Running with least-priv user#5

Perhaps something to add to the README. You can run taskbot with a non-admin user, using the following role and amps (provided in Roxy ml-config format): <role> <role-name>${app-name}-amp-role</role-name> <description>A role for all amps of the ${app-name} application</description> <privileges> <!-- required by taskbot --> <privilege> <privilege-name>xdmp:invoke</privilege-name> </privilege> <privilege> <privilege-name>xdmp:get-server-field</privilege-name> </privilege> <privilege> <privilege-name>xdmp:set-server-field</privilege-name> </privilege> <privilege> <privilege-name>xdmp:spawn</privilege-name> </privilege> </privileges> </role> <amp> <namespace>ns://blakeley.com/taskbot</namespace> <local-name>maybe-fatal</local-name> <doc-uri>/ext/mlpm_modules/taskbot/src/taskbot.xqm</doc-uri> <db-name>${modules-db}</db-name> <role-name>${app-name}-amp-role</role-name> </amp> <amp> <namespace>ns://blakeley.com/taskbot</namespace> <local-name>FATAL</local-name> <doc-uri>/ext/mlpm_modules/taskbot/src/taskbot.xqm</doc-uri> <db-name>${modules-db}</db-name> <role-name>${app-name}-amp-role</role-name> </amp> <amp> <namespace>ns://blakeley.com/taskbot</namespace> <local-name>fatal-set</local-name> <doc-uri>/ext/mlpm_modules/taskbot/src/taskbot.xqm</doc-uri> <db-name>${modules-db}</db-name> <role-name>${app-name}-amp-role</role-name> </amp> <amp> <namespace>ns://blakeley.com/taskbot</namespace> <local-name>spawn-function-with-policy</local-name> <doc-uri>/ext/mlpm_modules/taskbot/src/taskbot.xqm</doc-uri> <db-name>${modules-db}</db-name> <role-name>${app-name}-amp-role</role-name> </amp> Note: depending on what happens in the spawned function one provides oneself, one may need additional application specific privs..