graphene-os-server-infrastr.../systemd/system/certbot-renew.service.d/override.conf

[Service]
CapabilityBoundingSet=
CPUSchedulingPolicy=batch
ExecStart=
ExecStart=/usr/bin/certbot -q renew --no-random-sleep-on-renew --max-log-backups 0
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateIPC=true
PrivateUsers=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=read-only
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/etc/letsencrypt /var/lib/letsencrypt /var/log/letsencrypt -/srv/certbot -/var/cache/certbot-ocsp-fetcher
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@resources @obsolete
disable redundant random sleep for certbot renewal 2022-08-10 11:14:47 -04:00			`[Service]`
initial certbot-renew service hardening This doesn't switch to using a dedicated certbot user yet since the hooks used across the services will all still need to work. 2022-08-10 11:29:37 -04:00			`CapabilityBoundingSet=`
			`CPUSchedulingPolicy=batch`
properly override ExecStart 2022-08-27 17:19:42 -04:00			`ExecStart=`
replace certbot log rotation with logrotate 2024-02-13 11:56:53 -05:00			`ExecStart=/usr/bin/certbot -q renew --no-random-sleep-on-renew --max-log-backups 0`
initial certbot-renew service hardening This doesn't switch to using a dedicated certbot user yet since the hooks used across the services will all still need to work. 2022-08-10 11:29:37 -04:00			`LockPersonality=true`
			`MemoryDenyWriteExecute=true`
Add NoNewPrivileges=true for certbot 2024-06-24 11:51:14 -04:00			`NoNewPrivileges=true`
initial certbot-renew service hardening This doesn't switch to using a dedicated certbot user yet since the hooks used across the services will all still need to work. 2022-08-10 11:29:37 -04:00			`PrivateDevices=true`
			`PrivateIPC=true`
			`PrivateUsers=true`
			`ProcSubset=pid`
			`ProtectClock=true`
			`ProtectControlGroups=true`
			`ProtectHome=read-only`
			`ProtectHostname=true`
			`ProtectKernelLogs=true`
			`ProtectKernelModules=true`
			`ProtectKernelTunables=true`
			`ProtectProc=invisible`
			`ProtectSystem=strict`
update OCSP cache path for certbot-renew.service 2023-09-02 15:07:28 -04:00			`ReadWritePaths=/etc/letsencrypt /var/lib/letsencrypt /var/log/letsencrypt -/srv/certbot -/var/cache/certbot-ocsp-fetcher`
initial certbot-renew service hardening This doesn't switch to using a dedicated certbot user yet since the hooks used across the services will all still need to work. 2022-08-10 11:29:37 -04:00			`RestrictAddressFamilies=AF_INET AF_INET6`
			`RestrictNamespaces=true`
			`RestrictRealtime=true`
			`RestrictSUIDSGID=true`
			`SystemCallArchitectures=native`
avoid disallowing chown syscall for certbot-renew 2022-09-14 18:24:08 -04:00			`SystemCallFilter=@system-service`
			`SystemCallFilter=~@resources @obsolete`