Oops & Recoveries

🐍 The Time I Added the Flask App on 8081 Too Soon — and NGINX Faceplanted

---

💥 What Happened

While wiring up a reverse proxy for the Flask app on virtca8, I added this to nginx.conf:

location /virtca8/ {
    proxy_pass http://127.0.0.1:8081/;
    include proxy_set_header.conf;
}

But... the Flask app wasn’t running yet.

---

🧨 What Broke

• nginx -t passed ✅
• systemctl restart nginx failed ❌

• Error:

  Job for nginx.service failed because the control process exited with error code.
  

• journalctl -xe revealed:
  • 🔒 SELinux blocked access to cert files (star_fullchain.crt)
  • 🔌 NGINX failed to connect to upstream 127.0.0.1:8081

---

🛠️ What Fixed It

1. Started the Flask app on port 8081 (or confirmed it was up)

2. Restored SELinux labels on certs:

   restorecon -Rv /etc/pki/nginx

3. Restarted nginx cleanly:

   nginx -t && systemctl restart nginx

---

🔍 Lessons Learned

✅ Do This	💬 Why
curl http://127.0.0.1:8081	Confirm Flask app is actually running
Use nginx -t && journalctl -xe	Detect startup issues beyond syntax
restorecon -Rv	SELinux will silently block you otherwise
Don’t wire dead upstreams	NGINX gets angry fast

---

Would you like a second entry for "The SELinux Certificate Label from Hell"? 😄