graphene-os-server-infrastr.../systemd/system/certbot-renew.service.d/mail.grapheneos.org.conf
Daniel Micay 2a33c3b962 initial certbot-renew service hardening
This doesn't switch to using a dedicated certbot user yet since the
hooks used across the services will all still need to work.
2022-08-10 11:32:48 -04:00

5 lines
113 B
Plaintext

[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
PrivateUsers=false