[Unit]
Description=Let's Encrypt renewal
OnFailure=systemd-notifier.cymais@%n.service

[Service]
Type=oneshot
ExecStart=/usr/bin/certbot renew --quiet --agree-tos
ExecStartPost=/bin/systemctl reload nginx.service