[Unit]
Description=Vacuum Wall ACME Certificate Renewal

[Service]
Type=oneshot
# Run as the daemon user, not the WebUI user: it owns the project tree
# (and the ACME home) in production, and acme.sh chmods its config home
# to 700 and its keys/confs to 600 on every run. Running as the WebUI
# user left the tree unreadable to the daemon (and vice versa) whenever
# the two users' runs interleaved.
User={{ USER_DAEMON_NAME }}
WorkingDirectory={{ PROJECT_DIR }}
Environment=ACME_HOME={{ PROJECT_DIR }}/data/acme
Environment=HOME={{ PROJECT_DIR }}
# --log: persistent on-disk transcript of the raw CA exchange (journald
# captures stdout regardless; the file survives journal retention).
ExecStart={{ ACME_HOME }}/acme.sh --cron --home {{ ACME_HOME }} --config-home {{ ACME_HOME }} --log