grant traefik write access to state/acme.json

and ensure the file exists and is private before launching

tljh/systemd-units/traefik.service

@@ -7,13 +7,14 @@ After=network.target
 [Service]
 User=root
 Restart=always
-# process only needs to write acme.json file, no other files
+# process only needs to write state/acme.json file, no other files
 ProtectHome=tmpfs
 ProtectSystem=strict
 PrivateTmp=yes
 PrivateDevices=yes
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
+ReadWritePaths={install_prefix}/state/acme.json
 WorkingDirectory={install_prefix}/state
 ExecStart={install_prefix}/hub/bin/traefik \
             -c {install_prefix}/state/traefik.toml

tljh/traefik.py

@@ -77,3 +77,8 @@ def ensure_traefik_config(state_dir):
     with open(os.path.join(state_dir, "traefik.toml"), "w") as f:
         os.fchmod(f.fileno(), 0o744)
         f.write(new_toml)
+
+    # ensure acme.json exists and is private
+    with open(os.path.join(state_dir, "acme.json"), "a") as f:
+        os.fchmod(f.fileno(), 0o600)
+