CentOS 7 server used for shared hosting. No chroot. 99% WordPress installs.

Every user gets a /home/someuser skeleton including ~/web where all web-accessible files reside. All dirs below and including web are chmod-ed 0750, all files are 0640. Every user gets a php-fpm instance running as someuser:someuser. Nginx user nginx is added to the someuser group on creation. Files and dirs are owned by someuser:someuser. PHP/WordPress are happy with this, nginx doesn't have any problem serving stuff. Many years working fine.

Now I have a "dirty" (as in messy) image bank that I don't want to just copy over to the web tree. My plan is to set up an internal nginx server{} with that dir as root to serve those images on demand and I want the main nginx server{} to use proxy_store to save only the requested images on the web tree.

I can't get nginx to write under ~/web. I tried chmod-ing everything from ~/web on to 0760 to no avail. I also tried recreating the directory structure in the target dir, but it still doesn't write the files.

Should I relax permissions further up in the directory chain? I don't like the idea that much. Is there something I'm missing? I have it working in other setups where the nginx user is the owner of the tree where it writes.


server {
   listen 8080;
   server_name blah.com;
   location / {
      root /home/someuser/messydir;
server {
   root /home/someuser/web;
# lots of lines
   location /images {
      error_page 404 = @fetch;
      expires 7d;
   location @fetch {
      proxy_set_header Host blah.com;
      proxy_pass         http://localhost:8080;
      proxy_store        on;
      proxy_store_access user:rw group:r;
      root "/home/someuser/web/images";

Solved! I got an answer on a different forum.

For this particular issue to work correctly, the directory chain including "images" needs to have eXecute permissions (navigate or cd in case of directories) and the images dir where nginx writes needs Write permissions too. So the images directory needs to be set to 0770 in my setup, and all directories above it should be set at 0750.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.