I have a custom daemon which manages a blacklist for my proxy (HAProxy). When the blacklist is updated I need to reload haproxy so that it has the most recent proxy. Unfortunately manually reloads of haproxy are not reasonable because the blacklist could be updated several times a day.
To solve this problem I created a script to reload haproxy but it needs to run as root so it can go through systemctl to be properly managed. This script is in the daemon user's bin directory. I have also changed the ownership of the file to another user (root for now) and permissions to -r-xr-x---. I plan to add the daemon user to the sudoers file with no password access to this script.
I want to know is this practice "secure" or is there a better alternative?