I have messed around with assigning different users and groups to the files in
/var/www, but each way that I've tried so far ends up being overly complicated and error-prone. I'm looking for a simple and repeatable pattern that differs minimally from the default file-system settings (permissions, sticky bits, ACLs, etc.) Once I get this nailed down, I plan to replicate it across multiple servers over time.
My situation is that I have a web application that lives in
/var/www/foo and needs to be uploaded via SFTP. I'm planning on having git-ftp do the actual uploads. All files need to be readable by Apache. Some folders, and any subfolders created by the application, need to be writable by Apache. I have a single user account on the server in question that does not belong to any special groups at the moment, but does have full
sudo access. There will be multiple uploads over time and after each upload, I need to run a script that may create, modify, or delete files.
What is the least invasive way to get the files in place and not run into any permissions issues, either during the upload or at run-time?
In case it helps, I'm setting up Laravel applications on Debian, though the pattern that I'm looking for should hopefully generalize beyond that framework, the language it runs on, and that distribution.