[Unit]
Description=Update Conservancy website checkout
[Service]
Type=oneshot
User=www
User=www-data
WorkingDirectory=/var/www/website
ExecStart=/var/www/website/systemd/conservancy-www-update.sh
SystemCallFilter=~@clock @cpu-emulation @debug @module @mount @obsolete
CapabilityBoundingSet=
NoNewPrivileges=true