I have a Digitalocean server setup running Ubuntu 16.04 with basically a LAMP setup.
I am running into issues however with the folder permissions. Thumbs will only be written when the folder permissions are set as 777. When setting them to 755 no thumbs will be generated.
All directories and files should be owned (chown) by the group that’s used by Apache. You can leave the user set to your login user so that you are still able to edit the files.
Not as far as I can tell. If you only set the permissions to directories that need write permissions, it should be pretty safe. Just make sure not to allow Apache access to your home directory etc., otherwise hackers will have access too if there is a bug in Apache/Kirby/your code.