stash

deploy/dev/instance_b/nginx-b.dev.conf

@@ -1,3 +1,10 @@
+# Worker stays unprivileged as the image's default "nginx" user, but gains the "root" group so
+# it can read /var/www/userfiles - backend-b (running as root) writes those with
+# FILE_UPLOAD_DIRECTORY_PERMISSIONS=0750, group-readable but not world-readable. Mirrors
+# deploy/prod/playbook.yml's "Allow nginx to read backend user files" (www-data joins the
+# backend's file-owning group instead of loosening the mode).
+user nginx root;
+
 events {}
 
 http {