acme.service

[Unit]
Description=ACME certificate renewal

[Service]
Type=oneshot
User=acme
Group=acme
PermissionsStartOnly=True
ExecStart=/usr/bin/acme-renew
ExecStartPost=!/usr/bin/acme-post
Restart=on-failure
StateDirectory=acme
ReadWritePaths=/etc/acme/
AmbientCapabilities=
CapabilityBoundingSet=
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
PrivateUsers=true
ProtectClock=true
ProtectControlGroups=yes
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=yes
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
#SecureBits=noroot-locked
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM