mirror of
https://github.com/rkivalin/certforge.git
synced 2026-10-13 08:00:43 +00:00
Roman KivalinandClaude Opus 4.6
a100395097
- save_key was called on every renewal even when reusing an existing key, which caused EROFS errors under ProtectSystem=strict - Track whether the key is new/rotated via KeyResult.needs_save - DANE TLSA publication errors are logged but don't prevent hooks - Remove ProtectSystem=strict and ReadWritePaths from systemd service since users can configure arbitrary paths in config - Add file paths to write error messages for easier diagnosis Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
18 lines
330 B
Desktop File
18 lines
330 B
Desktop File
[Unit]
|
|
Description=Certforge ACME certificate renewal
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/bin/certforge renew
|
|
|
|
# Hardening
|
|
PrivateTmp=yes
|
|
NoNewPrivileges=yes
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictSUIDSGID=yes
|