blob: a724eba323ce8d0936c299eb998548ff5b71f23c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
|
[Unit]
Description=Check and renew ACME TLS certificates
After=network.target
Requires=network.target
AssertFileNotEmpty=/etc/acme/%I.conf
[Service]
# You need to configure http server
# so that directory "/run/acme-challenge"
# was the alias of "/.well-known/acme-challenge"
#
# Nginx example:
#
# location /.well-known/acme-challenge {
# alias /run/acme-challenge;
# }
RuntimeDirectory=acme-challenge
RuntimeDirectoryMode=0755
SuccessExitStatus=2
Environment="ACME_DIR=/var/lib/acme"
Environment="ACME_ARGS=-vbnN -a https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf"
Environment="ACME_ACCOUNT=letsencrypt"
EnvironmentFile=/etc/acme/%I.conf
ExecStartPre=/usr/bin/install -dm0700 "${ACME_DIR}/certs/%I"
ExecStopPost=/usr/bin/sh -c "[ ! -x '/etc/acme/%I.hook' ] || exec '/etc/acme/%I.hook'"
ExecStart=/usr/bin/acme-client $ACME_ARGS \
-f "${ACME_DIR}/accounts/${ACME_ACCOUNT}.pem" \
-c "${ACME_DIR}/certs/%I" \
-k "${ACME_DIR}/certs/%I/privkey.pem" \
-C /run/acme-challenge \
$ACME_DOMAINS
CapabilityBoundingSet=CAP_SYS_CHROOT CAP_SETUID CAP_SETGID
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ReadOnlyPaths=/
ReadWritePaths=/var/lib/acme
ReadWritePaths=/run/acme-challenge
|