I've recently spent some time sandboxing nginx on my web server by running the master process as the user www-data instead of root, adding some seccomp filters

I've recently spent some time sandboxing nginx on my web server by running the master process as the user www-data instead of root, adding some seccomp filters through systemd and writing a custom AppArmor profile[1]. And the hardest part was dealing with certbot actually. Not least because it's written in Python, and so adding capabilities to the script itself didn't do a thing. They needed to be added to the Python interpreter executable[2]. The whole thing seemed more complicated than its worth. I've looked briefly at what supposedly configuring an OpenBSD server with OpenBSD httpd + OpenBSD's acme-client would look like, and it seems so much easier and the secure configuration is the official one, so I'd need to worry much less about updates breaking my stuff. So I'm considering moving to OpenBSD for my web server. The only thing giving me pause currently is that I saw no mention of HTTP/2 support, so I suspect there is none. Although maybe I don't need it. We'll see. [1]: That last apart I actually already had, but it needed some tweaking this time, because I moved nginx's PID file to its own runtime directory created by systemd, instead of allowing it to write to /run as root. [2]: Of course only for testing. I revoked them after verifying that everything works. And now they're only assigned dynamically by systemd when the service is run.