[Unit]
Description=get let's encrypt certificate via dehydrated

[Service]
Type=oneshot
User=dehydrated
Group=ssl-cert
WorkingDirectory=/var/lib/dehydrated
ExecStart=/usr/bin/dehydrated -c
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/dehydrated
PrivateTmp=yes