One of the things we operate for the research side of the department is an old fashioned general purpose web server, where everyone has a home page area of their own in the traditional '/~<login>/' style ( cf ). This web server has been there for a very long time, and one of the decisions that was made very early on was that for security reasons, the web server would not NFS mount people's regular home directories from our fileservers .
The traditional Apache way to do '/~<login>/' home pages is to have some location under your home directory that's exposed as your web home page area ; the traditional name for this is '
public_html
'. One alternative is to relocate this to a separate directory tree, but this directory tree is flat, which makes it awkward to have different pools of disk space for different people ( which is absolutely required for us ). Since we didn't want to use people's regular home directories for security reasons and we couldn't put everyone in one directory, we did the obvious hack: people have a different, special home directory on the web server. These home directories are in special 'webdir' filesystems on our fileservers , and these webdir filesystems are the only NFS filesystems that the web server NFS mounts.
The result is that everyone actually has two home directories in two different filesystems (although those two filesystems will come from the same ZFS pool). They have their regular home directory filesystem, which is accessible on our login and compute servers but not the web server, and their 'webdir' home directory, which is accessible everywhere. To make this more convenient to people, we create a '
public_html
' symlink in people's regular home directories that points to the '
public_html
' in their webdir home directory. If people have personally run web servers , these and their support files also live in the 'webdir' home directory, for relatively obvious reasons.
( We have a special short name form of people's home directories , so on the web server this short form points to their web home directory. The
public_html
symlink combined with this means that '/u/<login>/public_html' always refers to your web home page directory tree no matter what machine you're on.)
Because everyone's web home directory filesystem is in the same ZFS pool as their normal home directory filesystem, the web server still depends on all of our ZFS fileservers . Since our web server is reasonably active ( also , also ), it tends to react very rapidly to any NFS fileserver hiccups.
PS: The web home directory security decision predates me, so I don't know why it was made, but in my view it's a perfectly sensible decision. In general you should probably assume that your web server can be coaxed into reading and disclosing any Unix file that it has filesystem level access to. If you don't like the implications of this, you need to arrange for it to have access to fewer files. A dedicated set of filesystems is one relatively straightforward way to do that.