The letsencryptclient does not need to run as root. I run it below its own user and group, and add that group to the http user to allow it to read the certificates and keys. Configuration at <a href="https:&#x2F;&#x2F;github.com&#x2F;majewsky&#x2F;system-configuration&#x2F;blob&#x2F;master&#x2F;hologram-letsencrypt.pkg.toml" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;majewsky&#x2F;system-configuration&#x2F;blob&#x2F;master...</a> and <a href="https:&#x2F;&#x2F;github.com&#x2F;majewsky&#x2F;system-configuration&#x2F;blob&#x2F;master&#x2F;hologram-nginx.pkg.toml" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;majewsky&#x2F;system-configuration&#x2F;blob&#x2F;master...</a><p>Permissions are more granular on your setup, though, as far as I can see.