This doesn't switch to using a dedicated certbot user yet since the hooks used across the services will all still need to work.