Web application package guidelines

From ArchWiki

The factual accuracy of this article or section is disputed.

Reason: The file system layout is insufficient for more than one instance of a webapp. (Discuss in Talk:Web application package guidelines)
Arch package guidelines

32-bit – CLR – CMake – Cross – DKMS – Eclipse – Electron – Font – Free Pascal – GNOME – Go – Haskell – Java – KDE – Kernel modules – Lisp – Meson – MinGW – Node.js – Nonfree – OCaml – Perl – PHP – Python – R – Ruby – Rust - Security – Shell – VCS – Web – Wine

This page describes how to package web applications.

Separate user

For security reasons, every web application should be run as a separate (unprivileged) user (i.e. $pkgname).

Note: Traditionally, many web applications were run as the http user/group, which can be considered unsafe, as in such a scenario applications can read each other's files.

Refer to the systemd-sysusers(8), sysusers.d(5), systemd-tmpfiles(8) and tmpfiles.d(5) man pages for details on how to create users and deal with ownership of files and folders for that user in a package.

Directory structure

The layout follows the FHS.

  • /usr/share/$pkgname: The application's data directory holds the files of the web application. Files are owned by root and are therefore readonly to the application user and group $pkgname.
  • /etc/$pkgname: The configuration directory of the application holds configuration files for the application (symlinked to the data directory). Files located here have to go to the backup array and are owned by the user and group $pkgname.
Warning: Files potentially containing authentication information must be protected (i.e. not readable by any other user or group on the system, except root and $pkgname)!
  • /run/$pkgname: The runtime directory of the application (owned by the user and group $pkgname). It can be used for sockets (e.g. in setups facilitating socket activation).
Note: According to the package guidelines on directories, /run must not be contained in a package. Use tmpfiles to add the directory with matching permissions.
  • /var/cache/$pkgname: The cache directory of the application (owned by the user and group $pkgname). It (or subfolders in it) is symlinked to the data directory for applications requiring writable cache directories.
  • /var/lib/$pkgname: The persistent storage of the application (owned by the user and group $pkgname). It (or subfolders in it) is symlinked to the data directory for applications requiring persistent storage directories.