Drupal 8 setting up private files folder

Base the path on app_root.

This works well if the web root is under a separate folder like /var/www/mysite/web.

$settings['file_private_path'] = $app_root . '/../private';

https://www.drupal.org/docs/8/core/modules/file/overview

An absolute path won’t pass validation checks.

$settings['file_private_path'] =  '/var/www/mysite/private';