Messages

Yes, we are using acme-challenge.

I'm still having the same issue on 25.7.3. After booting, it looks like lighttpd is not creating these sockets:

Code Select Expand

root@opnsense:~ # sockstat | grep /var/lib/php/tmp/php-fastcgi.socket-
root     php-cgi    96915 0   stream /var/lib/php/tmp/php-fastcgi.socket-0
root     php-cgi    96461 0   stream /var/lib/php/tmp/php-fastcgi.socket-0
root     php-cgi    95886 0   stream /var/lib/php/tmp/php-fastcgi.socket-0
root     php-cgi    95568 0   stream /var/lib/php/tmp/php-fastcgi.socket-0
root     php-cgi    95045 0   stream /var/lib/php/tmp/php-fastcgi.socket-0
root     php-cgi    92984 0   stream /var/lib/php/tmp/php-fastcgi.socket-0
root     php-cgi    66399 0   stream /var/lib/php/tmp/php-fastcgi.socket-3
root     php-cgi    65970 0   stream /var/lib/php/tmp/php-fastcgi.socket-3
root     php-cgi    65465 0   stream /var/lib/php/tmp/php-fastcgi.socket-3
root     php-cgi    64972 0   stream /var/lib/php/tmp/php-fastcgi.socket-3
root     php-cgi    64305 0   stream /var/lib/php/tmp/php-fastcgi.socket-3
root     php-cgi    63720 0   stream /var/lib/php/tmp/php-fastcgi.socket-3
root     php-cgi    52184 0   stream /var/lib/php/tmp/php-fastcgi.socket-2
root     php-cgi    51868 0   stream /var/lib/php/tmp/php-fastcgi.socket-2
root     php-cgi    51428 0   stream /var/lib/php/tmp/php-fastcgi.socket-2
root     php-cgi    51386 0   stream /var/lib/php/tmp/php-fastcgi.socket-2
root     php-cgi    51195 0   stream /var/lib/php/tmp/php-fastcgi.socket-2
root     php-cgi    50723 0   stream /var/lib/php/tmp/php-fastcgi.socket-2
root     php-cgi    10796 0   stream /var/lib/php/tmp/php-fastcgi.socket-4
root     php-cgi    10502 0   stream /var/lib/php/tmp/php-fastcgi.socket-4
root     php-cgi    10336 0   stream /var/lib/php/tmp/php-fastcgi.socket-4
root     php-cgi     9756 0   stream /var/lib/php/tmp/php-fastcgi.socket-4
root     php-cgi     9508 0   stream /var/lib/php/tmp/php-fastcgi.socket-4
root     php-cgi     8480 0   stream /var/lib/php/tmp/php-fastcgi.socket-4


I've managed to get lighttpd to work temporarily if I comment the following line from /var/etc/lighttpd-api-dispatcher.conf

server.username = "wwwonly"


I seems like the user wwwonly cannot access the fastcgi sockets.

Hi,

I'm having exactly the same issue since upgrading to 25.7.1. The lighttpd instance for the api dispatcher will not run and this will be in /var/log/lighttpd/latest.log:

<29>1 2025-08-15T09:48:26+10:00 <omitted> lighttpd 33291 - [meta sequenceId="16"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.79/src/server.c.1974) server started (lighttpd/1.4.79)
<27>1 2025-08-15T09:48:26+10:00 <omitted> lighttpd 33291 - [meta sequenceId="17"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.79/src/gw_backend.c.533) connect() /var/lib/php/tmp/php-fastcgi-cp.socket-0: Permission denied
<27>1 2025-08-15T09:48:26+10:00 <omitted> lighttpd 33291 - [meta sequenceId="18"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.79/src/gw_backend.c.568) bind() unix:/var/lib/php/tmp/php-fastcgi-cp.socket-0: Permission denied
<27>1 2025-08-15T09:48:26+10:00 <omitted> lighttpd 33291 - [meta sequenceId="19"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.79/src/gw_backend.c.1712) [ERROR]: spawning gw failed.
<27>1 2025-08-15T09:48:26+10:00 <omitted> lighttpd 33291 - [meta sequenceId="20"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.79/src/server.c.1978) Configuration of plugins failed. Going down.


# grep wwwonly /etc/group /etc/master.passwd
/etc/group:wwwonly:*:789:
/etc/master.passwd:wwwonly:*:789:789::0:0:World Wide Web Only:/nonexistent:/usr/sbin/nologin

I have a single WAN public IP which is set as the CARP VIP address in a 2-member cluster. The WAN interface on both members has a private IP of 10.0.1.1 and 10.0.1.2 respectively. CARP seems to be set up and working fine, but I have to disable gateway monitoring for the WAN.

I assume dpinger which is used for gateway monitoring is sending pings using the WAN interface private IP instead of the VIP which would explain why this is failing. Is there any way to get dpinger to send from the VIP address instead? Is this a known issue?

Thanks,
Sam