graphene-os-server-infrastr.../systemd/system/certbot-renew.service.d/local.conf

[Service]
CapabilityBoundingSet=
CPUSchedulingPolicy=batch
ExecStart=
ExecStart=/usr/bin/certbot -q renew --no-random-sleep-on-renew
LockPersonality=true
MemoryDenyWriteExecute=true
PrivateDevices=true
PrivateIPC=true
PrivateUsers=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=read-only
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/etc/letsencrypt /var/lib/letsencrypt /var/log/letsencrypt -/srv/certbot -/etc/nginx/ocsp-cache
RemoveIPC=true
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@resources @obsolete
disable redundant random sleep for certbot renewal 2022-08-10 11:14:47 -04:00			`[Service]`
initial certbot-renew service hardening This doesn't switch to using a dedicated certbot user yet since the hooks used across the services will all still need to work. 2022-08-10 11:29:37 -04:00			`CapabilityBoundingSet=`
			`CPUSchedulingPolicy=batch`
properly override ExecStart 2022-08-27 17:19:42 -04:00			`ExecStart=`
disable redundant random sleep for certbot renewal 2022-08-10 11:14:47 -04:00			`ExecStart=/usr/bin/certbot -q renew --no-random-sleep-on-renew`
initial certbot-renew service hardening This doesn't switch to using a dedicated certbot user yet since the hooks used across the services will all still need to work. 2022-08-10 11:29:37 -04:00			`LockPersonality=true`
			`MemoryDenyWriteExecute=true`
			`PrivateDevices=true`
			`PrivateIPC=true`
			`PrivateUsers=true`
			`ProcSubset=pid`
			`ProtectClock=true`
			`ProtectControlGroups=true`
			`ProtectHome=read-only`
			`ProtectHostname=true`
			`ProtectKernelLogs=true`
			`ProtectKernelModules=true`
			`ProtectKernelTunables=true`
			`ProtectProc=invisible`
			`ProtectSystem=strict`
certbot-renew: make nginx ocsp-cache dir optional 2022-08-28 15:46:33 -04:00			`ReadWritePaths=/etc/letsencrypt /var/lib/letsencrypt /var/log/letsencrypt -/srv/certbot -/etc/nginx/ocsp-cache`
initial certbot-renew service hardening This doesn't switch to using a dedicated certbot user yet since the hooks used across the services will all still need to work. 2022-08-10 11:29:37 -04:00			`RemoveIPC=true`
			`RestrictAddressFamilies=AF_INET AF_INET6`
			`RestrictNamespaces=true`
			`RestrictRealtime=true`
			`RestrictSUIDSGID=true`
			`SystemCallArchitectures=native`
avoid disallowing chown syscall for certbot-renew 2022-09-14 18:24:08 -04:00			`SystemCallFilter=@system-service`
			`SystemCallFilter=~@resources @obsolete`