A lot of the currently used uid/gids for apache/nginx/php are a bit of a mess, and changing them might actually break running instances, so we have to be really careful to attempt to fix it.
With php-fpm, it’s the php processes that write to the data folders, and not nginx, so what matters for writable data directories is what uid php-fpm runs as - nginx won’t be writing to those, and it might not even be reading from them either - all nginx does is talk to the php-fpm socket. At least, this is true for wordpress and nextcloud, which is what I use myself.
nginx
is configured to use httpd:httpd
user id’s just like apache by default:
--user=httpd
--group=httpd
You can change it, but there’s very little value in doing that. By default, it should be able to talk to php-fpm because /run/php-fpm.sock
runs with these permissions:
srw-rw---- 1 root httpd 0 Apr 1 18:05 /run/php-fpm.sock
In other words: group httpd
can read/write the php-fpm socket, which nginx
is part of.
This last permission is defined in /usr/share/defaults/php/php-fpm.d/www.conf
:
listen.group = httpd
listen.mode = 0660
Last, php-fpm
actually doesn’t run as root, but changes uid to nobody
as defined, in the same file, by this:
user = nobody
group = nobody
Now, THIS part is likely the only thing you want to change, since nobody
is generally not a good uid to use for writable stuff like this.
[www]
user = www-data
group = www-data
To get php-fpm
to use this, I’ve myself made an override unit:
ExecStart=/usr/sbin/php-fpm --nodaemonize --fpm-config /etc/php/php-fpm.conf
Then, in turn, /etc/php/php-fpm.conf
contains:
include=/etc/php/php-fpm.conf.d/*.conf
Which then pulls in the [www]
override section later.
That last part can be done in 20 different ways - you control any of the paths here, so you can put it anyway you like, really.