Deploying Python Web Applications with nginx and uWSGI Emperor

uWSGI configuration

Start with this, but read the notes below and change the values accordingly:

Save this file as:

• Ubuntu, Debian: /etc/uwsgi-emperor/vassals/myapp.ini

• Fedora, CentOS, EL8 (AlmaLinux, Rocky Linux): /etc/uwsgi.d/myapp.ini

• Arch Linux: /etc/uwsgi/vassals/myapp.ini (create the directory first and chown it to http: mkdir -p /etc/uwsgi/vassals; chown -R http:http /etc/uwsgi/vassals)

The options are:

• socket — the socket file that will be used by your application. It’s usually a file path (Unix domain socket). You could use a local TCP socket, but it’s not recommended.

• chdir — the app directory.

• binary-path — the uWSGI executable to use. Remove if you didn’t install the (optional) uwsgi package in your virtual environment.

• virtualenv — the virtual environment for your application.

• module — the name of the module that houses your application, and the object that speaks the WSGI interface, separated by colons. This depends on your web framework:

  Framework	Flask, Bottle	Django	Pyramid
  Package	module where app is defined	project.wsgi (project is the package with settings.py)	module where app is defined
  Callable	Flask: app instance Bottle: app = bottle.default_app()	application	app = config.make_wsgi_app()
  Module	package:app	project.wsgi:application	package:app
  Caveats	Make sure app is not in an if __name__ == '__main__': block	Add environment variable for settings: env = DJANGO_SETTINGS_MODULE=project.settings	Make sure app is not in an if __name__ == '__main__': block (the demo quickstart does that!)

• uid and gid — the names of the user account to use for your server. Use the same values as in the chown command above.

• processes and threads — control the resources devoted to this application. Because this is a simple hello app, I used one process with one thread, but for a real app, you will probably need more (you need to see what works the best; there is no algorithm to decide). Also, remember that if you use multiple processes, they don’t share memory (you need a database to share data between them).

• plugins — the list of uWSGI plugins to use. For Arch Linux, use plugins = python (the logfile plugin is always active). For CentOS 7 only (i.e. not for EL8), use plugins = python36.

• logger — the path to your app-specific logfile. (Other logging facilities are available, but this one is the easiest, especially for multiple applications on the same server)

• env — environment variables to pass to your app. Useful for configuration, may be specified multiple times. Example for Django: env = DJANGO_SETTINGS_MODULE=project.settings

You can test your configuration by running uwsgi --ini /path/to/myapp.ini (disable the logger for stderr output or run tail -f /srv/myapp/uwsgi.log in another window).

If you’re using Fedora, CentOS, or EL8, there are two configuration changes you need to make globally: in /etc/uwsgi.ini, disable the emperor-tyrant option (which we don’t need, as it sets uid/gid for every process based on the owner of the related .ini config file — we use one global setup) and set gid = nginx. We’ll need this so that nginx can talk to your socket.

nginx configuration

We need to configure our web server. Here’s a basic configuration that will get us started:

Save this file as:

• Ubuntu, Debian: /etc/nginx/sites-enabled/myapp.conf

• Fedora, CentOS, EL8 (AlmaLinux, Rocky Linux): /etc/nginx/conf.d/myapp.conf

• Arch Linux: add include /etc/nginx/conf.d/*.conf; to your http directive in /etc/nginx/nginx.conf and use /etc/nginx/conf.d/myapp.conf

Note that this file is a very basic and rudimentary configuration. This configuration is fine for local testing, but for a real deployment, you will need to adjust it:

• set listen to 443 ssl and create a http→https redirect on port 80 (you can get a free SSL certificate from Let’s Encrypt; make sure to configure SSL properly).

• set server_name to your real domain name

• you might also want to add custom error pages, log files, or change anything else that relates to your web server — consult other nginx guides for details

• nginx usually has some server already enabled by default — edit /etc/nginx/nginx.conf or remove their configuration files from your sites directory to disable it

For Arch Linux

All you need is:

systemctl enable nginx emperor.uwsgi
systemctl start nginx emperor.uwsgi

Verify the service is running with systemctl status emperor.uwsgi

For Fedora, CentOS, EL8

Make sure you followed the extra note about editing /etc/uwsgi.ini earlier and run:

systemctl enable nginx uwsgi
systemctl start nginx uwsgi

Verify the service is running with systemctl status uwsgi

If you disabled SELinux, this is enough to get an app working and you can skip over to the next section.

If you want to use SELinux, you need to do the following to allow nginx to read static files:

setenforce 0
chcon -R system_u:system_r:httpd_t:s0 /srv/myapp/appdata/static
setenforce 1

We now need to install a SELinux policy (that I created for this project; updated 2020-05-02) to allow nginx and uWSGI to communicate. Download nginx-uwsgi.pp and run:

semodule -i nginx-uwsgi.pp

Hopefully, this is enough (you can delete the file). In case it isn’t, please read SELinux documentation, check audit logs, and look into audit2allow.

For Ubuntu and Debian

Ubuntu and Debian (still!) use LSB services for uWSGI. Because LSB services are awful, we’re going to set up our own systemd-based (native) service.

Start by disabling the LSB service that comes with Ubuntu and Debian:

systemctl stop uwsgi-emperor
systemctl disable uwsgi-emperor

Copy the .service file from the uWSGI systemd documentation to /etc/systemd/system/emperor.uwsgi.service. Change the ExecStart line to:

ExecStart=/usr/bin/uwsgi --ini /etc/uwsgi-emperor/emperor.ini

You can now reload systemd daemons and enable the services:

systemctl daemon-reload
systemctl enable nginx emperor.uwsgi
systemctl reload nginx
systemctl start emperor.uwsgi

Verify the service is running with systemctl status emperor.uwsgi. (Ignore the warning about no request plugin)