I'm running a shared hosting server with nginx and php-fpm on Debian.
Everything works fine, php-fpm has separate pools for each users running as separate users and they each have their own socks.
Nginx is however running as www-data because I don't want to have separate nginx processes for each user.
This means that in order for nginx to have access to the users data, the permissions of /home have to be drwxr-x--x. The problem is, all users have access to other users files.
What would be the best way to give nginx access to the users files without giving other users access. Running nginx as root is not an option. But would AppArmor help?