title: File permissions for Django: Gunicorn, Nginx, and Static Files
body: <p>I have a standard ubuntu 14.04 machine. I use it daily under the user <code>mh00h</code>. I'm interested in using this machine as a production server. How do I manage file permissions for Django and Nginx?</p>
  
  <p>Nginx is currently configured to run under the <code>www-data:www-data</code>. This minimizes risk of the rest of a machine being compromised. Django/gunicorn likewise should run under a user other than <code>mh00h</code>. But under what user should gunicorn actually be run under? <code>nobody</code>, correct?</p>
  
  <p>Next: I am storing all of my web development files under <code>/home/mh00h/development</code>. Owned by <code>mh00h</code>. <code>/home/mh00h/development/project1 (plus all dir/files but /media and /static)</code>? Owned by <code>mh00h</code>. I follow django two-scoops best practices to create a project directory with static files inside of it. Of course, Nginx is unable to access <code>/home/mh00h/development/project1/project1/static</code> now because all of those parent directories are owned by <code>mh00h</code>, not <code>www-data</code> (<code>./static</code> is owned by <code>www-data</code>).</p>
  
  <p>To complicate the matter, virtualenvwrapper creates my virtual environments under <code>/home/mh00h/.virtualenvs/</code>.</p>
  
  <p>I am hesitant to fraction away from two scoop's best practices and store <code>/static</code> separately in <code>/var/www</code>, because I want all of these directories to stay nicely packaged together for easy transport off to some other server later. Plus, it makes me messy if I compare myself against how two-scoops did it.</p>
  
  <ol>
  <li>Where should my static files be stored?</li>
  <li>Where should django specific files be stored?</li>
  <li>What users/groups should be able to access which of 1 and 2?</li>
  <li>Where should virtualenvwrapper environments be stored?</li>
  <li>What permissions should these locations have?</li>
  </ol>
  
  <p>Thank you.</p>