{DOCROOT} and {DOCROOT_CLIENT} both point to /var/www/domain.tld/web/ Shouldn't {DOCROOT_CLIENT} point to /var/www/domain.tld/ ?
No. {DOCROOT_CLIENT} is the real path /var/www/clients/clientX/webX while {DOCROOT} is the symlinked path /var/www/domain.tld