node.js - Nodejs, PM2, and nginx deploying security? -

there few guides online show how nodejs running on server, tend skip on few details on security. bit of loaded question, , i'm not sure begin. wondering if clarify following details.

first, setup:

• i have installed node locally non-sudo user because running node admin bad idea:

  /home/appuser     |--- nodejs/               # node install             |--- bin/             |--- include/             |--- lib/             |--- share/      |--- app/             |--- node_modules/             |--- public/        # holds html templates, static files , uploaded files             |--- core/          # holds main app js files             |--- app.js         # main nodejs program             |--- config.js      # configuration holds authentication details, other config stuff             |--- package.json 

  i can run application using pm2 doing pm2 start app.js.

  my nginx configuration:

  server {     listen 80;      server_name mydomainname.com;      location / {       proxy_pass http://localhost:8080;       proxy_http_version 1.1;       proxy_set_header upgrade $http_upgrade;       proxy_set_header connection 'upgrade';       proxy_set_header host $host;       proxy_cache_bypass $http_upgrade;     } } 

my concerns are:

(1) application - should main app/ live inside /home/appuser?

• any danger in having app files live inside non-sudo user home? if so, should app files live?

• i'm wondering if public/ should in different place , not live in same folder application files. wouldn't want application source files leak out, config.js holds sensitive information database auth details , email auth details.

  if should moved, /public live relative app/?

• right permissions on app/ chown -r appuser:appuser app/, user owns files. there other permissions should set on application folder?

(2) pm2 - since installed nodejs , modules locally, how safely pm2 restart nodejs app after server restart?

• my understanding pm2-init.sh live in /etc/init.d/, , happens automatically if had installed pm2 globally sudo.

  how should pm2 restart app safely using non-sudo user?

(3) nginx

• how can safely serve public/ through nginx if served this:

  http://mydomainname.com/public 

• my app handles routes , should throw 404 if route not found. possible work around , maliciously make app or nginx browse other directories?

  ie, outside of app directory

  http://mydomainname.com/../../etc/path/to/secrets 

  or, locally in app

  http://mydomainname.com/public/../../config.js 

  are there security precautions can set in nginx or nodejs prevent if possible?

1. the way adopt have files node:node-developer. , start app under node user. node-developer group developers. , set file permissions 770

2. write simple shell script logs node user , start pm2 init scirpts

3. solved using proper permission settings. nginx runs under nginx user. if files public, make nginx:nginx. user public/../../something. nginx not have rights access it.