Help me understand how the user accounts are used in the switch2osm server set up instructions.

You must understand there are two different sets of accounts: The Unix user accounts, and the PostgreSQL accounts. They are not necessarily aligned, however PostgreSQL's default setting is that if you have the Unix account X you will also use the PostgreSQL account X.

The Unix superuser is root and does not (by default) exist in PostgreSQL, and the PostgreSQL superuser is postgres, a non-privileged account in Unix.

The Unix user renderaccount does not need sudo privileges. In order to create this account in PostgreSQL, you need to have PostgreSQL superuser rights, which you gain by becoming the Unix user postgres; you cannot create this account as root because there is no matching PostgreSQL user.

Giving the renderaccount PostgreSQL superuser rights, while not strictly needed, makes things easier down the line.

Indeed in more recent PostgreSQL versions, createuser doesn't prompt you for superuser, and you must specify --interactive if you want the old behaviour, or just specify -s to make the account a superuser. If you have created the account already but without superuser, become the Unix user postgres and run

psql -c 'alter role renderaccount with superuser'

The reason why the creation of a Unix account "renderaccount" is suggested is actually because of what we'd seen happen with previous versions of the instructions. There people either used "www-data" (often used as a default web server process) or "root" (definitely not recommended. Using "renderaccount" was designed to work independently of whatever might be there on a a server and not break anything. The assumption was that people might use these instructions on a machine that already exists, and by default if you set up a Ubuntu server you're asked for an initial user account. "renderaccount" was chosen because it's new and likely won't break anything that already exists.

As Frederik says there are two sets of accounts involved here - Unix accounts and PostgreSQL users. The guide tries to gloss over that and uses the same name for both (hence the "createuser renderaccount" to create a postgres user of that name).

If there's anything that you think needs to be clarified better please let us know - either by just saying what needs to be changed at the wordpress site or by a pull request to the github one. The Wordpress site is actually the "live" one, but the text content of the main pages is the same, so you can actually comment on either.