nginx - userdir with user permissions

Question

What I want to do is have the usual server running user files like this:

http://users.example.com/~user1/stuff.php

which would be stored somewhere in /home/user1/www or something like that, but running with that user's permissions. So, scripts in the /home/user1/www directory can't access files/folders in the /home/user2/www directory (unless UNIX permissons permit it).

I read a solution using vhosts and a new pool for each vhost, but for hundreds of users that's probably to heavie. Is there any workaround?

Note that I'm running nginx in a Raspberry Pi, so this is just a home project, nothing really serious.

Answer 1

Since nginx doesn't run php directly, but instead forwards requests to a php application, you care what the php binary is running as. I'm assuming you're running php-fpm, but the general idea isn't specific to php-fpm.

The configuration page for php-fpm shows the directives that can be set. We're interested in the user and group params, as they control what user and group the php instances will run as (and therefore what permissions the script will run as). The chroot directive may also be of interest in creating a secure system (you may want to restrict each user to only the files available in /home/user1/www, not higher in the directory hierarchy).

As you can see, they're set on a per-pool basis.

So you could create several pools, one per user, and have each run under that user and group. You could also chroot to that user's webroot. This is the solution you linked.

But since you have to set up a new php-fpm pool for every user, it's not something you can do on-demand. Instead, make creating the php-fpm pool part of your user creation process.