I have a Ubuntu 10.04 server running nginx with nginx running as user
nginx. I'm trying to deploy an Octopress-based site with rsync and have stumbled on what looks like a security dilemma.
Obviously, the whole
/srv/www/ directory should be readable by user
nginx, and a couple upload directories should be writable by user
Octopress likes connecting to a server via ssh, which is good. Since I have a sinking feeling about giving
nginx remote shell access, I created a special user (
deployer) just for that purpose, who is configured to have shell access and is allowed to connect via ssh. Rsync works fine, but all the web files are copied as owned by
deployer, and user
nginx cannot read them.
I might add user
nginx to group
deployer and play with rsync's
-p options to allow nginx/php to write to upload directories, but I'm not sure it won't bite me later. Ideally I think I need a kind of rsync-then-chown&chmod, but I suspect that's a bit too much to ask.
What are the best practices? How do you go about it?
Thanks in advance.