Open boazpoolman opened 6 months ago
fyi @boazpoolman I've managed to solve the issue by adding www-data
user to the dokku
group on the machine I'm hosting dokku:
ssh root@yourdokku
gpasswd -a www-data dokku
For more context: nginx is being run by the www-data
user and that user cannot access the dokku apps' files and directories owned by user and group dokku
.
Not sure when this changed, but it seemed to be working before my last update which was dokku version 0.32.x.
Is this something that needs to be added to the readme?
Or can we solve the issue from within the source code of the plugin?
I think it should be solved within the source, so the proper word for my solution is a workaround 😀
Check!
Are ya'll running SELinux or something? What version of ubuntu are you running?
For reference, I've been seeing issues with more "hardened" dokku installs where the nginx config isn't reloaded or similar - this is due to the issue @adamgyulavari brought up.
There is an issue upstream in Dokku to move these configs into the /etc/nginx
folder and let nginx handle it, but I haven't gone through the motions of making the change, mostly cause it will be obnoxious to do and likely to cause issues in migration if not done right...
I'm getting this issue on my first ever test-run of dokku, on a new VPS with Ubuntu 22.04 LTS on Google Cloud. Apart from bootstrapping dokku the way the docs say, I haven't installed a single package, so no extra security shenanigans (unless it's part of Jammy out of the box).
Can confirm the workaround in https://github.com/dokku/dokku-maintenance/issues/19#issuecomment-2100753293 works.
I'm running into this issue as well with nginx 1.27.0
, Dokku 0.34.7
on Debian 12.
AFAIK we have not diverged from a default installation.
However, it works fine on a Debian 11 installation.
Unfortunately, the workaround in https://github.com/dokku/dokku-maintenance/issues/19#issuecomment-2100753293 does not seem to work on Debian 12.
I've in the meanwhile noticed that in Debian 12 the Dokku user home (/home/dokku
) is created with permissions 0700
instead of 0755
, which prevents Nginx from accessing it. I've used the Ansible role to install Dokku.
The workaround described above did not work for me, because:
nginx
instead of www-data
.So for me chmod 0755 /home/dokku
solved the issue.
Description of problem
When I enable the maintenance mode for an app I get a 403 page.
How reproducible
I'm unsure if this is intended behavior, or that it's an issue with my implementation.
I can confirm that all different apps on my Dokku host have the same problem.
Setting a custom page does change the behavior.
Steps to Reproduce
dokku maintenance:enable myapp
Actual Results
A 403 nginx page
Expected Results
The maintenance page.
Environment Information
dokku report APP_NAME
outputHow (deb/make) and where (AWS, VirtualBox, physical, etc.) was Dokku installed?:
Dokku was installed on an OVH VPS with Ubuntu 22.04. The official installation docs were used to install Dokku.
Additional information
dokku ps:inspect APP_NAME
The nginx configuration (if applicable) via
dokku nginx:show-config APP_NAME
}
server { listen [::]:80; listen 80; server_name database-of-life.com; access_log /var/log/nginx/nextjs-access.log; error_log /var/log/nginx/nextjs-error.log; underscores_in_headers off;
include /home/dokku/nextjs/nginx.conf.d/*.conf; location / { return 301 https://$host:443$request_uri; }
}
server { listen [::]:443 ssl http2; listen 443 ssl http2;
server_name database-of-life.com; access_log /var/log/nginx/nextjs-access.log; error_log /var/log/nginx/nextjs-error.log; underscores_in_headers off;
ssl_certificate /home/dokku/nextjs/tls/server.crt; ssl_certificate_key /home/dokku/nextjs/tls/server.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers off;
keepalive_timeout 70;
location / {
}
client_max_body_size 1m;
error_page 400 401 402 403 405 406 407 408 409 410 411 412 413 414 415 416 417 418 420 422 423 424 426 428 429 431 444 449 450 451 /400-error.html; location /400-error.html { root /var/lib/dokku/data/nginx-vhosts/dokku-errors; internal; }
error_page 404 /404-error.html; location /404-error.html { root /var/lib/dokku/data/nginx-vhosts/dokku-errors; internal; }
error_page 500 501 503 504 505 506 507 508 509 510 511 /500-error.html; location /500-error.html { root /var/lib/dokku/data/nginx-vhosts/dokku-errors; internal; }
error_page 502 /502-error.html; location /502-error.html { root /var/lib/dokku/data/nginx-vhosts/dokku-errors; internal; } include /home/dokku/nextjs/nginx.conf.d/*.conf; }
upstream nextjs-5000 {
server 172.17.0.5:5000; }