Service adjustments

static/Trixie/nginx.service

@@ -31,12 +31,6 @@ BindReadOnlyPaths=/bin
 BindReadOnlyPaths=/sbin
 BindReadOnlyPaths=/etc
 
-# Read-only: vhost docroots + app projects. Add a new line here when you
-# add a vhost whose root isn't under one of these parents.
-BindReadOnlyPaths=/raweb
-BindReadOnlyPaths=/srv
-BindReadOnlyPaths=/hostdata
-
 # Read-write: nginx runtime state.
 #   /run               nginx.pid, nginx.lock, /run/nginx/temp/*, PHP-FPM sock
 #   /var/log/nginx     access.log, error.log
@@ -44,6 +38,10 @@ BindReadOnlyPaths=/hostdata
 BindPaths=/run
 BindPaths=/var/log/nginx
 BindPaths=/nginx
+BindPaths=/var/cache/nginx
+BindPaths=/srv
+BindPaths=/hostdata
+BindPaths=/raweb
 
 NoNewPrivileges=true
 ProtectKernelTunables=true