I set the following ACL on my web directory:

setfacl -R -d -m mask:002 /var/www

and then created a file as root that I expected to be readable by the default (apache) group.

-rw--w-r--+ 1 root apache 0 Dec 17 22:32 newfile.py

When I run getfacl on the file, I get:

# file: newfile.py
# owner: root
# group: apache
user::rw-
group::rwx #effective:-w-
mask::-w-
other::r--

I'm not sure how to read this- but all I know is that the webserver is throwing a permissions error because apache can't read the file. Can anyone explain what is going on here?