See #85567 (review).

With the upgrade to 20.09, trying to set

{
  services.nginx = {
    enable = true;
    virtualHosts."example.com".root = "/home/niklas/web"; # Requires `chmod o+x /home/niklas`.
  };
}

I got permission errors in nginx logs:

[error] ...: *2 "/home/niklas/web/index.html" is forbidden (13: Permission denied), ...

and in strace:

stat("/home/niklas/web/index.html", 0x7ffc40253550) = -1 EACCES (Permission denied)

despite my file system permissions being set up correctly.

sudo -u nginx stat /home/niklas/web/index.html completed successfully.

Eventually I found that this is because of the new ProtectHome = mkDefault true; systemd sandboxing option introduced in

(PR #85567).

This changelog update makes the user aware of this. It needs to be backported to 20.09.