{"action":"closed","issue":{"url":"https://api.github.com/repos/phusion/passenger-docker/issues/102","labels_url":"https://api.github.com/repos/phusion/passenger-docker/issues/102/labels{/name}","comments_url":"https://api.github.com/repos/phusion/passenger-docker/issues/102/comments","events_url":"https://api.github.com/repos/phusion/passenger-docker/issues/102/events","html_url":"https://github.com/phusion/passenger-docker/issues/102","id":102565775,"number":102,"title":"How to set permissions to not conflict between Web server and app server","user":{"login":"paulmenzel","id":9318792,"avatar_url":"https://avatars.githubusercontent.com/u/9318792?v=3","gravatar_id":"","url":"https://api.github.com/users/paulmenzel","html_url":"https://github.com/paulmenzel","followers_url":"https://api.github.com/users/paulmenzel/followers","following_url":"https://api.github.com/users/paulmenzel/following{/other_user}","gists_url":"https://api.github.com/users/paulmenzel/gists{/gist_id}","starred_url":"https://api.github.com/users/paulmenzel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paulmenzel/subscriptions","organizations_url":"https://api.github.com/users/paulmenzel/orgs","repos_url":"https://api.github.com/users/paulmenzel/repos","events_url":"https://api.github.com/users/paulmenzel/events{/privacy}","received_events_url":"https://api.github.com/users/paulmenzel/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-22T20:43:11Z","updated_at":"2015-08-23T11:32:10Z","closed_at":"2015-08-23T11:32:10Z","body":"NGINX runs under the user `www-data` and the app under the user `app`.\r\n\r\nAssume there are files in `public/my-uploads/some-hash/receipt-for-customer-X.pdf`\r\n\r\n    -rw-r-----  1 app app  x Apr 15  2014 public/my-uploads/some-hash/receipt-for-customer-X.pdf\r\n\r\nwhich shouldn’t be world readable.\r\n\r\nNow the problem is, that the file cannot be served by NGINX, as this runs as user `www-data` and cannot read that file.\r\n\r\nHow should that problem be solved? Add `www-data` to the group `app`?"}}