Operating Systems
Bug Report
Uploaded files returned 403 from nginx because the app's umask made them owner-only
After moving our app from a shell-launched process to a systemd service, every newly uploaded image returned 403 Forbidden. Old files were fine. The new files were created with mode 600 because systemd sets a different umask. How umask works, why it changed, and the fix with UMask= and group ownership.