[Unit]
Description=Reconcile tenant TLS domains every 10 minutes

[Timer]
OnBootSec=2min
OnUnitActiveSec=10min
# Spread load so many servers do not all hit the ACME API at once.
RandomizedDelaySec=90s
Persistent=true

[Install]
WantedBy=timers.target