Make unprivileged user/group for the internal client resp. webserver configurable.

1 files changed, 4 insertions, 4 deletions

diff --git a/lacme b/lacme
index 088e393..e4b8e01 100755
--- a/lacme
+++ b/lacme
@@ -91,8 +91,8 @@ do {
     my %valid = (
         client => {
             socket  => (defined $ENV{XDG_RUNTIME_DIR} ? "$ENV{XDG_RUNTIME_DIR}/S.lacme" : undef),
-            user    => 'nobody',
-            group   => 'nogroup',
+            user    => '@@lacme_client_user@@',
+            group   => '@@lacme_client_group@@',
             command => '@@libexecdir@@/lacme/client',
             # the rest is for the ACME client
             map {$_ => undef} qw/server timeout SSL_verify SSL_version SSL_cipher_list/
@@ -100,8 +100,8 @@ do {
         webserver => {
             listen                => '@@runstatedir@@/lacme-www.socket',
             'challenge-directory' => undef,
-            user                  => 'www-data',
-            group                 => 'www-data',
+            user                  => '@@lacme_www_user@@',
+            group                 => '@@lacme_www_group@@',
             command               => '@@libexecdir@@/lacme/webserver',
             iptables              => 'No'