Activate a narrow nginx admin listener

$ sudo nginx -t
syntax is ok
test is successful
$ sudo systemctl reload nginx
$ sudo ss -lntp | grep ':8186'
<no output>
$ getenforce
Enforcing
$ sudo tail -n 1 /var/log/nginx/error.log
[emerg] 2417#2417: bind() to 127.0.0.1:8186 failed (13: Permission denied)
$ sudo ausearch -m AVC -ts recent | tail -n 1
type=AVC avc: denied { name_bind } for pid=2417 comm="nginx" src=8186 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0
$ sudo semanage port -l | grep '^http_port_t'
http_port_t tcp 80, 443, 8080

server {
    listen 127.0.0.1:8186;
    server_name admin.northwind.test;
    location = / { return 302 http://127.0.0.1:8186/admin; }
    location / { proxy_pass http://127.0.0.1:9100; }
}

• ›The edge connector and nginx run on the same proxy host; no LAN client needs this listener.
• ›The sign-in flow uses /login and /login/totp, and the owner console is under /admin.
• ›The admin hostname must not provide a second route to games or other public-site features.
• ›Redirects shown to a browser must use the public HTTPS admin hostname and reveal no origin address or listener port.