mediawiki 1.43.0 | File and Directory Permissions | Arch Linux

Hi.
I am using Arch Linux and did a fresh install of mediawiki-1.43.0.tar.gz 
in a fresh created directory (untar was done using user root). After 
copying my individual file to the fresh install, I set up my file 
permission according to these instructions at 
https://www.mediawiki.org/wiki/Manual:Security - chapter "File permissions".

I ended up with a non functional wiki because of wrong permissions.

Then I started to walk to the error messages and did this:

chgrp http mediawiki-1.43.0/includes/
chmod g+rx mediawiki-1.43.0/includes/

This raises the next error (composer needs access to 
vendor/autoload.php). I do not want walk through all the code and errors 
just to notice somewhen in production that I do not have access to x or 
y. Instead I want to be sure to start with the right and save setup. 
Internet search did not help a lot. Docs mentioned above have been 
missunderstood, are incomplete or wrong.

My goal is to have a secure wiki with all permissions as low as needed 
for files and directories.

What would you suggest? Does anyone have a link to a good and proven doc?

Thanks,
Steffi


This is what I have so far:

drwxr-x--- 14 root http    4096  1. Feb 13:19 ./
drwxrwx---  9 root http    4096  1. Feb 13:08 ../
-rw-r--r--  1 root utmp    1511  5. Dez 16:41 api.php
-rw-r--r--  1 root utmp  352410  5. Dez 16:42 autoload.php
drwx------  2 root root    4096  1. Feb 13:08 cache/
-rw-r--r--  1 root utmp     168  5. Dez 16:41 CODE_OF_CONDUCT.md
-rw-r--r--  1 root utmp    8358  5. Dez 16:42 composer.json
-rw-r--r--  1 root utmp     125  5. Dez 16:41 composer.local.json-sample
-rw-r--r--  1 root utmp   19421  5. Dez 16:41 COPYING
-rw-r--r--  1 root utmp   15957  5. Dez 16:42 CREDITS
-rw-r--r--  1 root utmp    1762 20. Dez 19:45 docker-compose.yml
drwx------  5 root root    4096  1. Feb 13:08 docs/
drwx------ 35 root root    4096  1. Feb 13:08 extensions/
-rw-r--r--  1 root utmp      95  5. Dez 16:41 FAQ
-rw-r--r--  1 root utmp 1639880  5. Dez 16:42 HISTORY
drwx------ 23 http root    4096  1. Feb 13:18 images/
-rw-r--r--  1 root utmp    2221  5. Dez 16:41 img_auth.php
drwxr-x--- 96 root http    4096  1. Feb 13:08 includes/
-rw-r--r--  1 root utmp    2213  5. Dez 16:41 index.php
-rw-r--r--  1 root utmp    3685  5. Dez 16:42 INSTALL
-rw-r--r--  1 root utmp    1302  5. Dez 16:41 jsdoc.json
drwx------  5 root root    4096  1. Feb 13:08 languages/
-rw-r--r--  1 root utmp    1464  5. Dez 16:41 load.php
-rw-r-----  1 root http    6838  1. Feb 13:19 LocalSettings.php
drwx------ 11 root root   12288  1. Feb 13:08 maintenance/
drwx------  4 root root    4096  1. Feb 13:08 mw-config/
-rw-r--r--  1 root utmp    1761  5. Dez 16:41 opensearch_desc.php
-rw-r--r--  1 root utmp    1643  5. Dez 16:41 README.md
-rw-r--r--  1 root utmp   54673 20. Dez 19:45 RELEASE-NOTES-1.43
drwx------  5 root root    4096  1. Feb 13:08 resources/
-rw-r--r--  1 root utmp    1239  5. Dez 16:41 rest.php
-rw-r--r--  1 root utmp     199  5. Dez 16:41 SECURITY
drwx------  6 root root    4096  1. Feb 13:08 skins/
drwx------ 11 root root    4096  1. Feb 13:08 tests/
-rw-r--r--  1 root utmp    1659  5. Dez 16:41 thumb_handler.php
-rw-r--r--  1 root utmp    1357  5. Dez 16:41 thumb.php
-rw-r--r--  1 root utmp    4394  5. Dez 16:41 UPGRADE
drwx------ 21 root root    4096  1. Feb 13:08 vendor/