Hi Joel,
That seems to be a good setup. As for nsopenssl maybe some one can ask ScottG to fix the hardcoded path. Tom Jackson maybe? Based from memory I believe you can put the certs on a different path, but you just have to create the modules... blah blah dir since nsopenssl checks it on startup. Sorry poor memory still have to get back to OpenACS this days.
Putting no password for a user essentially makes the user unable to login unless you are coming from root. So you have to be root in order for you to su to postgres. It is however possible to ssh to a user without a password using keys.
It is really great to have volunteers like Joel moving forward OpenACS in the docs and installation process. Once OpenACS is easy to install its one less reason not to use it. LAMP tends be easier to install even the fact that it has more parts.
