Add support for the systemd directive OpenFile= for passing UNIX socket FDs to nginx

[erik.sjolund@…]

nginx currently supports specifying a UNIX socket path with the proxy_pass configuration directive

For example

proxy_pass http://unix:/tmp/backend.socket:/uri/;

(reference:
​https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass
)

Instead of specifying a path to the UNIX socket, I would like to pass in a file descriptor for the UNIX socket to nginx via inheritance from the parent process that starts nginx (i.e., systemd).

Feature request:
Add support for specifying a UNIX socket via the new systemd directive

OpenFile=

(see ​https://www.freedesktop.org/software/systemd/man/systemd.service.html#OpenFile=) which is available in systemd 253 (released 15 February 2023).

systemd connects to the UNIX socket and lets nginx inherit the file descriptor.

I have not yet investigated how systemd sets the environment variable LISTEN_FDNAMES. (I could provide more details later).

Rationale

This new feature would make it possible to set up a systemd system service with the systemd configuration USER=myuser and GROUP=mygroup and use nginx to proxy traffic to a UNIX socket that the user myuser:mygroup does not have file permission access to. The reason myuser:mygroup is able to use the UNIX socket is that systemd (running as root) has already connected to the socket.

[Maxim Dounin]

Instead of specifying a path to the UNIX socket, I would like to pass in a file descriptor for the UNIX socket to nginx via inheritance from the parent process that starts nginx

Note there can be multiple simultaneous requests to the upstream. How do you expect this to be handled with a single file descriptor?

[erik.sjolund@…]

The systemd directive OpenFile takes an optional argument for setting the fd-name. The systemd directive OpenFile can be given multiple times. To have multiple backends in nginx we could use different fd-names. These names are provided to nginx via the environment variable LISTEN_FDNAMES. The names would need to be matched against the same names in the nginx configuration. (Some new syntax is required in the nginx configuration).

nginx could use the function

 int sd_listen_fds_with_names(int unset_environment,
                                    char*** names);

to extract the fd-names from the environment variable LISTEN_FDNAMES
(reference:
​https://man7.org/linux/man-pages/man3/sd_listen_fds.3.html )

Copy-paste from the description of the systemd directive OpenFile in the systemd.service man page ​https://www.freedesktop.org/software/systemd/man/systemd.service.html#OpenFile=

Takes an argument of the form "path[:fd-name:options]", where:

"path" is a path to a file or an AF_UNIX socket in the file system;
"fd-name" is a name that will be associated with the file descriptor; the name may contain any ASCII character, but must exclude control characters and ":", and must be at most 255 characters in length; it is optional and, if not provided, defaults to the file name;

[erik.sjolund@…]

I forgot to mention that the systemd socket unit configuration

Accept=no

should be used. That means that nginx will be calling accept().
(reference:
​https://www.freedesktop.org/software/systemd/man/systemd.socket.html#Accept=
)

[erik.sjolund@…]

Note there can be multiple simultaneous requests to the upstream. How do you expect this to be handled with a single file descriptor?

Ok, now I see your point. This feature request will not work. Sorry for the noise.

[Maxim Dounin]

Thanks for confirming, closing this.