🦞 Clawdie and Nginx

Everything learned about serving static files on the domedog.pro server • 06.03.2026

1. Server Layout

Active nginx config

server {
    listen 80;
    listen [::]:80;
    server_name domedog.pro;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name domedog.pro;

    ssl_certificate /etc/letsencrypt/live/domedog.pro/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domedog.pro/privkey.pem;

    root /home/clawdie/htdocs/domedog.pro;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

2. The 404 Problem — Root Cause

When a new HTML file was created by Clawdie (writing as user clawdie), it got a 404 in the browser even though the file existed on disk.

Why this happens — the umask chain

$ umask
0007

$ id www-data
uid=33(www-data) gid=33(www-data) groups=33(www-data)

$ ls -la /home/clawdie/htdocs/domedog.pro/page.html
-rw-rw---- 1 clawdie clawdie 23916 Mar 6 09:34 page.html
#  ^^^ 660: owner+group can read, others (www-data) CANNOT

3. The Fix — Add www-data to the clawdie Group

# Add www-data to the clawdie group
sudo usermod -a -G clawdie www-data

# Reload nginx to pick up the new group membership
sudo systemctl reload nginx

After this:

• www-data is now in group clawdie
• Files with mode 660 and group clawdie are readable by nginx
• No need to chmod individual files ever again
• Any file written by the clawdie user will automatically inherit group clawdie

4. Debugging Checklist — When You Get a 404

Work through these in order:

ls -la /home/clawdie/htdocs/domedog.pro/your-file.html

sudo nginx -T | grep -A20 "domedog"
# Look for: root /home/clawdie/htdocs/domedog.pro;

ls -la /home/clawdie/htdocs/domedog.pro/your-file.html
# Need at least: -rw-r--r-- (644) OR -rw-rw---- (660) with www-data in clawdie group
stat -c "%a %G %n" /home/clawdie/htdocs/domedog.pro/your-file.html
# Should show: 644 clawdie ... OR 660 clawdie ... (with www-data in group)

ls -ld /home/clawdie /home/clawdie/htdocs /home/clawdie/htdocs/domedog.pro
# All dirs need at least o+x (execute/traverse) or www-data in the group

sudo tail -20 /var/log/nginx/error.log
# "Permission denied" = file exists, can't read (permissions issue)
# "No such file or directory" = wrong path or file doesn't exist

sudo nginx -t              # test config syntax first
sudo systemctl reload nginx   # apply without dropping connections

5. Quick Permission Fix (one-off file)

If you ever need to fix a single file quickly before the group membership kicks in (nginx requires restart/reload to pick up new group memberships for running worker processes):

# Make a single file world-readable
chmod 644 /home/clawdie/htdocs/domedog.pro/your-file.html

# Make all files in webroot world-readable at once
chmod 644 /home/clawdie/htdocs/domedog.pro/*.html

6. Understanding umask 0007

The server uses umask 0007 (set in ~/.bashrc). This is intentional — it makes all files private by default, only accessible to owner and group members.

7. Files Currently Served

8. Useful nginx Commands

# Test config syntax (always do this before reload)
sudo nginx -t

# Dump full merged config (great for debugging)
sudo nginx -T

# Reload (apply config changes, no downtime)
sudo systemctl reload nginx

# Restart (full restart, brief downtime)
sudo systemctl restart nginx

# Check status
sudo systemctl status nginx

# Watch error log live
sudo tail -f /var/log/nginx/error.log

# Watch access log live
sudo tail -f /var/log/nginx/access.log

# Check what groups www-data is in (verify the fix)
groups www-data
# Should show: www-data : www-data clawdie

9. SSL / Let's Encrypt

SSL certificates are managed by Certbot and stored at /etc/letsencrypt/live/domedog.pro/. They auto-renew via a system timer. To check expiry:

# Check certificate expiry
sudo certbot certificates

# Test renewal (dry run, no changes)
sudo certbot renew --dry-run

# Force renew now
sudo certbot renew --force-renewal