Can't open PID file /run/nginx.pid (yet?

Question

Nginx

Hello colleagues!
I ask for hints.

There is a debian 11 system. The nginx mainline 1.21.5 package is delivered from the official turnip.
Nginx runs as user www-data. The virtualhost is configured. The service is starting, but the PID file is in some trouble.
It is located here /run/nginx.pid - when the service starts, it is created, but it doesn't "go" anywhere else.

If I run the command
systemctl status nginx

I get this output:

Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2022-01-03 23:49:05 +07; 7min ago
       Docs: https://nginx.org/en/docs/
    Process: 17804 ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf (code=exited, status=0/SUCCESS)
   Main PID: 17805 (nginx)
      Tasks: 2 (limit: 2353)
     Memory: 1.6M
        CPU: 15ms
     CGroup: /system.slice/nginx.service
             ├─17805 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
             └─17806 nginx: worker process

Jan 03 23:49:05 cloud systemd[1]: Starting nginx - high performance web server...
Jan 03 23:49:05 cloud systemd[1]: nginx.service: Can't open PID file /run/nginx.pid (yet?) after start: Operation not permitted
Jan 03 23:49:05 cloud systemd[1]: Started nginx - high performance web server.

I think this is the infection Can't open PID file /run/nginx.pid (yet?) after start: Operation not permitted
I look at the output of the program ss -tulnp- nginx is not listening to anything.

I thought maybe it's in apparmor - no. Turned it off - same thing. Turned it on, created profiles for nginx - the same nonsense.

I read a bunch of articles about moving the pid file to another location - it does not help.

The PID file is read by the NGINX parent process, so it should 100% have access to it. Yes, it is created and destroyed when the process is restarted, and in the status it shows:

Can't open PID file /run/nginx.pid (yet?) after start: Operation not permitted

Did even so:

Who faced it? How did you decide?

Answer 1

If you /lib/systemd/system/nginx.service
add this:

ExecStartPost=/bin/sh -c 'umask 022; pgrep nginx > /var/run/nginx.pid'

then the error disappears.
BUT! The server does not listen to either 80: or 443 port ... Again, determined using the programss -tulnp