@BDHarrington7 going to reinstall search and see if everything is working. I ended up removing all but mailgun and now going to see about enabling one by one to identify the culprit.

Resolved after talking to baris. I have the mailgun emailer plugin, and also had the db_search and MFA plugin. Disabled db_search and MFA and permissions are working as expected.

If you experience this, try disabling/uninstalling plugins.

I have a very similar setup, except that I am using numerous instances of nodebb within an upstream block, which I would suggest on your droplet depending on it's size:

upstream forum_nodes {
    ip_hash;
    server 127.0.0.1:4567;
    server 127.0.0.1:4568;
    server 127.0.0.1:4569;
    server 127.0.0.1:4570;
}

server {
    listen 80;

    server_name forum.somedomain.tld;

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_set_header X-NginX-Proxy true;
    proxy_redirect off;

    # Socket.IO Support
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    gzip	on;
    gzip_min_length	1000;
    gzip_proxied	off;
    gzip_types      text/plain application/xml application/x-javascript text/css application/json;

    location @nodebb {
        proxy_pass http://forum_nodes;
    }

    location ~ ^/(images|language|sounds|templates|uploads|vendor|src\/modules|nodebb\.min\.js|stylesheet\.css|admin\.css) {
        root /home/nodebb/nodebb/public/;
        try_files $uri $uri/ @nodebb;
    }

    location / {
        proxy_pass http://forum_nodes;
    }
}

It is publicly accessible, but not public, so I will send you a message with a link to it...

nodebb@forum:~/nodebb$ git branch
  v0.8.x
* v0.9.x
nodebb@forum:~/nodebb$ git status
On branch v0.9.x
Your branch is up-to-date with 'origin/v0.9.x'.

nothing to commit, working directory clean

I am logged in as a test user, which is a registered-users user and validated via email. I can see the "New Topic" button as well as the reply. I get the error when I try to post a reply and I also see it, now that I explored a bit more; when I go back (cmd left arrow on mac) to the previous page/category parent from an individual post.

Yes, it is set as well:

root@forum:~# redis-cli
127.0.0.1:6379> zrange group:cid:1:privileges:groups:topics:create:members 0 -1
1) "administrators"
2) "registered-users"
127.0.0.1:6379> zrange group:cid:2:privileges:groups:topics:create:members 0 -1
1) "administrators"
2) "registered-users"
127.0.0.1:6379> zrange group:cid:3:privileges:groups:topics:create:members 0 -1
1) "administrators"
2) "registered-users"
127.0.0.1:6379> zrange group:cid:4:privileges:groups:topics:create:members 0 -1
1) "administrators"
2) "registered-users"
127.0.0.1:6379> zrange group:cid:5:privileges:groups:topics:create:members 0 -1
1) "administrators"
2) "registered-users"

@baris said:

zrange group:cid:<cid>:privileges:groups:topics:reply:members 0 -1

I have verified that the registered-users group is in fact added to every category, which matches what I see in the ACP:

root@forum:~# redis-cli
127.0.0.1:6379> zrange group:cid:1:privileges:groups:topics:reply:members 0 -1
1) "administrators"
2) "registered-users"
127.0.0.1:6379> zrange group:cid:2:privileges:groups:topics:reply:members 0 -1
1) "administrators"
2) "registered-users"
127.0.0.1:6379> zrange group:cid:3:privileges:groups:topics:reply:members 0 -1
1) "administrators"
2) "registered-users"
127.0.0.1:6379> zrange group:cid:4:privileges:groups:topics:reply:members 0 -1
1) "administrators"
2) "registered-users"
127.0.0.1:6379> zrange group:cid:5:privileges:groups:topics:reply:members 0 -1
1) "administrators"
2) "registered-users"

As an administrator (only admin) I am able to post to my categories no problem. I only have administrators and registered-users in the ACP; however I have a verified test user and I am attempting to post and receive the "Error - You do not have enough privileges for this action." dialog whenever I try to create a topic that I know has read/write for registered-users, or reply.

I have double, triple checked the perms. The following is the output of what redis-cli commands I could find to try and troubleshoot.

Do I have duplicate groups within redis and need to clean them up some how?

root@forum:~# redis-cli
127.0.0.1:6379> hgetall groupslug:groupname
 1) "cid-1-privileges-groups-find"
 2) "cid:1:privileges:groups:find"
 3) "cid-1-privileges-groups-read"
 4) "cid:1:privileges:groups:read"
 5) "cid-1-privileges-groups-topics-create"
 6) "cid:1:privileges:groups:topics:create"
 7) "cid-1-privileges-groups-topics-reply"
 8) "cid:1:privileges:groups:topics:reply"
 9) "cid-2-privileges-groups-find"
10) "cid:2:privileges:groups:find"
11) "cid-2-privileges-groups-read"
12) "cid:2:privileges:groups:read"
13) "cid-2-privileges-groups-topics-create"
14) "cid:2:privileges:groups:topics:create"
15) "cid-2-privileges-groups-topics-reply"
16) "cid:2:privileges:groups:topics:reply"
17) "cid-3-privileges-groups-find"
18) "cid:3:privileges:groups:find"
19) "cid-3-privileges-groups-read"
20) "cid:3:privileges:groups:read"
21) "cid-3-privileges-groups-topics-create"
22) "cid:3:privileges:groups:topics:create"
23) "cid-3-privileges-groups-topics-reply"
24) "cid:3:privileges:groups:topics:reply"
25) "cid-4-privileges-groups-find"
26) "cid:4:privileges:groups:find"
27) "cid-4-privileges-groups-read"
28) "cid:4:privileges:groups:read"
29) "cid-4-privileges-groups-topics-create"
30) "cid:4:privileges:groups:topics:create"
31) "cid-4-privileges-groups-topics-reply"
32) "cid:4:privileges:groups:topics:reply"
33) "registered-users"
34) "registered-users"
35) "administrators"
36) "administrators"
37) "cid-5-privileges-groups-find"
38) "cid:5:privileges:groups:find"
39) "cid-5-privileges-groups-read"
40) "cid:5:privileges:groups:read"
41) "cid-5-privileges-groups-topics-create"
42) "cid:5:privileges:groups:topics:create"
43) "cid-5-privileges-groups-topics-reply"
44) "cid:5:privileges:groups:topics:reply"
127.0.0.1:6379> hgetall groups:administrators
(empty list or set)
127.0.0.1:6379> smembers groups
(empty list or set)
127.0.0.1:6379> zrange groups:createtime 0 -1
 1) "cid:1:privileges:groups:find"
 2) "cid:1:privileges:groups:read"
 3) "cid:1:privileges:groups:topics:create"
 4) "cid:1:privileges:groups:topics:reply"
 5) "cid:2:privileges:groups:find"
 6) "cid:2:privileges:groups:read"
 7) "cid:2:privileges:groups:topics:create"
 8) "cid:2:privileges:groups:topics:reply"
 9) "cid:3:privileges:groups:find"
10) "cid:3:privileges:groups:read"
11) "cid:3:privileges:groups:topics:create"
12) "cid:3:privileges:groups:topics:reply"
13) "cid:4:privileges:groups:find"
14) "cid:4:privileges:groups:read"
15) "cid:4:privileges:groups:topics:create"
16) "cid:4:privileges:groups:topics:reply"
17) "registered-users"
18) "administrators"
19) "cid:5:privileges:groups:find"
20) "cid:5:privileges:groups:read"
21) "cid:5:privileges:groups:topics:create"
22) "cid:5:privileges:groups:topics:reply"