nsd running as -u nsadmin -g web
Like I said, when I su'd to nsadmin I was able to access it fine, so nsd is doing something fishy.
I also tried giving the directory group foo and then adding nsadmin to that in /etc/group. Also worked when I su'd; also didn't work when nsd ran the proc.
Just now I tried changing it to jon:web, and nsd likes that too. I can see how that could make a twisted sort of sense, but it still strikes me as very nonstandard.