Otdfbt

After some fooling around with PHP-FPM user pools, I got a configuration that works... but is right?

I'm self hosting a PrivateBin. Obviously, I'm trying to get this install as secure as possible but this is my first time setting up PHP-FPM user pools.

Following these instructions I setup the permissions. My concern is that this app won't run without write and execute privileges to the traffic_limiter.php file located in the data directory. This obviously concerns me.

User Configuration
I created a user called privatebin and also created the appropriate pool in /etc/php/7.2/fpm/pool.d/privatebin.conf.

[privatebin]
user = privatebin
group = privatebin
listen = /run/php/php7.0-fpm.privatebin.sock
listen.owner = privatebin 
listen.group = www-data 
listen.mode = 0660

pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3

I also added the following to the virtual host file.

 <IfModule mod_fastcgi.c>
 AddHandler php7-fcgi-privatebin .php
 Action php7-fcgi-privatebin /php7-fcgi-privatebin
 Alias /php7-fcgi-privatebin /usr/lib/cgi-bin/php7-fcgi-privatebin
 FastCgiExternalServer /usr/lib/cgi-bin/php7-fcgi-privatebin -socket /run/php/php7.0-fpm.privatebin.sock -pass-header Authorization
 <Directory "/usr/lib/cgi-bin">
 Require all granted
 </Directory>
 </IfModule>

 <Directory /var/www/bin.xxxx.io/html>
 Options +SymLinksIfOwnerMatch
 AllowOverride None

 Require all granted
 RewriteEngine On
 <IfModule mod_fastcgi.c>
 <FilesMatch ".+.ph(p[3457]?|t|tml)$">
 SetHandler php7-fcgi-privatebin
 </FilesMatch>
 </IfModule>
 </Directory>

The pooled user appears to be working.

#$ps aux | grep php
private+ 1532 0.0 0.1 717056 22780 ? S 11:22 0:00 php-fpm: pool privatebin
private+ 1533 0.0 0.1 717056 22780 ? S 11:22 0:00 php-fpm: pool privatebin
www-data 1534 0.0 0.9 806716 149296 ? S 11:22 0:05 php-fpm: pool www
www-data 1539 0.0 0.9 1041968 150420 ? S 11:22 0:03 php-fpm: pool www
www-data 2299 0.0 0.8 1039040 144136 ? S 12:25 0:02 php-fpm: pool www

Finally... here are the file permissions.

/var/www/html
dr-xr-x--- 2 root www-data 4096 Apr 2 11:20 cfg/
dr-xr-x--- 4 root www-data 4096 Aug 11 2018 css/
drwxr-x--- 2 privatebin www-data 4096 Apr 2 13:04 data/
dr-xr-x--- 2 root www-data 4096 Aug 11 2018 i18n/
dr-xr-x--- 2 root www-data 4096 Aug 11 2018 img/

/var/www/html/data
-rw-r----- 1 privatebin www-data 19 Apr 2 13:04 .htaccess
-rwxrw---- 1 privatebin www-data 45 Apr 2 13:26 purge_limiter.php*
-rwxrw---- 1 privatebin www-data 522 Apr 2 06:57 salt.php*
-rwxrw---- 1 privatebin www-data 130 Apr 2 13:26 traffic_limiter.php*

As I said, this appears to be working, but I had to fiddle with the user permission to get them right. An advise is greatly appreciated.