使用uWSGI在Nginx上安装Django的正确方法

Question

What I'm trying to do is to setup django with uwsgi on nginx 1.6.3 with http binding to port 8000 on centos7. I've looked at a blog

and a document

The blog is pretty confusing and it does not work for my version of nginx; but the document is decent and all the steps lead me to a successful execution using uwsgi but I'm having problems with nginx.

First of all, I can only run nginx as a sudoer (root) so I made a virtualenv for the root user. Then, I made my nginx config at: /etc/nginx/sites-enabled/mysite_nginx.conf and did a soft link:

sudo ln -s /etc/nginx/sites-enabled/mysite_nginx.conf /etc/nginx/mysite_nginx.conf

but nginx does not pick it after nginx restart. Does anyone know why?

To continue, I decided to rename /etc/nginx/mysite_nginx.conf to /etc/nginx/nginx.conf to force it to get picked up. and my django app is at: /usr/share/nginx/firstsite owned by root and my nginx user is nginx. Here is my nginx.conf:

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    include /etc/nginx/conf.d/*.conf;
    upstream django {
        server 127.0.0.1:8001;
    }

    server {
        listen       8000 default_server;
        listen       [::]:8000 default_server;
        server_name  _;
        root         /usr/share/nginx/firstsite;

        client_max_body_size 300M;   # adjust to taste

        location /media  {
            alias /usr/share/nginx/firstsite/media;
        }

        location /static {
            alias /usr/share/nginx/firstsite/static;
        }

        location / {
            uwsgi_pass  django;
            include     /usr/share/nginx/firstsite/uwsgi_params;
        }
    }
}

Also I do not understand how uwsgi is configured. I have a wusgi.ini that works. I just need to know where to put the uwsgi.ini file and whether it is possible to run nginx and uwsgi as a non-root user.

I've run the nginx test and it says that my configuration file is ok. Lastly, I get an error when trying to start nginx. It says it does not have permissions to bind to port 8000. so I read this post

then I tried:

yum -y install policycoreutils-python
semanage port -l | grep http_port_t
semanage port -a -t http_port_t  -p tcp 8000

and I get an error:

ValueError: Port tcp/8000 already defined

I know there are several questions and problems here but the goal is pretty clear.

Answer 1

It could be...

a) the system firewall is block python/nginx/bash etc. from binding to port 80 or

b) you need to run it with sudo . This is because Unix-like OSes require superuser privileges for an application to bind to a well-known port .

Answer 2

nginx will usually run as root. uwsgi can also run as root or as a normal user, normally you'd have it run as root, and configure uwsgi apps to run as non-root users (you can specify that in the uwsgi config file for your app) - check out the link @doniyor posted for more details on how to set up Vassals.

You can also set it up so that if you change a file (usually the wsgi file for the app), uwsgi will restart that app. You'd usually use the touch command on that file, and as that file is in a normal user account, you can easily restart your app without having to be root.

As for reason nginx isn't picking your file up is that the file needs to be in /etc/nginx/sites-enabled , the ln command gets the source in the -s switch, so esentially you're linking files the other way around.

Permission to bind to unreserved ports shouldn't be a problem even for normal users. It is possible that something's already running on that port, try something different, like 8001.