Forum OpenACS Q&A: Optimal users/permissions for multiple slave sites?

Posted by Stan Kaufman on
For multiple ACS installations, Jerry's How-to suggests creating separate users to go with the separate tablespaces (aka DBs in PG).

Should this separation extend to the users which own the nsd processes (and not just the users for logging into the DBs)? Or should the main AOLServer user (traditionally nsadmin) own all the nsd processes? If you put all your master/slave configs in a single nsd.tcl file, obviously you will start them all with a single user. But if you separate the files, you can have a different user per server instance.

So, which should it be:

./bin/nsd -kt nsd-master.tcl -u nsadmin -g web
./bin/nsd -kt nsd-slave1.tcl -u nsadmin -g web
./bin/nsd -kt nsd-slave2.tcl -u nsadmin -g web


./bin/nsd -kt nsd-master.tcl -u nsadmin -g web
./bin/nsd -kt nsd-slave1.tcl -u slave1 -g web
./bin/nsd -kt nsd-slave2.tcl -u slave2 -g web

(presuming you have users slave1 and slave2)

And what factors are important here: maintainability, clarity, efficiency, style, other? Does this really matter or not?