1

I have a gunicorn service managed by systemd on a Debian Buster server. Here is the /etc/system.d/system/my_site file:

[Unit]
Description=gunicorn daemon for my site
Requires=my_site.socket
After=network.target

[Service]
Type=notify
User=someuser
Group=somegroup
WorkingDirectory=/home/soemuser/my_site/
ExecStart=/home/someuser/my_site_env/bin/gunicorn --bind unix:/run/gunicorn.my_site.sock --workers 2 --log-file /var/log/my_site.log my_site.wsgi:application
ExecReload=/bin/kill -s HUP $MAINPID
KillMode=mixed
TimeoutStopSec=5
PrivateTmp=true

[Install]
WantedBy=multi-user.target

This logs some gunicorn and my_site output to /var/log/my_site.log, great! The problem is that the log file is created with the following permissions: -rw-rw-rw- root root. Not so good.

How can I change the ownership and permissions on the created log file?

Unless I missed something there is nothing about it in the gunicorn doc.

Improve this question

1 Answer 1

Reset to default
0

Add your user to the www-data group and set the group to www-data.

User=user
Group=www-data

and try to replace

--log-file /some/path

with

--access-logfile
Improve this answer
2
  • Well... the reason I have created someuser is that user www-data can do many things that gunicorn should not be able to touch. Adding my user to the www-data group would partly defeat my tentative to secure the whole thing.
    – mimo
    Aug 18, 2020 at 15:57
  • then change the permission of the directory according to your user and group. sudo chown -R someuser:somegroup /path/to/directory. and each user and group is only allowed to do what you allow, in theory using somegroup or www-data is the same.
    – Sakai
    Aug 18, 2020 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.