by OnlyHuman on Thu Mar 31, 2011 6:55 am
([msg=55782]see Re: "no such thing as magic"[/msg])
Speaking of magnets and magic, here's an interesting little trick. You should try configuring lighttpd to use mod_magnet while both the server and the FastCGI backend reside in separate chroot jails. They need to communicate through hard links to named *nix sockets created by spawn_fcgi. And since they're both sitting in a separate chroot jail, there's a matter of file locations, permissions, and ownership, to resolve. Not only does it have to be resolved such that both server, and backend have access to the proper resources, but also in such a way that any intruders won't have access to them unless they can also gain root. It's easy if you place everything inside the same chroot jail, but that won't work if you later need the server on one machine, and the backend on another. Admittedly, that would also require you to switch from named sockets to TCP sockets, which should be an incredibly easy task once all the other issues are solved. But until then, it's a constant uphill battle that's riddled with 500 and 503 errors from a server that's not careful to log as thoroughly as it probably should. Even searching for solutions to the problems I encountered trying to set that up, gave me the impression that google itself was telling me that it's time to switch to NginX. But still, I've seen this type of setup actually functioning, and anybody who can pull that trick off, is magician enough for me. I'll stick with a less difficult implementation.