`listen` not working inside `include`

[Thomas Landauer]

With this being my sites-enabled/foo.conf

server {
    include inc*;
    ssl_certificate     localhost.crt;
    ssl_certificate_key localhost.key;
    ...
}

... and this my sites-enabled/inc

listen 443 ssl http2;

... I'm getting:

nginx: [emerg] "listen" directive is not allowed here in /etc/nginx/sites-enabled/inc:1

If I move the ssl_certificate lines to inc (and move the listen back to foo.conf), it works.

So either this is a bug, or ​http://nginx.org/en/docs/ngx_core_module.html#include is wrongly claiming that include works in any context.

[Maxim Dounin]

The sites-enabled/inc is not expected to be included by include inc*;, since include paths are relative to the main configuration file. On the other hand, as long as your nginx.conf contains something like include /etc/nginx/sites-enabled/*;, which is the default in the Ubuntu nginx package you are using, the error is expected to appear, as your include file will be included in the http block, and the listen directive is not allowed in http context.

Could you please show other include directives as used in your nginx configuration, notably in /etc/nginx/nginx.conf?

[Thomas Landauer]

(I edited the description to include full paths.)

Thanks! The root of the problem is this line in my /etc/nginx/nginx.conf:

include /etc/nginx/sites-enabled/*;

This caused inc to be loaded as a definition on its own. I was assuming that only *.conf files are loaded by default, and I can safely create an arbitrary file inside sites-enabled. So for anybody else running into the same problem:

• Either change the above line to:

  include /etc/nginx/sites-enabled/*.conf;
  

• Or place your inc elsewhere (outside sites-enabled)

Suggestion for nginx

These two lines in /etc/nginx/nginx.conf are inconsistent (*.conf vs. *):

include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;

So to avoid the above problem in general, I'm suggesting:

• Either change the second line to /etc/nginx/sites-enabled/*.conf; by default. As far as I remember, all examples I've ever seen use .conf as their filename.
• Or add a note at ​http://nginx.org/en/docs/ngx_core_module.html#include that placing the included file inside sites-enabled is a bad idea ;-)

[Maxim Dounin]

The sites-enabled/* thing is a misconception specific to the Ubuntu-provided (and Debian-provided) nginx package. It was already pointed out multiple times that using bare * in includes is unsafe, in particular, because it also includes various temporary files, including ones created by editors and version control systems.

As far as I understand, the original idea of sites-enabled/ was to make it possible to enable particular sites with symlinks, and it might be relatively safe when used properly. But it means you should never ever try to edit anything in sites-enabled/, and only link files there from sites-available/. Unfortunately, this is not something most of the Ubuntu users are aware of, and this constantly causes issues.

If you think that the Ubuntu-provided package should be improved, you may want to report this to the corresponding Ubuntu bug tracker. Alternatively, consider using official nginx package as available from ​nginx.org.

[Thomas Landauer]

I opened an issue at Debian: ​https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994199