Add write permissions to nginx for files inside /usr/local/lib/lua + add read permission for others on logs files

[mgiammarco]

Hello, I have a configuration like this:

mywww:                                                                                                                                                                                                         
  image: bunkerity/bunkerized-nginx                                                                                                                                                                            
  restart: always                                                                                                                                                                                              
  ports:                                                                                                                                                                                                       
  - 20080:8080                                                                                                                                                                                               
  - 20443:8443                                                                                                                                                                                               
  volumes:                                                                                                                                                                                                     
  - /cache:/cache                                                                                                                                                                                            
  - /certificates:/etc/letsencrypt                                                                                                                                                                           
  - nginx_logs:/var/log                                                                                                                                                                                      
  environment:   

  - MULTISITE=yes                                                                                                                                                                                            
  - SERVER_NAME=xxxxxxx.yyy                                                                                                                                      
  - SERVE_FILES=no                                                                                                                                                                                           
  - DISABLE_DEFAULT_SERVER=yes                                                                                                                                                                               
  - REDIRECT_HTTP_TO_HTTPS=yes                                                                                                                                                                               
  - AUTO_LETS_ENCRYPT=yes                                                                                                                                                                                    
  - USE_PROXY_CACHE=yes                                                                                                                                                                                      
  - USE_GZIP=yes                                                                                                                                                                                             
  - USE_BROTLI=yes                                                                                                                                                                                           
  - USE_REVERSE_PROXY=yes                                                                                                                                                                                    
  - xxxxxxxx.yyy_REVERSE_PROXY_URL=/                                                                                                                                                                
  - xxxxxxxx.yyy_REVERSE_PROXY_HOST=xxxxxxx.yyy:10080/                                                                                                                             

  - USE_MODSECURITY=no                                                                                                                                                                                       

  - USE_CROWDSEC=yes                                                                                                                                                                                         
  - CROWDSEC_HOST=http://mycrowdsec:8080                                                                                                                                                                     
  - CROWDSEC_KEY=dddddddddddd7bece6f36a06a49e653          

but I get this error at startup: /opt/entrypoint/utils.sh: line 9: /usr/local/lib/lua/crowdsec/crowdsec.conf: Permission denied and this on each url: CrowdSec.lua:103: allowIp(): [Crowdsec] Http error invalid host 'nil' while talking to LAPI (%CROWDSEC_HOST%/v1/decisions?

Can you help me? Thanks, Mario

[fl0ppy-d1sk]

Hi @mgiammarco,

It looks like a bug. Starting with v1.2.3 every process is run as an unprivileged user but we forgot to make the files inside the /usr/local/lib/lua writeable by this user (see code here).

[mgiammarco]

Infact in the example I had to put also rw the /var/log of mycrowdsec container, probably it is related? So what can I do? Do I need to wait for new release? Thanks, Mario

Il giorno mar 6 apr 2021 alle ore 13:34 Bunkerity @.***> ha scritto:

Hi @mgiammarco https://github.com/mgiammarco,

It looks like a bug. Starting with v1.2.3 every process is run as an unprivileged user but we forgot to make the files inside the /usr/local/lib/lua writeable by this user (see code here https://github.com/bunkerity/bunkerized-nginx/blob/master/prepare.sh#L69-L71 ).

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bunkerity/bunkerized-nginx/issues/113#issuecomment-814048586, or unsubscribe https://github.com/notifications/unsubscribe-auth/AABBIFUNRXGZAMBTL5S74K3THLWUXANCNFSM42NIHFLA .

[fl0ppy-d1sk]

Thanks for catching up the logs issue, we also need to fix it. Yes, you should wait until the next release. I will keep you updated once it's done.

[fl0ppy-d1sk]

Hello @mgiammarco,

Crowdsec should now be fully working with the last version of bunkerized-nginx. I've also updated the example.