I want to configure Craft to run as user craftcms and have configuration owner craftowner. The purpose is to make configuration read-only to craftcms, so that there can be no changes to the configuration via the interface. We will pull config updates from a git repo.
Is there a canonical guide for implementing this setup? If not, has anyone determined what permissions are required?