gateway should run as few things as possible as the root user

many/all services on the gateway are run as root, including monitoring. there should be dedicated non-privileged users running these things.