[Unit]
Description=Renew the %i certificate from Vault
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
EnvironmentFile=/etc/vault-cert/%i.env
ExecStart=/usr/local/sbin/vault-cert-renew
PrivateTmp=true
NoNewPrivileges=true
ProtectHome=true