From c4980dfdb54f52a7d11988ca5005b3b374f0e8af Mon Sep 17 00:00:00 2001 From: Ovidiu U Date: Wed, 10 Jun 2026 13:40:20 +0100 Subject: [PATCH] Document updated per-app PHP-FPM pool and filesystem permissions Updates SERVER.md with deploy-dvla user separation, dedicated php8.4-fpm-dvla pool configuration, explicit directory permissions for Laravel storage/cache/database, and known production gaps --- SERVER.md | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/SERVER.md b/SERVER.md index d59ddb4..2ed5c22 100644 --- a/SERVER.md +++ b/SERVER.md @@ -12,16 +12,34 @@ you change the box. - **Hostname:** ubuntu-4gb-dvla-api - **Swap:** 2 GB swapfile at `/swapfile` (mounted via `/etc/fstab`) -## Users +## Users (UPDATED) -- `root` — break-glass admin only -- `deploy` (UID 1000) — owns the app directory, performs deployments -- `www-data` — nginx + PHP-FPM runtime user; group-shared with `deploy` for file access +- deploy (UID 1000) — human admin, sudo, your SSH key +- deploy-dvla (UID 1001) — owns and runs dvla-api, no sudo, your SSH key +- www-data — nginx only, no group memberships in app users -> **Note:** This box runs **one** app. If a second app is ever added, the -> default PHP-FPM `www` pool MUST be split into per-app pools running as -> per-app system users, or the apps will be able to read each other's `.env` -> and SQLite files. See the earlier project chats for the multi-app layout. +## PHP-FPM (UPDATED) + +- Pool: /etc/php/8.4/fpm/pool.d/dvla-api.conf +- Runs as deploy-dvla +- Socket: /run/php/php8.4-fpm-dvla.sock +- pm.max_children = 3 +- Default www.conf disabled (renamed to www.conf.disabled) + +## Filesystem perms + +- /var/www/dvla-api: 2755 (traversable so nginx can reach public/) +- App subdirs: 2750 (deploy-dvla owner+group only) +- public/: 755/644 (world-readable, intentional) +- .env: 600 +- storage/, bootstrap/cache/: 2770 (writable by deploy-dvla) +- database/: 2770, database.sqlite: 660 + +## Known gaps + +- No backups +- No HTTPS yet +- Token-based git auth (not SSH) — Pangolin doesn't forward SSH to Gitea o ## Web stack