1

I have a gunicorn service managed by systemd on a Debian Buster server. Here is the /etc/system.d/system/my_site file:

[Unit]
Description=gunicorn daemon for my site
Requires=my_site.socket
After=network.target

[Service]
Type=notify
User=someuser
Group=somegroup
WorkingDirectory=/home/soemuser/my_site/
ExecStart=/home/someuser/my_site_env/bin/gunicorn --bind unix:/run/gunicorn.my_site.sock --workers 2 --log-file /var/log/my_site.log my_site.wsgi:application
ExecReload=/bin/kill -s HUP $MAINPID
KillMode=mixed
TimeoutStopSec=5
PrivateTmp=true

[Install]
WantedBy=multi-user.target

This logs some gunicorn and my_site output to /var/log/my_site.log, great! The problem is that the log file is created with the following permissions: -rw-rw-rw- root root. Not so good.

How can I change the ownership and permissions on the created log file?

Unless I missed something there is nothing about it in the gunicorn doc.

Improve this question

1 Answer 1

Reset to default
0

Add your user to the www-data group and set the group to www-data.

User=user
Group=www-data

and try to replace

--log-file /some/path

with

--access-logfile
Improve this answer
2
  • Well... the reason I have created someuser is that user www-data can do many things that gunicorn should not be able to touch. Adding my user to the www-data group would partly defeat my tentative to secure the whole thing.
    – mimo
    Commented Aug 18, 2020 at 15:57
  • then change the permission of the directory according to your user and group. sudo chown -R someuser:somegroup /path/to/directory. and each user and group is only allowed to do what you allow, in theory using somegroup or www-data is the same.
    – Sakai
    Commented Aug 18, 2020 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .