v.34.5_fix_systemd

docs/ACME_PROVIDERS.md

@@ -2,6 +2,15 @@
 
 Certificates are managed under **Certificates**. You can import a PEM pair, reference accessible external certificate files or request a managed ACME certificate. Issuing a certificate does **not** automatically assign it to a Vhost; choose the certificate in the intended frontend/Vhost afterwards.
 
+On Linux, the updated DEB/RPM service allows **read-only** access to
+external certificate paths according to the `rustproxy` user's Unix group/
+ACL permissions, including paths inside `/home`. A separate safety rule still
+requires the actual PEM files and real parent directories to be owned by root
+or `rustproxy`; user-owned `/home/alice` is therefore unsuitable as a PEM
+ancestor even though it can host a Web Server document root. See
+[Installation: external paths](INSTALL.md#linux-debrpm-read-only-access-to-external-paths)
+for scoped ACLs and Certbot renewal handling.
+
 ## Supported certificate methods
 
 | Mode | Requirements |