Nginx-mainline, php-fpm, Git - Permissions user:group & modes

A lot of the currently used uid/gids for apache/nginx/php are a bit of a mess, and changing them might actually break running instances, so we have to be really careful to attempt to fix it.

With php-fpm, it’s the php processes that write to the data folders, and not nginx, so what matters for writable data directories is what uid php-fpm runs as - nginx won’t be writing to those, and it might not even be reading from them either - all nginx does is talk to the php-fpm socket. At least, this is true for wordpress and nextcloud, which is what I use myself.

nginx is configured to use httpd:httpd user id’s just like apache by default:

--user=httpd
--group=httpd

You can change it, but there’s very little value in doing that. By default, it should be able to talk to php-fpm because /run/php-fpm.sock runs with these permissions:

srw-rw---- 1 root httpd 0 Apr  1 18:05 /run/php-fpm.sock

In other words: group httpd can read/write the php-fpm socket, which nginx is part of.

This last permission is defined in /usr/share/defaults/php/php-fpm.d/www.conf:

listen.group = httpd
listen.mode = 0660

Last, php-fpm actually doesn’t run as root, but changes uid to nobody as defined, in the same file, by this:

user = nobody
group = nobody

Now, THIS part is likely the only thing you want to change, since nobody is generally not a good uid to use for writable stuff like this.

[www]
user = www-data
group = www-data

To get php-fpm to use this, I’ve myself made an override unit:

ExecStart=/usr/sbin/php-fpm --nodaemonize --fpm-config /etc/php/php-fpm.conf

Then, in turn, /etc/php/php-fpm.conf contains:

include=/etc/php/php-fpm.conf.d/*.conf

Which then pulls in the [www] override section later.

That last part can be done in 20 different ways - you control any of the paths here, so you can put it anyway you like, really.