hypnotoad and root access

[mab974]

I am currently developing an application that needs root access. Either
to update some files or to run external commands. What is the best way to
proceed from a security point of view?
For now the application is launched via systemd in root:root mode by
hypnotoad.

Thanks!

[Grinnz]

You can start the application as root and have the workers drop privileges using https://metacpan.org/pod/Mojolicious::Plugin::SetUserGroup but this does not help if the workers also need privileges. My recommendation would be to create a user that has sudo privileges to only run the commands it needs to run and run hypnotoad as that user.