[Unit]
Description=Smail certificate renewal
After=network-online.target nginx.service
Wants=network-online.target

[Service]
Type=oneshot
EnvironmentFile=/etc/smail/acme-dns.env
EnvironmentFile=/etc/smail/acme-renew.env
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/local/libexec/smail-acme/lego --path /var/lib/smail-acme-tls --email ${SMAIL_ACME_EMAIL} --accept-tos --key-type ec256 --dns ${SMAIL_ACME_DNS_PROVIDER} --domains ${SMAIL_MAIL_DOMAIN} --domains *.${SMAIL_MAIL_DOMAIN} --http-timeout 20 --cert.timeout 120 renew --days 30 --reuse-key --no-random-sleep
ExecStartPost=/opt/smail/smail-config --root /opt/smail --external-tls-dir /var/lib/smail-acme-tls/certificates --publish-external-tls /etc/nginx/smail/tls.pem
ExecStartPost=/usr/sbin/nginx -t
ExecStartPost=/usr/bin/systemctl reload nginx.service
StateDirectory=smail-acme-tls
StateDirectoryMode=0700
TimeoutStartSec=720
TimeoutStopSec=15
MemoryHigh=192M
MemoryMax=256M
MemorySwapMax=0
CPUQuota=100%
TasksMax=64
Environment=GOMEMLIMIT=64MiB
UMask=0077
PrivateTmp=true
ProtectHome=true
NoNewPrivileges=true