What are the correct permissions for the files and directories of a web project?

Question

linux

Hello.
There is a server on Linux (nginx + php5-fpm) with a web project. In general, there are folders with the project code, a web folder with the front controller and resources, folders with files uploaded by users, as well as a folder with logs and cache.
Tell me, please, what rights to which folders / files should be and which user? For nginx, the www user is registered in the config, but now nginx is launched as root, and therefore even files from the web folder with disabled read permissions are opened in the browser, how to fix this problem?

Answer 1

For nginx, the www user is registered in the config, but now nginx is launched from under the root,

1. Why was it necessary to change the default user, www was created?
2. How do you think nignx should start? I recommend reading . Also pay attention to the master process and worker process
3. I hope that there was a smart approach to setting up php5-fpm and therefore a separate pool was created for each domain. Well, in the pool, php5-fpm requires a valid user and group for the document root.
4. Summing up, the permissions for folders are 755, for files - 644, owner user:group
hint:
find /var/www/vhosts/myperfectwebsite.com -type d -exec chmod 0755 {} \;
find /var/www/vhosts/myperfectwebsite.com -type f -exec chmod 0644 {} \;
tip: this topic is very important, so it is worth spending 2-4 hours on it.

Answer 2

Run nginx under www (or www-data, whatever).
The whole /var/www I have 664 for files, 775 for folders, owner www-data:www-data.
My ssh user is in the www-data group.

Answer 3

The most correct (armored) practice seems to be the creation of two users for the project: for deployment and for server operation. Putting them in the same group.
Setting rights to most (if possible all) project files - 644.
Setting rights to most (probably not all here) project directories - 755.
For those files / directories where the server should be able to write (logs, cache, etc. .) - 664 and 775, respectively.
Owner for everything not created by the server: user_for_deploy:general_group .