From 158d369371564131600800e80b916bd62460036b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 17 Apr 2026 15:41:13 +0000
Subject: [PATCH] Fix WordPress ownership and tighten permissions to match
 php-fpm pool

Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/3c7ded55-8f08-46f7-af17-6bbbdadba84b

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
---
 modules/wordpress.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/modules/wordpress.nix b/modules/wordpress.nix
index 1f97fa6..650f217 100755
--- a/modules/wordpress.nix
+++ b/modules/wordpress.nix
@@ -94,10 +94,10 @@ lib.mkIf config.sovran_systemsOS.services.wordpress {
           echo "Download complete."
       fi
 
-      chown -R caddy:root "$INSTALL_DIR"
-      find "$INSTALL_DIR" -type d -exec chmod 755 {} \;
-      find "$INSTALL_DIR" -type f -exec chmod 644 {} \;
-      chmod -R 775 "$INSTALL_DIR/wp-content"
+      chown -R caddy:php "$INSTALL_DIR"
+      find "$INSTALL_DIR" -type d -exec chmod 750 {} \;
+      find "$INSTALL_DIR" -type f -exec chmod 640 {} \;
+      chmod -R 770 "$INSTALL_DIR/wp-content"
 
       echo "Generating wp-config.php..."
       cd "$INSTALL_DIR"
@@ -228,7 +228,7 @@ CREDS
 
   systemd.tmpfiles.rules = [
     "d /var/lib/www 0755 caddy root -"
-    "d /var/lib/www/wordpress 0755 caddy root -"
+    "d /var/lib/www/wordpress 0750 caddy php -"
   ];
 
   environment.systemPackages = with pkgs; [ wp-cli unzip ];