permission denied) while reading upstream, client: 169.150.203.10, server: cyberchef.example.com, request: "GET /assets/main.css HTTP/2.0", upstream: "http://127.0.0.1:8111/assets/main.css", host: "cyberchef.example.com", referrer: "https://cyberchef.example.com/"
25#+end_src
26
27You can see that the error is =13: Permission denied= and it occurs in the
28=/var/lib/nginx/tmp/= directory. In my case, I had thousands of errors where
29Nginx was denied permission to read/write files in this directory.
30
31So how do I fix it?
32
33* The Solution
34
35In order to resolve the issue, I had to ensure the =/var/lib/nginx= directory is
36owned by Nginx. Mine was owned by the =www= user and Nginx was not able to read
37or write files within that directory. This prevented Nginx from caching
38temporary files.
39
40#+begin_src sh
41# Alpine Linux
42doas chown -R nginx:nginx /var/lib/nginx
43
44# Other Distros
45sudo chown -R nginx:nginx /var/lib/nginx
46#+end_src
47
48You /may/ also be able to change the =proxy_temp_path= in your Nginx config, but
49I did not try this. Here's a suggestion I found online that may work if the
50above solution does not:
51
52#+begin_src sh
53nano /etc/nginx/http.d/example.com.conf
54#+end_src
55
56#+begin_src conf
57server {
58  ...
59
60  # Set the proxy_temp_path to your preference, make sure it's owned by the
61  # `nginx` user
62  proxy_temp_path /tmp;
63
64  ...
65}
66#+end_src
67
68Finally, restart Nginx and your server should be able to cache temporary files
69again.
70
71#+begin_src sh
72# Alpine Linux (OpenRC)
73doas rc-service nginx restart
74
75# Other Distros (systemd)
76sudo systemctl restart nginx
77#+end_src