Systemd socket activation support

[AlphaJack]

Hi, I'm enjoying Angie's container image because it comes with popular modules ready to be loaded.
I need socket activation to preserve the source IP address of clients when running Angie in a rootless Podman container , as I need to distinguish between VPN and internet clients.

Nginx supports systemd socket activationby specifying the env variable NGINX=3:4.

However, with Angie this doesn't work, I've tried to set both NGINX=3:4 and ANGIE=3:4.

Was the variable changed or was this feature removed?

[VBart]

There's no such thing as systemd socket activation support in vanilla nginx, nor in Angie. The example by the link tries to misuse the nginx binary upgrade mechanism for that purpose.

The variable was just renamed to ANGIE, nothing else has been changed except fixing some bugs presented in nginx and caused by race conditions during binary upgrade.

[clarfonthey]

Proper socket activation is particularly difficult because angie can listen on any number of sockets and you need to make sure those match up properly.

It would at minimum require calling getsockaddr on all the LISTEN_FDs passed to match them up with the ones angie is required to listen on, and/or maybe configuring some options to specifically listen on LISTEN_FDNAMES.

[eriksjolund]

@AlphaJack The semi colon is missing in the values you show. For details, see

https://github.com/eriksjolund/podman-nginx-socket-activation/blob/447d1f355c3295c5afa515c354066f01cd8ee24e/examples/example7/nginx.container#L7C13-L7C23

The order of the sockets can be adjusted by changing the order of these two lines

https://github.com/eriksjolund/podman-nginx-socket-activation/blob/447d1f355c3295c5afa515c354066f01cd8ee24e/examples/example7/nginx.socket#L5-L6

(and hope it will match the order nginx and angie uses)

The example by the link tries to misuse the nginx binary upgrade mechanism for that purpose.

That's correct.

[VBart]

We're actually thinking about proper support for socket activation in Angie, but no ETA yet.