502 Bad Gateway after 1.x -> 2.0.10 upgrade

Rocologo · 16. September 2015

Okay. Could you please post a fresh copy of the two configuration files /etc/nginx/sites-enabled/openmediavault-webgui and /etc/php5/fpm/pool.d/openmediavault-webgui.conf so we can see current status.

colbond · 16. September 2015

Code

more openmediavault-webgui
server {
    server_name openmediavault-webgui;
    root /var/www/openmediavault;
    index index.php;
    autoindex off;
    server_tokens off;
    sendfile on;
    large_client_header_buffers 4 32k;
    client_max_body_size 25M;
    error_log /var/log/nginx/openmediavault-webgui_error.log error;
    access_log /var/log/nginx/openmediavault-webgui_access.log combined;
    location /extjs/ {
        alias /usr/share/javascript/extjs5/;
    }
    location /images/ {
        alias /var/www/openmediavault/images/;
    }
    location ~ \.php$ {
        try_files $uri = 404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php5-fpm-openmediavault-webgui.sock;
        fastcgi_index index.php;
        fastcgi_read_timeout 60s;
        include fastcgi_params;
    }
    listen [::]:8080 default_server ipv6only=off;
    listen [::]:443 default_server ipv6only=off ssl deferred;
    ssl_certificate /etc/ssl/certs/openmediavault-378223d6-e3a1-426f-ab98-3b4663594d7f.crt;
    ssl_certificate_key /etc/ssl/private/openmediavault-378223d6-e3a1-426f-ab98-3b4663594d7f.key;
    include /etc/nginx/openmediavault-webgui.d/*.conf;
}

Alles anzeigen

Code

upstream php-handler {
       server unix:/var/run/php5-fpm-openmediavault-owncloud.sock;
       }


server {
        listen 8443 ssl;
        server_name openmediavault;


#        ssl_certificate /etc/ssl/nginx/cloud.example.com.crt;
#        ssl_certificate_key /etc/ssl/nginx/cloud.example.com.key;
#        ssl_certificate /etc/ssl/certs/openmediavault-378223d6-e3a1-426f-ab98-3b4663594d7f.crt;
#        ssl_certificate_key /etc/ssl/private/openmediavault-378223d6-e3a1-426f-ab98-3b4663594d7f.key;
        ssl_certificate /etc/ssl/certs/owncloud-2015.crt;
        ssl_certificate_key /etc/ssl/private/owncloud-2015.key;


        # Path to the root of your installation
        root /var/www/owncloud;


        error_log /var/log/nginx/openmediavault-owncloud_error.log error;
        access_log /var/log/nginx/openmediavault-owncloud_access.log combined;


        client_max_body_size 10G; # set max upload size
        fastcgi_buffers 64 4K;


        rewrite ^/caldav(.*)$ /remote.php/caldav$1 redirect;
        rewrite ^/carddav(.*)$ /remote.php/carddav$1 redirect;
        rewrite ^/webdav(.*)$ /remote.php/webdav$1 redirect;


        index index.php;
        error_page 403 /core/templates/403.php;
        error_page 404 /core/templates/404.php;


        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }


        location ~ ^/(data|config|\.ht|db_structure\.xml|README) {
                deny all;
        }


        location / {
                # The following 2 rules are only needed with webfinger
                rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
                rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;


                rewrite ^/.well-known/carddav /remote.php/carddav/ redirect;
                rewrite ^/.well-known/caldav /remote.php/caldav/ redirect;


                rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;


                try_files $uri $uri/ index.php;
        }
        location ~ ^(.+?\.php)(/.*)?$ {
                try_files $1 = 404;


                include fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$1;
                fastcgi_param PATH_INFO $2;
                fastcgi_param HTTPS on;
#                fastcgi_pass 127.0.0.1:9000;
                fastcgi_pass unix:/var/run/php5-fpm-openmediavault-webgui.sock;
                # Or use unix-socket with 'fastcgi_pass unix:/var/run/php5-fpm.sock;'
        }


        # Optional: set long EXPIRES header on static assets
        location ~* ^.+\.(jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
                expires 30d;
                # Optional: Don't log access to assets
                access_log off;
        }


}

Alles anzeigen

Rocologo · 16. September 2015

Wrong conf files. It is not the owncloud files i want to check ☺

colbond · 16. September 2015

Ah yes. The top one above is the nginx config. Here's php5/fpm/pool.d:

Code

more openmediavault-webgui.conf
[openmediavault-webgui]
user = openmediavault
group = openmediavault


listen = /var/run/php5-fpm-openmediavault-webgui.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660


pm = ondemand
pm.max_children = 25
pm.process_idle_timeout = 10s


chdir = /


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; OpenMediaVault php.ini settings ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;


; Paths and Directories
php_value[include_path] = ".:/usr/share/php:/var/www/openmediavault"


; Pam Authentication Support (see /etc/pam.d) ;
php_value[pam.servicename] = "openmediavault-webgui";


; Maximum allowed size for uploaded files.
; http://php.net/upload-max-filesize
php_value[upload_max_filesize] = 25M


; Maximum size of POST data that PHP will accept.
; http://php.net/post-max-size
php_value[post_max_size] = 25M


; Do not expose to the world that PHP is installed on the server.
; http://php.net/expose-php
php_value[expose_php] = Off


; Name of the session (used as cookie name).
; http://php.net/session.name
php_value[session.name] = OMVSESSID


; Default timeout for socket based streams (seconds)
; http://php.net/default-socket-timeout
php_value[default_socket_timeout] = 90


; Maximum execution time of each script, in seconds
; http://php.net/max-execution-time
; Note: This directive is hardcoded to 0 for the CLI SAPI
php_value[max_execution_time] = 90

Alles anzeigen

Rocologo · 16. September 2015

Ok. What does these files contain? You include them so they are a part of nginx configuration

include /etc/nginx/openmediavault-webgui.d/*.conf;

colbond · 16. September 2015

just a security.conf

Code

# PFS (Perfect Forward Secrecy)
# https://mozilla.github.io/server-side-tls/ssl-config-generator
ssl_protocols TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-S
HA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-
AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';


# Content Security Policy (CSP)
# https://www.owasp.org/index.php/Content_Security_Policy
add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;";


# https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options
add_header X-Frame-Options "SAMEORIGIN";


# http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx
add_header X-Content-Type-Options "nosniff";


# https://wiki.mozilla.org/Security/Features/XSS_Filter
# http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx
add_header X-XSS-Protection "1; mode=block";

Alles anzeigen

Rocologo · 16. September 2015

Ok. Thats not the problem....

Hmmm. Im out of ideas

Rocologo · 16. September 2015

In line 63 in the owncloud nginx file you have an error. (webgui)

fastcgi_pass unix:/var/run/php5-fpm-openmediavault-webgui.sock;

It should be

fastcgi_pass unix:/var/run/php5-fpm-openmediavault-owncloud.sock;

colbond · 16. September 2015

Ok really really interesting. I changed that and now BOTH sites are blank (owncloud and omv-webui)

Rocologo · 16. September 2015

I need to sleep now. Tomorrow i can postmy files, then you can see if you can tell the difference.

Did you restart both nginx and php5-fpm services?

Rocologo · 16. September 2015

I assumeyou mean the gateway error and not totally blank/white?

colbond · 16. September 2015

Sounds good. Thanks for your help!

No it's all always blank page now (where I'd get intermittent/regular 502s before).

Rocologo · 16. September 2015

@tekkb

Maybe tekkb is right that we are looking in a wrong direction and it is something else. If phpinfo.php works for boths sites now.nginx and php should work.

colbond · 16. September 2015

well now it's broken in both after changing that .sock reference, but before that it only loaded phpinfo in the owncloud directory, not openmediavault.

tekkb · 17. September 2015

I don't understand how you got all these weird alterations. Every site should have it's own sock. How was owncloud using the web gui's? Where are all these changes coming from?

Clear your browser cache and restart services:
service php5-fpm restart
service nginx restart

tekkb · 17. September 2015

Why is the server_name on this config openemediavault???? Should be owncloud, yes?

Code

upstream php-handler {
       server unix:/var/run/php5-fpm-openmediavault-owncloud.sock;
       }


server {
        listen 8443 ssl;
        server_name openmediavault;


#        ssl_certificate /etc/ssl/nginx/cloud.example.com.crt;
#        ssl_certificate_key /etc/ssl/nginx/cloud.example.com.key;
#        ssl_certificate /etc/ssl/certs/openmediavault-378223d6-e3a1-426f-ab98-3b4663594d7f.crt;
#        ssl_certificate_key /etc/ssl/private/openmediavault-378223d6-e3a1-426f-ab98-3b4663594d7f.key;
        ssl_certificate /etc/ssl/certs/owncloud-2015.crt;
        ssl_certificate_key /etc/ssl/private/owncloud-2015.key;


        # Path to the root of your installation
        root /var/www/owncloud;


        error_log /var/log/nginx/openmediavault-owncloud_error.log error;
        access_log /var/log/nginx/openmediavault-owncloud_access.log combined;


        client_max_body_size 10G; # set max upload size
        fastcgi_buffers 64 4K;


        rewrite ^/caldav(.*)$ /remote.php/caldav$1 redirect;
        rewrite ^/carddav(.*)$ /remote.php/carddav$1 redirect;
        rewrite ^/webdav(.*)$ /remote.php/webdav$1 redirect;


        index index.php;
        error_page 403 /core/templates/403.php;
        error_page 404 /core/templates/404.php;


        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }


        location ~ ^/(data|config|\.ht|db_structure\.xml|README) {
                deny all;
        }


        location / {
                # The following 2 rules are only needed with webfinger
                rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
                rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;


                rewrite ^/.well-known/carddav /remote.php/carddav/ redirect;
                rewrite ^/.well-known/caldav /remote.php/caldav/ redirect;


                rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;


                try_files $uri $uri/ index.php;
        }
        location ~ ^(.+?\.php)(/.*)?$ {
                try_files $1 = 404;


                include fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$1;
                fastcgi_param PATH_INFO $2;
                fastcgi_param HTTPS on;
#                fastcgi_pass 127.0.0.1:9000;
                fastcgi_pass unix:/var/run/php5-fpm-openmediavault-webgui.sock;
                # Or use unix-socket with 'fastcgi_pass unix:/var/run/php5-fpm.sock;'
        }


        # Optional: set long EXPIRES header on static assets
        location ~* ^.+\.(jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
                expires 30d;
                # Optional: Don't log access to assets
                access_log off;
        }


}

Alles anzeigen

tekkb · 17. September 2015

You should only have one sock line in your server config too. I see you have 2 sock lines in the file above for owncloud.

I would delete this and just have line 63 using owncloud's sock and not the web gui sock as mentioned by roco.

Code

upstream php-handler {
       server unix:/var/run/php5-fpm-openmediavault-owncloud.sock;
       }

tekkb · 17. September 2015

If it is not working then try disabling just owncloud and see if the web gui works. With the command I showed you for nginx.

Rocologo · 17. September 2015

You should try cleaning up your files. You can compare your files with mine a find the differences. You must look at your configuration as if it was two different server and separate them completely.

This is my openemedia-webgui

Code

server {
    server_name openmediavault-webgui;
    root /var/www/openmediavault;
    index index.php;
    autoindex off;
    server_tokens off;
    sendfile on;
    large_client_header_buffers 4 32k;
    client_max_body_size 25M;
    error_log /var/log/nginx/openmediavault-webgui_error.log error;
    access_log /var/log/nginx/openmediavault-webgui_access.log combined;
    location /extjs/ {
        alias /usr/share/javascript/extjs5/;
    }
    location /images/ {
        alias /var/www/openmediavault/images/;
    }
    location ~ \.php$ {
        try_files $uri = 404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php5-fpm-openmediavault-webgui.sock;
        fastcgi_index index.php;
        fastcgi_read_timeout 60s;
        include fastcgi_params;
    }
    listen [::]:8084 default_server ipv6only=off;
    if ($scheme = http) {
        # Force redirection to HTTPS.
        return 301 https://$host:6443$request_uri;
    }
    listen [::]:6443 default_server ipv6only=off ssl deferred;
    ssl_certificate /etc/ssl/certs/openmediavault-e462d7d4-28ae-419c-a1f8-2f1380c997df.crt;
    ssl_certificate_key /etc/ssl/private/openmediavault-e462d7d4-28ae-419c-a1f8-2f1380c997df.key;
    include /etc/nginx/openmediavault-webgui.d/*.conf;
}

Alles anzeigen

This is openmediavault-owncloud

Code

server {
    listen [::]:8443 default_server ipv6only=off ssl deferred;
    ssl_certificate /etc/ssl/certs/openmediavault-e462d7d4-28ae-419c-a1f8-2f1380c997df.crt;
    ssl_certificate_key /etc/ssl/private/openmediavault-e462d7d4-28ae-419c-a1f8-2f1380c997df.key;
    server_name owncloud;
    root /var/www/owncloud;
    index index.php;
    autoindex off;
    server_tokens off;
    sendfile on;
    large_client_header_buffers 4 32k;
    client_max_body_size 10G;
    error_log /var/log/nginx/owncloud_error.log error;
    access_log /var/log/nginx/owncloud_access.log combined;
    rewrite ^/caldav(.*)$ /remote.php/caldav$1 redirect;
    rewrite ^/carddav(.*)$ /remote.php/carddav$1 redirect;
    rewrite ^/webdav(.*)$ /remote.php/webdav$1 redirect;
    error_page 403 /core/templates/403.php;
    error_page 404 /core/templates/404.php;
    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }
    location ~ ^/(data|config|\.ht|db_structure\.xml|README) {
        deny all;
    }
    location / {
        # The following 2 rules are only needed with webfinger
        rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
        rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
        rewrite ^/.well-known/carddav /remote.php/carddav/ redirect;
        rewrite ^/.well-known/caldav /remote.php/caldav/ redirect;
        rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
        try_files $uri $uri/ index.php;
    }
    location ~ ^(.+?\.php)(/.*)?$ {
        try_files $1 = 404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$1;
        fastcgi_param PATH_INFO $2;
        fastcgi_param HTTPS on;
        fastcgi_param PHP_VALUE "upload_tmp_dir = /media/ea21f108-b011-4381-9bfb-486f4cb70476/owncloud/";
        fastcgi_pass unix:/var/run/php5-fpm-openmediavault-owncloud.sock;
        fastcgi_buffers 64 4K;
    }
    location ~* ^.+\.(jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
        expires 30d;
        access_log off;
    }
    # PFS (Perfect Forward Secrecy)
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA$
}

Alles anzeigen

This is my openmediavault-webgui.conf

Code

[openmediavault-webgui]
user = openmediavault
group = openmediavault


listen = /var/run/php5-fpm-openmediavault-webgui.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660


pm = ondemand
pm.max_children = 5
pm.process_idle_timeout = 10s


chdir = /


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; OpenMediaVault php.ini settings ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;


; Paths and Directories
php_value[include_path] = ".:/usr/share/php:/var/www/openmediavault"


; Pam Authentication Support (see /etc/pam.d) ;
php_value[pam.servicename] = "openmediavault-webgui";


; Maximum allowed size for uploaded files.
; http://php.net/upload-max-filesize
php_value[upload_max_filesize] = 25M


; Maximum size of POST data that PHP will accept.
; http://php.net/post-max-size
php_value[post_max_size] = 25M


; Do not expose to the world that PHP is installed on the server.
; http://php.net/expose-php
php_value[expose_php] = Off


; Name of the session (used as cookie name).
; http://php.net/session.name
php_value[session.name] = OMVSESSID


; Default timeout for socket based streams (seconds)
; http://php.net/default-socket-timeout
php_value[default_socket_timeout] = 90


; Maximum execution time of each script, in seconds
; http://php.net/max-execution-time
; Note: This directive is hardcoded to 0 for the CLI SAPI
php_value[max_execution_time] = 90

Alles anzeigen

This is my openmediavault-owncloud.conf

Code

[openmediavault-owncloud]
user = www-data
group = www-data


listen = /var/run/php5-fpm-openmediavault-owncloud.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660


pm = ondemand
pm.max_children = 15
pm.process_idle_timeout = 10s
;pm = static
;pm.max_children = 1


chdir = /


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; ownCloud php.ini settings ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;


; Paths and Directories
php_value[include_path] = ".:/usr/share/php:/var/www/owncloud"


; Maximum allowed size for uploaded files.
; http://php.net/upload-max-filesize
php_value[upload_max_filesize] = 10G


; Maximum size of POST data that PHP will accept.
; http://php.net/post-max-size
php_value[post_max_size] = 10G


; Do not expose to the world that PHP is installed on the server.
; http://php.net/expose-php
php_value[expose_php] = Off


; Name of the session (used as cookie name).
; http://php.net/session.name
php_value[session.name] = OWNCLOUDSESSID


; Default timeout for socket based streams (seconds)
; http://php.net/default-socket-timeout
php_value[default_socket_timeout] = 90


; Temporary directory for HTTP uploaded files (will use system default if not
; specified).
; http://php.net/upload-tmp-dir
php_value[upload_tmp_dir] = /var/www/owncloud/data


; added by CLJ
php_admin_value[error_log] = /var/log/php5-fpm-owncloud.log
php_admin_flag[log_errors] = on
php_admin_value[memory_limit] = 512M

Alles anzeigen

colbond · 19. September 2015

Ok. Disabled the vhost for owncloud completely. Copied your configs and only modified enough that it should work on my host (basically the ssl cert info). The redirect happens properly, then on 6443 I get a blank page. This has to be a php issue at this point, right?

Jetzt mitmachen!