document root

The directory a server block's root directive names — /var/www/mysite — and the base Nginx joins the request path onto to find a file. It is not "where the app's files live": it is the boundary of what the internet can download. Every file under it is fetchable by anyone who guesses the name, so a .env, a site.sql.gz backup or a .git directory copied there is published, not stored. The other half is reachability: www-data needs read on the file and traverse permission, the x bit, on every directory above it. That is why a 403 on a file that exists is nearly always a parent directory rather than the file. namei -l /var/www/mysite/index.html shows where the chain stops.