- create user cacert-goocsp in postinst script - use CAP_NET_BIND_SERVICE in systemd unit to allow binding to priviledged ports - change config file path to /etc/goocsp/config.yaml