A web server cannot read files in a custom directory with SELinux enforcing. How do you fix it?

Label the directory with the correct type and make it persistent:

bash semanage fcontext -a -t httpdsyscontentt "/web(/.)?" restorecon -Rv /web

Check denials with ausearch -m AVC -ts recent. Do not disable SELinux.