Shiny Server配置咨询：无sudo权限服务账户部署应用及日志访问配置优化

Hey there! Let's work through your Shiny Server setup step by step. First, let's recap your core requirements to make sure we hit every point:

• Keep your existing root-level apps (accessible via http://<ip.address>:3838/appName) completely unaffected
• Let a non-sudo service account (already in the shinyUsers group) deploy their own apps
• Let that service account view their app logs without sudo
• Clear up confusion around site_dir and log_dir

First: Fix the Conflicting Location Blocks #

Your current config has two identical location / blocks, which is a problem. Shiny Server uses Nginx-style prioritization, so the second block would overwrite the first—meaning your user_dirs settings were never being applied. Let's split these into separate, non-conflicting locations to keep root apps and user apps isolated.

Modified Working Configuration #

Here's the adjusted config that meets all your needs:

run_as :HOME_USER: shiny;

# Define server listening on port 3838
server {
  listen 3838;

  # Existing root-level apps (unchanged, no impact)
  location / {
    site_dir /srv/shiny-server;
    log_dir /var/log/shiny-server;
    directory_index on;
  }

  # User-specific apps for shinyUsers group
  location /user {
    user_dirs;
    # Restrict to members of shinyUsers group
    members_of shinyUsers;
    directory_index off;
    # Store user app logs in their own home directory (no sudo needed to access)
    log_dir :HOME_DIR:/ShinyApps/logs;
  }
}

Breakdown of Key Changes & Explanations #

• Split Locations: The location / block stays exactly as it was for your root apps—so they'll keep working with no changes. The new location /user block handles all personal user apps.
• run_as :HOME_USER: shiny: This makes sure each user's app runs under their own user account, which is critical for letting your service account access their own files and logs without sudo.
• log_dir :HOME_DIR:/ShinyApps/logs: The :HOME_DIR: variable dynamically maps to each user's home folder. This means your service account's app logs will live in ~/ShinyApps/logs—a directory they own, so they can view logs with simple commands like cat ~/ShinyApps/logs/your-app.log without sudo.
• user_dirs: This setting automatically links each user's ~/ShinyApps folder to the URL path /user/<your-service-username>/your-app-name. So your service account can deploy apps just by dropping their app folder into ~/ShinyApps.

Clarifying site_dir vs log_dir #

Let's clear up the confusion around these two parameters:

• site_dir: Defines the folder where Shiny Server looks for apps in a given location. For root apps, this is the system-wide /srv/shiny-server folder. For user_dirs, it's automatically set to each user's ~/ShinyApps (you don't need to specify it manually here).
• log_dir: Specifies where app logs are stored. For root apps, we use the system-level /var/log/shiny-server (which requires sudo to access). For user apps, we point to a directory in the user's home folder so they can access logs without elevated permissions.

Next Steps to Deploy & Test #

1. Set Up the Service Account's App Folder:
   Have the service account run these commands in their terminal:

   mkdir -p ~/ShinyApps/logs
   chmod 755 ~/ShinyApps
   

   This creates the required folder structure and ensures Shiny Server can access the apps.

2. Restart Shiny Server:
   You'll need someone with sudo access to restart the service to apply the config changes:

   sudo systemctl restart shiny-server
   

3. Test Deployment:
   The service account can drop their Shiny app folder into ~/ShinyApps, then access it via:
   http://<ip.address>:3838/user/<service-account-username>/your-app-name

4. Verify Log Access:
   The service account can check their logs directly:

   ls ~/ShinyApps/logs
   cat ~/ShinyApps/logs/your-app-name.log
   

Important Notes #

• Your existing root apps will continue to work exactly as before—no changes needed for them.
• Make sure the shiny user has read access to the service account's ~/ShinyApps folder (the chmod 755 step above takes care of this).
• If you'd prefer a different URL path for user apps (instead of /user), you can change the location block to something like /personal—just make sure it doesn't conflict with any existing root app names.

内容的提问来源于stack exchange，提问作者zimia