Setting up the private file directory (nginx)

Question

Problem

I'm trying to set-up a private file directory for Drupal on an LEMP stack (Ubuntu 12.04, nginx, MySQL, PHP), I wasn't 100% sure about the permissions or set-up so I thought I'd ask, how should you do it?

So Far

It needs to be a folder which is writable by the webserver but not accessible from the web.

Example:

Location: drupal_root/privatefiles

Permission: chgrp 775 www-data privatefiles

Nginx config: (goes into /etc/nginx/sites-available/mysite):

server {
         listen 8080;
           root /srv/www/mysite/public;


           location ^~ /privatefiles {
             internal;
           }

        ...
        }

Would that be enough? It recommends on the official page to have the folder outside the Drupal root. What difference would this make?

Answer 1

Have a look at Perusio's config, it has all the information and explanation you need. Here is a quote from it:

This config assumes that private files are stored under a directory named private. I suggest sites/default/files/private or sites/<sitename>/files/private but can be anywhere inside the site root as long as you keep the top level directory name private. (...) Example: Calling the top level private files directory protected instead of private.

location ^~ /sites/default/files/protected {          
  internal;        
}

Now any attempt to access the files under this directory directly will return a 404.

...

The usual practice involves setting up a directory outside of files directory and giving write permissions to the web server user. (...) I think it to be less advisable, in the sense that now there's another directory that is writable by the server.

I prefer to use a directory under files, which is the only one that is writable by the web server, and use the above location (protected or private) to block access by the client to it.

In short, marking it as internal is enough.