A refused connection is one of the causes of a 502. This step shows how to tell the others apart by the error.log line.
An application can listen on a file instead of a port — a unix socket. Then proxy_pass holds the path to it: proxy_pass http://unix:/run/app/app.sock;. A process can connect to a socket if it may write to that file. On Ubuntu the nginx worker processes run as the www-data user, so that user needs the permission.
The words in the error.log line show what happened on the second leg:
| In the error.log line | What happened |
|---|---|
(111: Connection refused) while connecting to upstream |
nothing listens on the address and port from proxy_pass |
(2: No such file or directory) while connecting to upstream |
there is no socket file at that path |
(13: Permission denied) while connecting to upstream |
the socket exists, but www-data may not write to it |
upstream timed out (110: Connection timed out) |
the application did not answer in time — 504 Gateway Time-out |
error.log has the line connect() to unix:/run/shop/shop.sock failed (13: Permission denied) while connecting to upstream. What do you check first?
-
Here
proxy_passholds a socket path, with no port. nginx found the file — otherwise the brackets would say2: No such file or directory. -
A timeout is a different line,
upstream timed out. Code 13 is a denial right at connect time. -
Code 13 is about the file's permissions: without them nginx will not reach the application, running or not.
ls -lon the socket shows the permissions.
Code 13 is a denial: the socket file exists, but the nginx worker processes running as www-data lack write permission on it. Check the permissions with ls -l on the socket and on the directory above it.
Key points
- The code in brackets in the error.log line names the cause: 111 — nothing listens, 2 — no socket file, 13 — no permission.
-
The nginx worker processes connect to a unix socket as
www-data: they are the ones that need write permission. -
An application that does not answer in time gives the client a different code,
504 Gateway Time-out.