setfacl -m m:r aFile
#re set the mask

solve the problem, but the question is: why the F**** this is happening !?

Update, this is only happening when I copy files from a ~SMB share… :'(
Otherwise it’s correct…

Proxmox seem powerfull

It’s a Type1, not Type2
https://en.wikipedia.org/wiki/Hypervisor#Classification

Thank you all !

Indeed setting execute perm on example, sub1, sub2, static

The program/user have now access to the directory.

In order words all the parents directory need at least execute in order to have access in the targeted directory…

Now I gave 751 for static. Meaning than others (here nginx) cannot list the files within. But never the less it works
the static files are appearing when requested (HTTP) but forbidding nginx to list the directory is changing something ? (performance/security)

Thanks