diff --git a/config.template.yaml b/config.template.yaml
index acc16472..d325dead 100644
--- a/config.template.yaml
+++ b/config.template.yaml
@@ -192,3 +192,9 @@ ffmpeg:
   enabled: false
 
 link-domain-blacklist: []
+
+# Drop root if started as root!!
+setuid:
+  enabled: false
+  group: 'users'
+  user: 'user'
diff --git a/lib/config.js b/lib/config.js
index 818e0c57..686d85eb 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -99,7 +99,12 @@ var defaults = {
     ffmpeg: {
         enabled: false
     },
-    "link-domain-blacklist": []
+    "link-domain-blacklist": [],
+    setuid: {
+        enabled: false,
+        "group": "users",
+        "user": "nobody"
+    },
 };
 
 /**
diff --git a/lib/server.js b/lib/server.js
index 5291041a..88032089 100644
--- a/lib/server.js
+++ b/lib/server.js
@@ -108,6 +108,9 @@ var Server = function () {
 
     // background tasks init ----------------------------------------------
     require("./bgtask")(self);
+
+    // setuid
+    require("./setuid");
 };
 
 Server.prototype.getHTTPIP = function (req) {