<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>
<blockquote type="cite">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">This allows permission management via user accounts but it can can get bulky as soon as you set up user accounts for permission management of each backend application, as they pose a higher risk, as indicated in the previous email
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Well you asked how to proxy unix sockets...
</pre>
</blockquote>
and that is the explantation why you could/should to do instead of
TCP sockets or did I miss something?</p>
<p><br>
</p>
<p><span style="font-family: Courier New">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">If you put everything (both the user unix sockets and also the parent proxy server) under the same http{} block</pre>
</blockquote>
</span><br>
so all goes in the same nginx.conf but in different <tt>http{}
block </tt>or do I need one <tt>nginx.conf</tt> for each, the
user unix sockets and also the parent proxy server?</p>
<p><br>
</p>
<p><span style="font-family: Courier New">
</span></p>
<p><span style="font-family: Courier New">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">It's more simple then just to make virtualhosts without the sockets and without the proxy.</pre>
</blockquote>
server {<br>
listen ...<a href="http://www.WebApp1.local;" target="_blank"></a><br>
}</span><br>
</p>
<p>a server block is the counterpart of a virtualhost in Apache
isn't it?<br>
You suggesting to setup virtualhosts what listen to a port whereto
traffic is forwarded from the router. I don't to have multiple
ports open at the router, so I would like to stick with UNIX
Sockets and proxy.</p>
<p><br>
</p>
<p>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">In general you are mixing a lot of things together,</pre>
</blockquote>
No worries, those things get solved elsewhere. I mentioned them as
they interfere with the proxy/virtualhost setup. <br>
</p>
<p><br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 02.10.2018 18:41, Reinis Rozitis
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:000601d45a6e$cee8e960$6cbabc20$@roze.lv">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">This allows permission management via user accounts but it can can get bulky as soon as you set up user accounts for permission management of each backend application, as they pose a higher risk, as indicated in the previous email
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Well you asked how to proxy unix sockets...
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">that is all put in the same http{} block.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
If you put everything (both the user unix sockets and also the parent proxy server) under the same http{} block then it makes no sense since a single instance of nginx always runs under the same user (and beats the whole user/app isolation).
It's more simple then just to make virtualhosts without the sockets and without the proxy.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Nginx just starts php-fpm
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
No.
Depending on distribution there might be some init and/or systemd scripts which start both daemons but on its own nginx doesn’t do that.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">4. (new) how to debug
In /etc/nginx/nginx.conf as there is:
access_log syslog:server=unix:/dev/log,facility=local7,tag=nginx_access,nohostname main;
error_log syslog:server=unix:/dev/log,facility=local7,tag=nginx_error,nohostname error;
so I assume Debug Logging is available although $ nginx -V 2>&1 | grep -- '--with-debug' does not return anything.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
It means that nginx is logging to syslog (which then usually writes somewhere under /var/log). You can change/point both logs also directly to a file.
--with-debug is only present when nginx is compiled in debug mode to log internal things and provide more detailed information in case of bugs. I doubt it will give any benefit in this case.
In general you are mixing a lot of things together, like asking about a BSD firewall, NATs, Bind and then trying to implement it on a specific linux-based ARM blackbox.
I would suggest to start experimenting/researching different technologies one by one rather than trying to achieve everything at once.
rr
_______________________________________________
nginx mailing list
<a class="moz-txt-link-abbreviated" href="mailto:nginx@nginx.org">nginx@nginx.org</a>
<a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/mailman/listinfo/nginx</a></pre>
</blockquote>
</body>
</html>