Best practices for unix socket

[ghost]

Hello community,

I have installed anubis via native package on debian. When using the default value for unix socket bind BIND=/run/anubis/instance.sock there are two problems:

1. The directory "anubis" under "run" does not exist
2. When i create it manually there are permissions problems (sockets user is "anubis" and it can not create a socket under "run")
3. The socket itself is "rwxrwx---" so nginx for example is not able to use this socket

What is the best way to solve this?

Regards

[thess]

Maybe not as intended, but his is how I got multiple sites running. I made a couple of changes to the default environment setup for standalone instances of Anubis using systemd. Instead of running as a dynamic user (Remove DynamicUser and LimitNOFILE settings), I specify the User= to be either the same as I run Nginx. If using an Anubis user, Nginx and Anubis should be in the same group. I then created /var/run/anubis and set the 'owner:group' appropriately - Both Nginx and Anubis will need write access to it. If using same user, then 0755 is sufficient.

The Anubis environment (<server-name>.env) is then: [Substitute the instance name of your choice for <server-name>]

BIND=/run/anubis/<server-name>-anubis.sock
BIND_NETWORK=unix
SOCKET_MODE=0660
TARGET=unix:///run/<server-name>-nginx.sock

The Nginx config looks like this:

...
real_ip_header X-Forwarded-For;

location / {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://<server-name>-anubis;
  }

upstream <server-name>-anubis {
  server unix:/run/anubis/<server-name>-anubis.sock;
}

server {
  listen unix:/run/<server-name>-nginx.sock;
...

HTH

[PandorasFox]

Seconding this: my ideal usecase is something approximating this:

services:
  caddy:
    container_name: caddy
    image: caddy:2
    network_mode: "host"
    volumes:
      - $PWD/caddy/config:/etc/caddy
      - caddy_config:/config
      - caddy_data:/data
      - anubis_sock:/run/anubis

  anubis:
    container_name: anubis
    image: ghcr.io/techarohq/anubis:latest
    pull_policy: always
    environment:
      BIND_NETWORK: "unix"
      BIND: "/run/anubis/sock"
      TARGET: "backend : ) "
      XFF_STRIP_PRIVATE: false
      POLICY_FNAME: "/data/cfg/policy.yaml"
    volumes:
      - $PWD/anubis:/data/cfg
      - anubis_sock:/run/anubis
volumes:
  anubis_sock:
  caddy_data:
  caddy_config:

However, anubis fails on this:

anubis  | {"time":"2025-07-19T21:10:14.305648621Z","level":"INFO","msg":"failed to bind to unix:/var/run/anubis.sock: listen unix /var/run/anubis.sock: bind: permission denied"}

The additional annoyance here is that I need to put the caddy container into host network mode so that the IPs in the forwarded headers are actually accurate, instead of being the docker virt bridge interface IPs. But doing that then makes the caddy container trivially able to DNS the requests over to the anubis container - so sharing a socket via a volume is the straightforward solution here, except also there's permissions errors abound here.

I figure there's probably a concise solution here that I'm missing (maybe just binding /run/ to a 1000:1000 0777 volume?)

[PandorasFox]

oh, wait, this might be SELinux on the load balancer. oops. f$!#

[PandorasFox]

Alright, SELinux off has made the debugging here clearer. Now, not mounting a volume to /run results in no such file or directory (silly), and the following still results in permission denied:

anubis:
    container_name: anubis
    image: ghcr.io/techarohq/anubis:latest
    pull_policy: always
    environment:
      BIND_NETWORK: "unix"
      BIND: "/run/anubis/anubis.sock"
      TARGET: "backend"
      XFF_STRIP_PRIVATE: false
      POLICY_FNAME: "/data/cfg/policy.yaml"
    volumes:
      - $PWD/anubis:/data/cfg
      - anubis_sock:/run/anubis:mode=777,uid=1000,gid=1000

adding user: root does fix the issue, so...... yeehaw tbh