Problem
We don’t want users on the one server to browse into other user’s folders, nor do we wish to allow scripts to be run that can access other users folders. We do however want everyone to be able to browse whatever is available through their web browser.

Currently
At the moment I have a web server which serves all files through a single nginx instance. This is running on the user “www-data” which has to be able to at least read all the files under /home to be able to serve correctly. Our php-fpm setup is per-user. This means every user has their own worker pool so that scripts that are readable per user are all that can be run. This is somewhat useless at the moment though because all users can browse around the /home directories with impunity. That is the problem we wish to address, I do believe that php-fpm will restrain it’s activities to folders you set so we might be ok on that side of things but scripts could still be created to read files out from other places.

Idea
As nginx is a pretty lightweight application we could try making an nginx instance per-user. This would then allow files to be read by nginx (running as whatever user you set instead of the global www-data) and would let us lock down each /home folder for each user.

Plan
I need to test out whether this will work and if I can automate the setup process of this type of setup. It would be a pain to have to do it manually each time a new user was added or removed. The automation is by-the-by really, but it would save time in the long run. First I’ll see if my ideas are valid and a good option.

This now let’s any script placed under a user’s folder to be run and managed by the user, previously scripts had to be changed to the general “www-data” user and group. Depending on your server setup this can be very advantageous. In my case I have multiple users using a single server and I want them to be somewhat autonomous.

The next step in my server administration journey is the art of configuring chroot or something similar to ensure users are somewhat jailed to their own space. It is not at all advantageous to allow your users to see into other user’s folders. As recently highlighted by Matt over on WordPress.org.

Once I have the chroot stuff complete I’ll post on how I set it all up including the PHP-FPM pools.

After stripping down a lot of the UI (in fact all JS and CSS was pulled) I’ve been working on the navigation of the site to get that all in order. The next step will be to work on the browsable areas (basically all the titles/media). Once I have that in hand I’ll tackle the functionality of melative such as the stream and logging experiences. Finally I’ll hit up all the settings and misc pages about the place.

Once that’s done it should be good to go but will need a code review by Ryan to reduce some of the gammy PHP calls I’ve put in. There has been a few things altered in the core to allow a simplified UI and in fact when I hit stuff up after the navigation there will be a lot of code changes to conform the calls I imagine.

So anyway, thought I’d give an update.

I usually make use of an existing theme only because it has all the functions written out and what not. I could do it from scratch though I guess. I’ll code it up in plain html first then start converting the chunks over to PHP + WP.

This would be what the front page looks like.

This is how I would display single pages.

http://www.datasquare.co.nz/index.php/default/western-digital-caviar-black-500gb-7200rpm-32mb-cache-sata.html

Looks like I’ll grab that drive and slide it on into the iMac. Also, who would have thunk that you use a suction cup to get into the iMac. Go figure.

http://helpmemartin.blogspot.com/2009/03/upgrade-replace-imac-hard-drive-2008.html