I'm writing a GUI where users can edit their NGINX vhost information. Before updating their vhost I would like to perform a syntax check. That's why my idea was to copy the new contents to tmp first and then run a NGINX syntax check only on that certain file (instead of nginx -t which will check all vhosts and only in the appropriate nginx-directories).

Is is somehow possible to syntax-check one certain file only before pasting it from /tmp/new_vhost_content to /etc/nginx/sites-enables/vhost?

  • I hope you have proper validation for the configuration, like checking if user uses a root path he is supposed to use etc. If you allow free editing of nginx configuration, that is way too open approach waiting for abuse to happen. – Tero Kilkanen May 11 '18 at 19:28
  • Thanks I'm considering that. What else would you check except the root path? – manifestor May 11 '18 at 19:48
  • Anything that might expose other users' data, like FastCGI sockets etc. However, I cannot provide any exhaustive list since I am not implementing it myself and it is a big effort to properly evaluate the risks.. You need to think through it yourself and decide if you are happy with your solution. I wouldn't implement free editing myself at all due to risks involved. – Tero Kilkanen May 11 '18 at 20:54

To check a single config use the parameter -c ex. nginx -t -c /path/to/conf

  • +1 Thank you. Is there a possibity to wrap /etc/nginx/nginx.conf around it, because it' expects that, otherwise, if I have only a file with a server{} directive it will throw an error because of the missing wrapper. – manifestor May 8 '18 at 19:58
  • @chevallier that doesn't really make any sense. A computer can't validate only a tiny portion of the configuration out of context. – Michael Hampton May 8 '18 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.