Add permission error when user cannot write to /etc/nginx folder

nginx_config_reloader/__init__.py

@@ -30,6 +30,7 @@
     MAGENTO1_CONF,
     MAGENTO2_CONF,
     MAGENTO_CONF,
+    MAIN_CONFIG_DIR,
     NGINX,
     NGINX_PID_FILE,
     UNPRIVILEGED_GID,
@@ -133,6 +134,9 @@ def install_magento_config(self):
         # Move temporary symlink to actual location, overwriting existing link or file
         os.rename(MAGENTO_CONF_NEW, MAGENTO_CONF)
 
+    def check_can_write_to_main_config_dir(self):
+        return os.access(MAIN_CONFIG_DIR, os.W_OK)
+
     def check_no_forbidden_config_directives_are_present(self):
         """
         Loop over the :FORBIDDEN_CONFIG_REGEX: to check if nginx config directory contains forbidden configuration
@@ -197,6 +201,12 @@ def _apply(self):
         if self.check_no_forbidden_config_directives_are_present():
             return False
 
+        if not self.check_can_write_to_main_config_dir():
+            self.logger.error(
+                "No write permissions to main nginx config directory, please check your permissions."
+            )
+            return False
+
         if not self.no_magento_config:
             try:
                 self.install_magento_config()

tests/test_nginx_config_reloader.py

@@ -26,10 +26,12 @@ def setUp(self):
         self.source = mkdtemp()
         self.dest = mkdtemp()
         self.backup = mkdtemp()
+        self.main = mkdtemp()
         _, self.mag_conf = mkstemp(text=True)
         _, self.mag1_conf = mkstemp(text=True)
         _, self.mag2_conf = mkstemp(text=True)
 
+        nginx_config_reloader.MAIN_CONFIG_DIR = self.main
         nginx_config_reloader.DIR_TO_WATCH = self.source
         nginx_config_reloader.CUSTOM_CONFIG_DIR = self.dest
         nginx_config_reloader.BACKUP_CONFIG_DIR = self.backup
@@ -49,6 +51,7 @@ def tearDown(self):
         shutil.rmtree(self.source, ignore_errors=True)
         shutil.rmtree(self.dest, ignore_errors=True)
         shutil.rmtree(self.backup, ignore_errors=True)
+        shutil.rmtree(self.main, ignore_errors=True)
         for f in [self.mag_conf, self.mag1_conf, self.mag2_conf]:
             try:
                 os.unlink(f)
@@ -646,6 +649,17 @@ def test_permissions_are_masked_for_file_in_subdir(self):
             & stat.S_IXOTH
         )
 
+    def test_no_permission_to_main_config_dir(self):
+        os.chmod(self.main, 0o400)  # Read-only
+
+        tm = self._get_nginx_config_reloader_instance()
+        try:
+            result = tm.check_can_write_to_main_config_dir()
+            self.assertFalse(result)
+        finally:
+            # Restore permissions after test
+            os.chmod(self.main, 0o700)
+
     def _get_nginx_config_reloader_instance(
         self,
         no_magento_config=False,