I'm looking to deploy virtual machines to run a single instance of Django REST framework. I would like to use uWSGI since it seems pretty light weight and can be configured with a single file. I have figured out most of the configuration, and have SSL running just fine. These VMs are being deployed with cloud-init, so the bulk is taken care of with minimal scripting. Everything else will be done via SSH.

My question is: where should I place my Django application, and what permissions should be set on that folder? What about uWSGI log and ini file locations? For reference, these are my plans for the uWSGI ini and folder locations and permissions. Note, I am aware of this question (What permissions should my website files/folders have on a Linux webserver?), and have read it, but this assumes some things that are setup with an apache2 install I think, so I'm starting from scratch. I'm probably really wrong in a few places, so I'd welcome any suggestions:

shared-socket = :443
https = =0,fullchain.pem,privkey.pem,HIGH
uid = uwsgi
gid = uwsgi
chdir = /var/www/primary/project
wsgi-file = project/wsgi.py
processes = 4
threads = 2
daemonize = /var/log/uwsgi/uwsgi_443.log
check-static = /var/www/primary/webroot/
logfile-chown = true

Plan for web app folder (where I was going to put the Django install):

sudo mkdir -p /var/www/primary
sudo chown -R vmuser /var/www/primary/
sudo chgrp -R uwsgi /var/www/primary/
sudo chmod -R 750 /var/www/primary/
sudo chmod g+s /var/www/primary/

Plan for config files:

sudo mkdir -p /etc/vmuser
sudo chown -R vmuser /etc/vmuser/
sudo chgrp -R uwsgi /etc/vmuser/
sudo chmod -R 740 /etc/vmuser/
sudo chmod g+s /etc/vmuser/

Plan for log files:

sudo mkdir -p /var/log/uwsgi
sudo chown -R vmuser /var/log/uwsgi
sudo chgrp -R uwsgi /var/log/uwsgi
sudo chmod -R 750 /var/log/uwsgi
sudo chmod g+s /var/log/uwsgi
  • Then make a suggestion for change. That said, this would not be a long running virtual machine, it would be wiped in 24 hours or less in most cases. – Brian Apr 12 at 16:50
  • Thinking more about your comment, it may well be that groups aren't worth it, and I just run things under the main user. However that user currently has sudo privileges without a password, so that would likely be bad if there actually was a compromise of some sort – Brian Apr 12 at 16:58
  • Wait, what? Those are two entirely different beasts. Do not, ever, run web services under root user (or a user who can become root). My question was concerning the group, which does not appear to have any benefit. – anx Apr 12 at 22:00
  • Okay, then suggest what WOULD have benefit then. I'm entirely open to suggestions concerning best practices in this situation. Is it enough to create another user to be owner of the uwsgi process and files? – Brian Apr 12 at 22:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.