I haven't been able to find a satisfying answer on Goole or the various Stack forums:
I noticed that files under /var/www (where nginx and I believe Apache are chrooted by default) have permissions mostly of root:daemon or root:bin. This is true of roundcube and I assume other web applications if installed from official packages. The nginx user, www, doesn't appear to be part of either daemon or bin, so files need to have the read flag set for other for them to be served by nginx.
So the question is: should I follow suit in my own applications and make files owned by root:daemon or root:bin as long as they are in the chroot environment? Or is it ok to do what I normally do on other systems and make them www:www?
This is my first question here, so hopefully it's specific enough.