OSM tile server "renderd" keeps using wrong user

Question

I set up my machine to serve tiles following instructions on https://www.linuxbabe.com/ubuntu/openstreetmap-tile-server-ubuntu-20-04-osm.

I am currently on Ubuntu 20.04.3 LTS.

I imported the data into the database, created system user osm and database user osm. Running renderd in foreground seems to work (tiles are rendered), but fails when run as daemon. This is likely because the process (?) is alwas run as user _renderd (which I did not create). Of course this user has no database permissions whatsoever, which then causes the daemon to crash.

In /etc/init.d/renderd I specified the following:

PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="Mapnik rendering daemon"
NAME=renderd
DAEMON=/usr/bin/$NAME
DAEMON_ARGS="-c /etc/renderd.conf"
PIDSOCKDIR=/run/$NAME
PIDFILE=$PIDSOCKDIR/$NAME.pid
SCRIPTNAME=/etc/init.d/$NAME
RUNASUSER=osm

For completness here's the content of /etc/renderd.conf

; BASIC AND SIMPLE CONFIGURATION:
[renderd]
stats_file=/var/run/renderd/renderd.stats
socketname=/var/run/renderd/renderd.sock
num_threads=4
tile_dir=/var/lib/mod_tile

[mapnik]
plugins_dir=/usr/lib/mapnik/3.1/input
font_dir=/usr/share/fonts/truetype
font_dir_recurse=true

[default]
URI=/osm/
XML=/home/osm/openstreetmap-carto/style.xml
HOST=localhost
TILEDIR=/var/lib/mod_tile
TILESIZE=256

So is specified "RUNASUSER" to use the correct user, but this seems not to be respected.

Where does the user "_renderd" come from and why is it used? More importantly what can I do to prevent this behaviour and force using user "osm"?

Answer 1

Look for

/etc/systemd/system/multi-user.target.wants/renderd.service

and specify the user there as well

[Service]
ExecStart=/usr/bin/renderd -f
User=osm

I don't know if both changes are strictly necessary, but I found this is what changed the user it ran under. The renderd package from osmadmins created that file, and created the _renderd user. Don't forget to change the ownership of certain directories as those instructions specify, or renderd will fail with permission problems once it is running as osm.

There are other instructions for Debian that simply use _renderd for the database user, avoiding this complication:

https://switch2osm.org/serving-tiles/manually-building-a-tile-server-debian-11/

Answer 2

On Ubuntu 22.04, I eventually tracked this down to: /usr/lib/tmpfiles.d/renderd.conf

d       /run/renderd    0755    _renderd     _renderd     -       -

Update the "_renderd" user and group to your desired user/group