Recipies not rechable 502

[Scifire]

Issue

Hello,

since my last update (unfortunately I can´t say from which version I updated exactly but it was somehtign 2.3.X) I can´t reach my recipies anymore, always get a 502 Bad Gateway.

The last time I updated I followed the changes for 2.3 and didn´t encounter any issues.

Would appreciate if anyone could help me to figure out whats the issue.

Tandoor Version

2.3.6

OS Version

Ubuntu 22.04

Setup

Docker / Docker-Compose

Reverse Proxy

Others (please state below)

Other

apache

Environment file

# only set this to true when testing/debugging
# when unset: 1 (true) - dont unset this, just for development
DEBUG=0
SQL_DEBUG=0

# hosts the application can run under e.g. recipes.mydomain.com,cooking.mydomain.com,...
#ALLOWED_HOSTS=*

# random secret key, use for example `base64 /dev/urandom | head -c50` to generate one
# ---------------------------- REQUIRED -------------------------
SECRET_KEY=mysecret
# ---------------------------------------------------------------

# your default timezone See https://timezonedb.com/time-zones for a list of timezones
TZ=Europe/Berlin

# add only a database password if you want to run with the default postgres, otherwise change settings accordingly
DB_ENGINE=django.db.backends.postgresql
# DB_OPTIONS= {} # e.g. {"sslmode":"require"} to enable ssl
POSTGRES_HOST=db_recipes
POSTGRES_PORT=5432
POSTGRES_USER=djangouser
# ---------------------------- REQUIRED -------------------------
POSTGRES_PASSWORD=mypassword
# ---------------------------------------------------------------
POSTGRES_DB=djangodb

Docker-Compose file

services:
  db_recipes:
    restart: always
    image: postgres:16-alpine
    volumes:
      - ./postgresql:/var/lib/postgresql/data
    env_file:
      - ./.env

  web_recipes:
    image: vabene1111/recipes:latest
    restart: always
    ports:
      - 127.0.0.1:8080:80
    env_file:
      - ./.env
    volumes:
      - staticfiles:/opt/recipes/staticfiles
      - ./mediafiles:/opt/recipes/mediafiles
    depends_on:
      - db_recipes


volumes:
   staticfiles:

Relevant logs

web_recipes-1  |
web_recipes-1  | 789 static files copied to '/opt/recipes/staticfiles', 2153 post-processed.
web_recipes-1  | Done
web_recipes-1  | Starting gunicorn
web_recipes-1  | [2025-12-05 14:20:37 +0000] [7] [INFO] Starting gunicorn 23.0.0
web_recipes-1  | [2025-12-05 14:20:37 +0000] [7] [INFO] Listening at: unix:/run/tandoor.sock (7)
web_recipes-1  | [2025-12-05 14:20:37 +0000] [7] [INFO] Using worker: gthread
web_recipes-1  | [2025-12-05 14:20:37 +0000] [27] [INFO] Booting worker with pid: 27
web_recipes-1  | [2025-12-05 14:20:37 +0000] [28] [INFO] Booting worker with pid: 28
web_recipes-1  | [2025-12-05 14:20:37 +0000] [29] [INFO] Booting worker with pid: 29
web_recipes-1  | Running django-vite in production mode (no HMR)
web_recipes-1  | Running django-vite in production mode (no HMR)
web_recipes-1  | Running django-vite in production mode (no HMR)
web_recipes-1  | 172.18.0.1 - - [05/Dec/2025:14:21:18 +0000] "GET / HTTP/1.1" 502 150 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0" "**.**.1.184"
web_recipes-1  | 2025/12/05 14:21:18 [crit] 14#14: *1 connect() to unix:/run/tandoor.sock failed (13: Permission denied) while connecting to upstream, client: 172.18.0.1, server: localhost, request: "GET / HTTP/1.1", upstream: "http://unix:/run/tandoor.sock:/", host: "recipes.*****.de"
web_recipes-1  | 172.18.0.1 - - [05/Dec/2025:14:21:19 +0000] "GET /service-worker.js HTTP/1.1" 200 41059 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0" "**.**.1.184"
web_recipes-1  | 172.18.0.1 - - [05/Dec/2025:14:21:19 +0000] "GET /assets/404Page-B75T1NWZ.js HTTP/1.1" 502 150 "https://recipes.*****.de/service-worker.js" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0" "**.**.1.184"
web_recipes-1  | 2025/12/05 14:21:19 [crit] 14#14: *1 connect() to unix:/run/tandoor.sock failed (13: Permission denied) while connecting to upstream, client: 172.18.0.1, server: localhost, request: "GET /assets/404Page-B75T1NWZ.js HTTP/1.1", upstream: "http://unix:/run/tandoor.sock:/assets/404Page-B75T1NWZ.js", host: "recipes.*****.de", referrer: "https://recipes.*****.de/service-worker.js"
web_recipes-1  | 2025/12/05 14:21:19 [crit] 14#14: *1 connect() to unix:/run/tandoor.sock failed (13: Permission denied) while connecting to upstream, client: 172.18.0.1, server: localhost, request: "GET /offline/ HTTP/1.1", upstream: "http://unix:/run/tandoor.sock:/offline/", host: "recipes.*****.de", referrer: "https://recipes.*****.de/service-worker.js"
web_recipes-1  | 172.18.0.1 - - [05/Dec/2025:14:21:19 +0000] "GET /offline/ HTTP/1.1" 502 150 "https://recipes.*****.de/service-worker.js" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0" "**.**.1.184"

[Scifire]

I checked inside the container the permissions of /run/tandoor.sock and it has the following permissions srwxr-x--- 1 root root
when changing this to srwxrwxrwx 1 root root it is working again.

I´m not sure if thats really the solution and if yes how I mixed that up.

For reference:

/opt/recipes # ps -e
PID   USER     TIME  COMMAND
    1 root      0:20 /sbin/tini -- /opt/recipes/boot.sh
    7 root      1:50 {gunicorn} /opt/recipes/venv/bin/python /opt/recipes/venv/bin/gunicorn --bind unix:/run/tandoor.sock --workers 3 --threads 2 --timeout 30 --access-logfile - --error-logfile - --log-level 'info' recipes.
   11 root      0:00 nginx: master process nginx
   12 nginx     0:00 nginx: worker process
   13 nginx     0:00 nginx: worker process
   27 root      2:02 {gunicorn} /opt/recipes/venv/bin/python /opt/recipes/venv/bin/gunicorn --bind unix:/run/tandoor.sock --workers 3 --threads 2 --timeout 30 --access-logfile - --error-logfile - --log-level 'info' recipes.
   28 root      2:04 {gunicorn} /opt/recipes/venv/bin/python /opt/recipes/venv/bin/gunicorn --bind unix:/run/tandoor.sock --workers 3 --threads 2 --timeout 30 --access-logfile - --error-logfile - --log-level 'info' recipes.
   29 root      2:03 {gunicorn} /opt/recipes/venv/bin/python /opt/recipes/venv/bin/gunicorn --bind unix:/run/tandoor.sock --workers 3 --threads 2 --timeout 30 --access-logfile - --error-logfile - --log-level 'info' recipes.
   40 root      0:00 sh
   58 root      0:00 ps -e

Would be great if someone could confirm how the permissions should be set or under which user/group the service should run.