Unix needs root priviledges to bind to port 80 and 443, but Resin should avoid running as root for security. It's best to use a port mapper or firewall to map the protected port to an unprotected port like 8080 to avoid running as root entirely.

On Linux, use iptables. An example iptable configuration.

If iptables is not available, the user-name and group-name configuration can use setuid to change Resin's user after binding ports.

When the HTTP port is mapped from 80 to port 8080 or when a load balancer redirects to an internal IP address, the application often needs the external address, not the server's view.

Use host-name in the <host> to set the canonical host and port name to the external address.

<host host-name="http://foo.com:80"> <host-alias>foo.com</host-alias> ... </host>