[Unit]
Description=Vacuum Wall ACME Certificate Renewal Timer

[Timer]
# Daily only: ZeroSSL backs off a failed validation for 24h per domain
# (Retry-After: 86400). With two runs a day every attempt landed inside
# the previous attempt's backoff window, re-arming it — a permanent
# renewal lockout. Attempts >24h apart are required for the backoff to
# ever expire (acme.sh discussion #6419).
OnCalendar=*-*-* 00:00:00
Persistent=true
RandomizedDelaySec=300

[Install]
WantedBy=timers.target