Usually I setup my Ubuntu server to have at least 2 users:
- A user behalf which the web server (Apache or Nginx) runs, e.g.
www-data
in groupwww-data
- A user that updates and maintains the web applications, e.g.
deployer
in groupsdeployer
andwww-data
A web application consists of 2 directories:
- A directory for executable files (e.g. PHP or JS) served by the web server (Apache or Nginx) and a code interpreter, e.g.
app
- A directory for the application to write (caches, logs, uploads, etc.), e.g.
storage
I setup the directories with the following permissions:
├ app rwxrwxr-x deployer:deployer
│ └ index.php rwxrwxr-x deployer:deployer
└ storage rwxrwxr-x www-data:www-data
├ logs rwxrwxr-x www-data:www-data
└ cache rwxrwxr-x www-data:www-data
The problem is that it's inconvenient to maintain the web application because it writes the files to storage
with the default permission and therefore deployer
can't write them. And vise versa, deployer
can leave files in storage
that are not writable by the application. An example of what happens after a while:
├ app rwxrwxr-x deployer:deployer
│ └ index.php rwxrwxr-x deployer:deployer
└ storage rwxrwxr-x www-data:www-data
├ logs rwxrwxr-x www-data:www-data
│ └ applogs.log rw-r--r-- www-data:www-data # Deployer can't write
└ cache rwxrwxr-x www-data:www-data
└ somecache.json rw-r--r-- deployer:deployer # Application can't write
I can't make the application write files with other group or mode. I have to make some complex sudo setup and watch carefully the files created by deployer
to maintain the application and keep it running.
Does the application self-write restriction worth the inconveniences? Is it ok (considering security concerns) to run the web server and maintain the application using a single user that can write the files both in the app
and storage
directories?