When running a Django application on a Debian server, should you create some sort of application user (e.g. "myappuser") and run the gunicorn process as that user or can/should gunicorn be run as root? Would running it as root create a security risk? I've installed gunicorn using APT rather than install it in a virtual environment. Running it as an application user seems to make the configuration more difficult as you have to give that user permission to write to the log files, the PID file, etc. It seems easier to run it as root.
exec gunicorn $DJANGO_WSGI_MODULE:application \
--name myapp \
--user=$USER \ # <- who should this be?
--group=$GROUP \