I'm primarily trying to set permissions inside of /var/www . We are using a project format which has the following structure in common for each project:
- Web server (nginx) is the primary owner of all directories
- /shared directory essentially contains libraries / library code which any application may use.
- /application is started up by a file in the root of any project directory (e,g site.com)
- /static has sub directories, usually /img, /css, /js, /feed . These may not execute.
- /service contains web/system services which run directly (subdomain bypasses root file)
- /support contains files which are loaded only by the application, but should never be served. (classes, templates, etc)
I'm able to get this working fair enough, but I am fairly sure I'm not doing so properly. Way too many 755s; and I have poor understanding of sticky bits which I'm about to google deeper.
On the development servers the bulk is meant to be owned by nginx:dev, where nginx is also in the dev group. on staging this is nginx:admin, on productions it is nginx:appupdater
My main goal today is that I'd like for the devs group to have the ability to create and edit any of the files within a project directory (project.com, site.com,...) while the /shared directory should only be updated manually very infrequently.
For one thing, I'd want to set permissions such that new files will be owned by nginx:devs and developers can freely upload and alter them on the dev server. I'm trying to get permissions best at denyomg access wherever possible while allowing apps running (as nginx) to load files from support and application directories. The only exception is a need for writing in /static/upload and a folder in /support/generated
How can I secure this permission-wise so that that we can still run apps, allow developers to access and create files without overriding the owner:group, and generally not shoot myself in foot if a user uploads executables?
(aside from app/server checking for me)