How to properly set access rights for a web server?

Question

linux

Good afternoon! I'm trying to figure out the right permissions for files and programs.
Now nginx is running as www-data user
php-fpm is running as www-data:www-data 0660
Server files are stored as www-data:users 644
Everything seems to be working. But there is a directory with images. Served via php file_get_contents. And it only works if you set the rights to 744. It does not work with 644. What for here the rights to start when the file should be read and given?
And one more thing: I created a user in the system, and I want the server files to belong to him. A user in the users group. Tried like this: user1:www-data , user1:users - but the server doesn't work. How to do it right? Add user to www-data group? Run nginx/php-fpm as this user?

Answer 1

> php-fpm works from www-data:www-data
is very bad
> How to do it right?
So

Answer 2

Might be worth looking into how permissions work on UNIX systems ?

find /path/to/site.ru -type f -exec chmod 664 {} \;
find /path/to/site.ru -type d -exec chmod 775 {} \;