I’m working on a small almaLinux server where one of my sites needs to provide a few downloadable files to visitors. I’m currently trying to figure out whether it’s better to keep those files inside the website’s document root or store them somewhere outside it and expose only the download path. I’m also a little unsure about the permissions side of this. I want visitors to be able to download the files without giving the web server more filesystem access than it actually needs. for a relatively small setup, what would be the usual approach on AlmaLinux? Are there any SELinux, file permission, or nginx settings I should check before making a download directory publicly accessible?
For a small setup, I would keep the files outside the document root, for example /srv/downloads, and expose them with nginx alias.
The web server only needs read permission; there is no need to make nginx the owner or give it write access.
On AlmaLinux with SELinux enabled, label the directory with httpd_sys_content_t.
If download traffic becomes large, moving the files to S3 or another object storage service would be worth considering.