Looking at your apache configuration, I see that unixd_module loaded, so apache is running as a daemon user / group daemon. Perhaps the root of your problems is because of the permissions set in the Dropbox folder, written inside your user's home.
If I'm right, you can avoid this problem by changing the configuration of your Apache. Take a look at httpd.conf for these lines:
User daemon Group daemon
As said, this is the user / group under which the server will respond to requests. Looking at your configuration, I read that your user is ferg . And usually for Mac users, the default group is staff . Therefore, change it in the following lines:
User ferg Group staff
Now you can restart apache. Each time you change the configuration, the apache server must be adjusted (or restarted by the configuration) to ensure that the new configuration is loaded correctly.
As a counter to this approach, it is possible that your Apache log files can no longer be updated (if they were written in daemon / daemon permissions). This is not a problem if you do not need them, apache works fine even without logs. But if necessary, we can avoid this problem by changing the ownership rights accordingly. Well, by executing this shell command:
sudo chown -R ferg: /Users/ferg/Library/Containers/com.bitnami.mampstack/Data/app/apache2/logs/
Answering your questions
About the user used to run apache, yes, it is (completely) safe to use your own user. Security mainly depends on which service / web application you have enabled. But your virtual host in httpd-vhosts.conf only listens on the localhost interface ( lockdown.local:8080 ), so you are the only one who uses it locally. On the other hand, pay attention to apache httpd.conf, your apache listens on all available interfaces. If you really want your apache to be accessible only to you with localhost, you should change it
Listen 8080
in
Listen 127.0.0.1:8080
And it might be better to reconfigure your virtual host:
<VirtualHost lockdown.local:8080>
:
<VirtualHost *:8080>
Just in case, in the future, if you change your mind, your virtual host will change the port for the port with apache configuration. But there should be more to say about the simplification and security of apache httpd. As said, in your case you should be sure that your apache only listens on the localhost interface.
As for your note 1, if you want to grant execution permission to other groups, you might need to recursively distribute execution permission. Try:
chmod -R go+x ~
But if you really want to grant access to apache, you also need to grant read permission to everyone.
chmod -R go+r ~
I also suggest that you avoid directory spaces, especially when dealing with apache configuration files, it might be better to change the web dev directory name (and, of course, the associated apache configuration)
Regarding file system permissions on Mac Os X, in your case, I suggest you take a look at the resolution for the entire directory in the path.
/Users/ferg/Dropbox/web dev/lockdown/site
I mean take a look at the permission granted:
/Users /Users/ferg /Users/ferg/Dropbox /Users/ferg/Dropbox/web dev /Users/ferg/Dropbox/web dev/lockdown /Users/ferg/Dropbox/web dev/lockdown/site /Users/ferg/Dropbox/web dev/lockdown/site
You can see the permission using the ls shell ls , for example: ls -l /Users To be sure that Apache can access the site directory, you really need the whole path that has execute permission for the others group. And inside the site directory, all files have read permission for the others group.
Hope this helps.