Django的文件权限：Gunicorn，Nginx和静态文件

Question

I have a standard ubuntu 14.04 machine. I use it daily under the user mh00h . I'm interested in using this machine as a production server. How do I manage file permissions for Django and Nginx?

Nginx is currently configured to run under the www-data:www-data . This minimizes risk of the rest of a machine being compromised. Django/gunicorn likewise should run under a user other than mh00h . But under what user should gunicorn actually be run under? nobody , correct?

Next: I am storing all of my web development files under /home/mh00h/development . Owned by mh00h . /home/mh00h/development/project1 (plus all dir/files but /media and /static) ? Owned by mh00h . I follow django two-scoops best practices to create a project directory with static files inside of it. Of course, Nginx is unable to access /home/mh00h/development/project1/project1/static now because all of those parent directories are owned by mh00h , not www-data ( ./static is owned by www-data ).

To complicate the matter, virtualenvwrapper creates my virtual environments under /home/mh00h/.virtualenvs/ .

I am hesitant to fraction away from two scoop's best practices and store /static separately in /var/www , because I want all of these directories to stay nicely packaged together for easy transport off to some other server later. Plus, it makes me messy if I compare myself against how two-scoops did it.

1. Where should my static files be stored?
2. Where should django specific files be stored?
3. What users/groups should be able to access which of 1 and 2?
4. Where should virtualenvwrapper environments be stored?
5. What permissions should these locations have?

Thank you.

Answer 1

All files and directories in our production environment are owned by root:root with 755/644 file permissions, unless otherwise required. Some private files (think private keys etc.) are only readable by the user/process that needs them, while still being writable only by root .

As for the project structure: all our projects have a dedicated directory under /srv/www/vhosts.d/ . Virtual environments are stored under /srv/www/virtualenvs . It is perfectly possible to store them in your home folder, but I feel this central approach is more in line with the idea of a production server. With the right settings, all virtual envs are also accessible by all users.

Our main project directory contains several scripts (manage.py and several deployment/update scripts) and is further split out into subdirectores: ie web contains public files, src contains the source code, and frontend contains the template folder and sass folder. The whole project directory is contained in a git repository, but deployment-specific files (user uploaded files, search indexes, encryption keys) are all in .git-ignore .

Our nginx process runs as www-data . In general each Django project has its own user, and the gunicorn process runs as this user.