title: Deploying Flask app with Gunicorn and Nginx on CentOS7 results in 502 Error
body: <p>I am trying to deploy a flask application called <em>pytimesheets</em> on a CentOS7 VM using Gunicorn and Nginx. I was basically following <a href="https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-gunicorn-and-nginx-on-centos-7" rel="nofollow">this tutorial</a> with some minor changes.</p>
  
  <p>When I start the application with <code>gunicorn --bind 0.0.0.0:8080 wsgi:app</code> (without using Nginx) it works, but that's not the way I want it to run.</p>
  
  <p>So I created a <strong>systemd service unit file</strong> /etc/systemd/system/pytimesheets.service:</p>
  
  <pre><code>[Unit]
  Description=Gunicorn instance to serve pytimesheets
  After=network.target
  
  [Service]
  User=centos
  Group=nginx
  WorkingDirectory=/home/centos/pytimesheets/pytimesheets
  Environment="PATH=/home/centos/miniconda/envs/pytimesheets-dev/bin"
  ExecStart=/home/centos/miniconda/envs/pytimesheets-dev/bin/gunicorn --workers 3 --bind unix:pytimesheets.sock -m 007 wsgi:app
  
  [Install]
  WantedBy=mulit-user.target
  </code></pre>
  
  <p>Started and enabled the gunicorn service - worked!</p>
  
  <p>Next, I configured <strong>Nginx</strong>:</p>
  
  <pre><code>user nginx;
  worker_processes auto;
  error_log /var/log/nginx/error.log;
  pid /run/nginx.pid;
  
  events {
      worker_connections 1024;
  }
  
  http {
      log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for"';
  
      access_log  /var/log/nginx/access.log  main;
  
      sendfile            on;
      tcp_nopush          on;
      tcp_nodelay         on;
      keepalive_timeout   65;
      types_hash_max_size 2048;
  
      include             /etc/nginx/mime.types;
      default_type        application/octet-stream;
  
      # Load modular configuration files from the /etc/nginx/conf.d directory.
      # See http://nginx.org/en/docs/ngx_core_module.html#include
      # for more information.
      include /etc/nginx/conf.d/*.conf;
  
      server {
          listen 8080;
          server_name my.servername.com;
  
          location / {
              proxy_set_header HOST $http_host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
              proxy_pass http://unix:/home/centos/pytimesheets/pytimesheets/pytimesheets.sock;
          }
      }
  
  
      server {
          listen       80 default_server;
          listen       [::]:80 default_server;
          server_name  _;
          root         /usr/share/nginx/html;
  
          # Load configuration files for the default server block.
          include /etc/nginx/default.d/*.conf;
  
          location / {
          }
  
          error_page 404 /404.html;
              location = /40x.html {
          }
  
          error_page 500 502 503 504 /50x.html;
              location = /50x.html {
          }
      }
  }
  </code></pre>
  
  <p>I added the user nginx to my usergroup (centos, has sudo privileges) <code>sudo usermod -a -G user nginx</code> and gave it execute permissions in my home directory <code>chmod 710 /home/centos</code></p>
  
  <p>Finally, I started nginx, but all I get when I visit the site is a <strong>502 Bad Gateway Error.</strong></p>
  
  <p>The Nginx error log shows me this:</p>
  
  <pre><code>2016/07/06 13:33:44 [crit] 17464#0: 
  *1 connect() to unix:/home/centos/pytimesheets/pytimesheets/pytimesheets.sock 
  failed (13: Permission denied) while connecting to upstream, 
  client: 10.250.16.87, server: my.servername.com, 
  request: "GET / HTTP/1.1", 
  upstream: "http://unix:/home/centos/pytimesheets/pytimesheets/pytimesheets.sock:/", 
  host: "my.servername.com"
  </code></pre>
  
  <p>The sock file is created once I start the pytimesheets service, and the location <code>/home/centos/pytimesheets/pytimesheets/pytimesheets.sock</code> may look weird, but it's correct.</p>
  
  <p>My guess is that there is something messed up with the user rights.
  Does anybody have an idea what I did wrong?</p>
  
  <p><strong>Update</strong></p>
  
  <p>I was able to run the application after setting <code>setenforce = Permissive</code>. However, I don't know if this is a permament solution.</p>