Saturday, February 19, 2022

[SOLVED] Laravel Continuous Integration with Gitlab-runner in offline environment (CentOS 7)

Issue

I'm developing a website on a totally offline environment. also, I use gitlab runner for CI and the host is CentOS 7.

the problem is that gitlab runner uses gitlab-runner user on centos for deploying laravel application and apache uses apache user for running laravel. I got Permission denied error on apache til I changed ownership of files. after that I get this error on apache log:

Uncaught UnexpectedValueException: The stream or file "storage/logs/laravel.log" could not be opened: failed to open stream: Permission denied

it seems that some vendor libraries like monolog want to write error or debug logs onto storage/logs/laravel.log but it gets permission denied. :(

.gitlab-ci.yml

stages:
  - build
  - test
  - deploy

buildBash:
  stage: build
  script:
    - bash build.sh

testBash:
  stage: test
  script:
    - bash test.sh

deployBash:
  stage: deploy
  script:
    - sudo bash deploy.sh

build.sh

#!/bin/bash

set -xe

# creating env file from production file
cp .env.production .env

# initializing laravel
php artisan key:generate
php artisan config:cache

# database migration
php artisan migrate --force

deploy.sh

#!/bin/bash

PWD=$(pwd)'/public'
STG=$(pwd)'/storage'

ln -s $PWD /var/www/html/public
chown apache.apache -R /var/www/html/public
chmod -R 755 /var/www/html/public
chmod -R 775 $STG

Am I using gitlab runner correct? how can I fix the permission denied error?


Solution

SELinux

I found the problem and it was selinux, like always it was selinux and I ignored it at the begining

What's the problem:

you can see selinux context on files with ls -lZ command, by default all files on www are httpd_sys_content_t, the problem is that selinux just allow apache to read these files. you should change storage and bootstrap/cache context so it can be writable.

there are 4 apache context type:

  • httpd_sys_content_t: read-only directories and files
  • httpd_sys_rw_content_t: readable and writable directories and files used by Apache
  • httpd_log_t: used by Apache for log files and directories
  • httpd_cache_t: used by Apache for cache files and directories

What to do:

first of all install policycoreutils-python for better commands

yum install -y policycoreutils-python

after installing policycoreutils-python the semanage command is available, so you can change file context like this:

semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/laravel/storage(/.*)?" semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/laravel/bootstrap/cache(/.*)?"

don't forget to commit the changes by this command:

restorecon -Rv /var/www/html/laravel/storage restorecon -Rv /var/www/html/laravel/bootstrap/cache

the problem is solved :)

ref: http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/



Answered By - Alireza
Answer Checked By - David Marino (WPSolving Volunteer)
at