security/acme-client: use a dedicated unprivileged user/group

[tgyurci_gmail.com]

Bump PORTREVISION

[brnrd]

Sorry to leave this laying around for so long...

The whole premise of acme-client is that it runs as root but drops privileges for any operation that doesn't require root.
Check the documentation on https://kristaps.bsd.lv/acme-client/

Your change only changes the user that root drops privs to. I don't see any value in that, am I missing something?

[tgyurci_gmail.com]

The rationale is that it does not use the "shared" nobody. I have disabled outgoing network traffic on my server, and having a separate user for acme-client allows to whitelist that user and therefore that "service" only.

[brnrd]

In D9103#304138, @tgyurci_gmail.com wrote:

The rationale is that it does not use the "shared" nobody. I have disabled outgoing network traffic on my server, and having a separate user for acme-client allows to whitelist that user and therefore that "service" only.

Understood. Do you already have this running on your systems?
It will take me a while before I have certs that need to renew 😄

[tgyurci_gmail.com]

I do not run it in production, but I have tested it, and worked well.

[brnrd]

Dang. Forgot to do the "complete link" to review in the commit...