The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web application files, some users chown those files to the user www-data.
I have recently read a good argument that states one should never give www-data write access to web application files but rather read and execute rights through being part of a group. I believe that would be the most secure set up I've seen but I'd love to know if anyone has better strategies.
What is the most secure way to configure the user permissions for a web application?
And as a bonus (without leaving the topic of the server itself), what other related configuration tips can you give to securing a web server beyond what you might get from the repos?