So right now we have our Laravel application up and running on the VBS. Nginx runs as a web server and php-fpm works with it to maintain a pool of PHP processes that handle the requests coming from Nginx. The Laravel application is owned by an Ubuntu user called www-data, which is used by both Nginx and php-fpm to read and write files. This is an okay setup to have something up and running real quick or like a dev environment or something, but we have a few things to consider. First, when we deploy our site by running git pull on the server, we do it using the Ubuntu user. And since the directory belongs to the www-data user, we won't be able to pull from the repo.

So let's do that. Let's ssh into the server. And run sudo adduser laracasts. Provide a password for the user. Confirm the password. Then just leave the other details blank for now. Confirm that the information we provided was correct. And done, the user was created. Now let's move our application files from the default /var/www to the laracasts user's home directory.

Now let's move our application files from the default /var/www to the laracasts user's home directory. So we run sudo mv /var/www /home/laracasts/www. Then we go check the home directory. And we can see that there are two directories there. One for the laracasts user and one for the ubuntu user. Let's check the laracasts directory. And we get permissions denied. Because the ubuntu user we are logged in as isn't privileged to go into the directory that belongs to the laracasts user.

Because the ubuntu user we are logged in as isn't privileged to go into the directory that belongs to the laracasts user. So let's use the su command to substitute the current user session with a session that belongs to the laracasts user. We run su laracasts. The system asks us for the laracasts user password. We provide it. And now we are logged in as laracasts. We can go into the laracasts directory and list the files. As you can notice the www directory which has our Laravel application still belongs to

We can go into the laracasts directory and list the files. As you can notice the www directory which has our Laravel application still belongs to the www-data user and group. We need to change the ownership to the laracasts user and group. And to do that we need to exit our laracasts session and go back to ubuntu. So let's exit the session using Ctrl+D. Clear the terminal. And then we run sudo chown -R laracasts:laracasts /home/laracasts/www for the user, laracasts for the group, for the home laracasts/www directory. Let's list the directories in the home again.

side files. Nginx reads only while php-fpm reads and writes. Since all the side files now belong to the laracasts user group, www-data won't be able to access them. And to fix that we are going to add the www-data user to the laracasts group. This will allow it to read files but won't write. And then we are going to change the user used by php-fpm to laracasts instead of www-data so it can read and write files in this directory. So let's do that. We will first add the www-data user to the laracasts group by running sudo usermod -a -G laracasts www-data.

So let's do that. We will first add the www-data user to the laracasts group by running sudo usermod -aG laracasts www-data. Then let's open the php-fpm pool configurations by running sudo nano /etc/php/8.1/fpm/pool.d/www.conf. We will first change the name of the pool from www to laracasts. We will create separate pools for all sites on the server. So for this site, it's laracasts. Then we will find an attribute called user and change it to laracasts. And same for the group.

Then we will find an attribute called user and change it to laracasts. And same for the group. Then we find an attribute named owner, change it to laracasts. And same for the group as well. The first user and group attributes decide which phpfpm will use when reading and writing the application files. The lesson owner and lesson group attributes decide the owners of the socket file phpfpm creates as a communication channel between it and nginx. Since the owner and group are set to laracasts, phpfpm will be able to read and write on this file.

Since the owner and group are set to laracasts, php-fpm will be able to read and write on this file. And since the www-data user used by nginx now belongs to the laracasts group, it will also be able to read and write on this file. The default permissions on that socket file are 660, which means that owners can read and write, the user and the group members as well. So now let's go edit the nginx configuration file sudo nano /etc/nginx/sites-available/laracasts. Then we update the root directory for the site to /home/laracasts/www/public. And finally we reload nginx with sudo service nginx reload and restart php-fpm so it creates the new pool with the new owners.

And finally we reload nginx with sudo service nginx reload and restart php-fpm so it creates the new pool with the new owners. So sudo service php8.1-fpm restart. Now we visit the site in the browser, refresh, and here we go, the site is still up and running. Now the remaining part in this lesson is to allow the laracasts user to pull from the github repository. And to do that we are going to move the keys we previously generated for the ubuntu user to the laracasts user. That way laracasts can access the github repository. Let's create a ~/.ssh directory for laracasts.

That way laracasts can access the github repository. Let's create a home laracasts/.ssh directory. Then we move the public key. Move home opuntu/.ssh/id_rsa.pub to home laracasts/.ssh/id_rsa.pub. And do the same for the private key file. And then we change the ownership recursively to laracasts laracasts 4d laracasts directory. This will include the new keys we just moved. Now we change the permissions to 700 for the .ssh directory. And now let's switch to the laracasts user. Oh not that, sudo su only will switch to the root user session.

And now let's switch to the laracasts user. Oh not that, sudo su only will switch to the root user session. So we need to run sudo su laracasts. Or su laracasts since we ran sudo before. Now we are in the laracasts session. Go into the laracasts directory. Then www. And we run git pull origin main. Verify that we want to add github.com as a non-trusted host. And here we go.

Verify that we want to add github.com as a non-trusted host. And here we go. We are able to communicate with the git repo on github. And now our site is isolated within a directory owned by a dedicated user, laracasts. And nginx along with phpfpm can access the files in this directory as they need. The laracasts user is able to communicate with github to deploy the changes that we push to our application. That's it for this lesson, I will see you in the next one.