Sysadmin Confused about file permissions - what are you all actually doing?

File permissions have always been a blind spot for me. I still have old (likely bad) habits when setting up new servers that have probably caused me a lot of headaches over the years.

I create users on my system for each website on my server, for example "site1" and "site2". Then I keep all of the files for those sites in /home/siteX/. The folders and all the files within them are owned by those respective users, and if something needs to be written to by nginx, I'd just change the permissions to 777. This isn't working too well for me anymore, as I want to use one-click updates in XenForo and WordPress now, and I suspect it's causing some problems with new WordPress plugins I'm using as well.

I know the general advice is to have all of the files of the website owned directly by nginx:nginx. However, to be frank, that advice has always puzzled me.

---

How are you all actually maintaining the files on your site with nginx:nginx permissions?

Sure, if you're performing one-click upgrades that's ideal, but what about the rest of the time? If you need to perform a quick edit to a config file, say wp-config.php, how do you actually do it? Are you actually logging into your server as the nginx user? Are you logging in as root? Are you chown-ing the file multiple times as needed to make your edits? Am I just wasting my time having multiple system users per site?

Also, I maintain my WordPress' custom theme folder and several custom plugins as git repos, and I push those changes via my site's SSH user. What happens if I try to push changes to that repo and all those files are owned by nginx? Would it even allow me to overwrite the files? Will they be owned by that user now, or by nginx?

From the way I see it, there are two mutually exclusive ways to go about this: you can have a server that has files which are easier to maintain directly with specific users, or you can give everything to nginx and enjoy automated things, but jump through a lot of hoops when you actually need to work with the files.

How do you guys deal with this problem? As you can see, I'm deeply confused about best practices here.

 

OK, thanks for the info. I guess I need to read Centminmod 101 again.

Any advice on what to do with git, though? Once file ownership is changed to nginx, pushing to repos with my site's SSH user obviously no longer works, and if I push as root user, the uploaded files are owned by root:root again, so I'm back to square one. Do I have to chown every single time I push changes?

I have tried researching this but nothing seems to answer the question. Git is so widely used; I don't understand how this is not a big issue for everyone?

 

OK! That surprises me — it feels like there should be a better way — but file permissions are just such a pain.

Bind mounts look too complex for my situation. I have figured out how to use git hooks for each of my repos to just update file ownership each time I push to the server via the myrepo.git/hooks/post-receive file:

Code (Text):

#! /bin/sh
GIT_WORK_TREE=/path/to/my/code git checkout -f
echo "Updating file ownership..."
chown -R nginx:nginx /path/to/my/code
echo "Restarting php-fpm..."
service php-fpm restart

This seems to do the trick. As you can see, I also added a command to restart PHP-FPM automatically.

I guess this works because I'm pushing to the git repo via ssh as the root user, so the script is executed with root permissions.