currently IIRC there is no easy way to privdrop a go program. one method might be to LockOSThread, setuid and exec self.

in the future it should be possible to pledge pf_exporter, but not currently because the pf pledge doesn't include at least DIOCGETQUEUES, possibly more require pf ioctls.

currently my method for running pf_exporter is:

doas -u nobody ./pf_exporter -pf.fd 0 0<>/dev/pf

abusing ksh to open the pf descriptor for me. eventually something like this should go in an rc script. if privdropping worked, we probably would not need to pre-open the pf fd.

note: doas closes every fd after STDERR_FILENO, so we use stdin (fd 0)

instead of hand-rolling the http server, https://godoc.org/github.com/prometheus/client_golang/prometheus/promhttp provides a convenient wrapper.

https://prometheus.io/docs/instrumenting/writing_exporters/#collectors provides an overview.