Add permission error when user cannot write to /etc/nginx folder

nginx_config_reloader/__init__.py

@@ -24,6 +24,7 @@
 from nginx_config_reloader.settings import (
     BACKUP_CONFIG_DIR,
     CUSTOM_CONFIG_DIR,
+    MAIN_CONFIG_DIR,
     DIR_TO_WATCH,
     ERROR_FILE,
     FORBIDDEN_CONFIG_REGEX,
@@ -133,6 +134,9 @@ def install_magento_config(self):
         # Move temporary symlink to actual location, overwriting existing link or file
         os.rename(MAGENTO_CONF_NEW, MAGENTO_CONF)
 
+    def check_can_write_to_main_config_dir(self):
+        return os.access(MAIN_CONFIG_DIR, os.W_OK)
+
     def check_no_forbidden_config_directives_are_present(self):
         """
         Loop over the :FORBIDDEN_CONFIG_REGEX: to check if nginx config directory contains forbidden configuration
@@ -196,6 +200,10 @@ def _apply(self):
         logger.debug("Applying new config")
         if self.check_no_forbidden_config_directives_are_present():
             return False
+
+        if not self.check_can_write_to_main_config_dir():
+            self.logger.error("No write permissions to main nginx config directory, please check your permissions.")
+            return False
 
         if not self.no_magento_config:
             try:

nginx_config_reloader/utils.py

@@ -1,6 +1,6 @@
 import json
 import subprocess
-
+import os
 
 def directory_is_unmounted(path):
     output = subprocess.check_output(

tests/test_nginx_config_reloader.py

@@ -26,10 +26,12 @@ def setUp(self):
         self.source = mkdtemp()
         self.dest = mkdtemp()
         self.backup = mkdtemp()
+        self.main = mkdtemp()
         _, self.mag_conf = mkstemp(text=True)
         _, self.mag1_conf = mkstemp(text=True)
         _, self.mag2_conf = mkstemp(text=True)
 
+        nginx_config_reloader.MAIN_CONFIG_DIR = self.main
         nginx_config_reloader.DIR_TO_WATCH = self.source
         nginx_config_reloader.CUSTOM_CONFIG_DIR = self.dest
         nginx_config_reloader.BACKUP_CONFIG_DIR = self.backup
@@ -49,6 +51,7 @@ def tearDown(self):
         shutil.rmtree(self.source, ignore_errors=True)
         shutil.rmtree(self.dest, ignore_errors=True)
         shutil.rmtree(self.backup, ignore_errors=True)
+        shutil.rmtree(self.main, ignore_errors=True)
         for f in [self.mag_conf, self.mag1_conf, self.mag2_conf]:
             try:
                 os.unlink(f)
@@ -646,6 +649,22 @@ def test_permissions_are_masked_for_file_in_subdir(self):
             & stat.S_IXOTH
         )
 
+    def test_no_permission_to_main_config_dir(self):
+        os.chmod(self.main, 0o400)  # Read-only
+
+        tm = self._get_nginx_config_reloader_instance()
+        try:
+            with self.assertLogs('root', level='ERROR') as cm:
+                result = tm.apply_new_config()
+                self.assertFalse(result)
+                self.assertTrue(
+                    any("No write permissions to main nginx config directory" in message for message in cm.output),
+                    "Expected error message not found in logs."
+                )
+        finally:
+            # Restore permissions after test
+            os.chmod(self.main, 0o700)
+
     def _get_nginx_config_reloader_instance(
         self,
         no_magento_config=False,