Use the `script` feature

nixos/modules/issuer.nix

@@ -96,8 +96,13 @@ in {
         # over TLS and require a certificate.
         lib.optional cfg.tls "cert-${cfg.domain}";
 
-      serviceConfig = {
-        ExecStart =
+      # It really shouldn't ever exit on its own!  If it does, it's a bug
+      # we'll have to fix.  Restart it and hope it doesn't happen too much
+      # before we can fix whatever the issue is.
+      serviceConfig.Restart = "always";
+      serviceConfig.Type = "simple";
+
+      script =
         let
           # Compute the right command line arguments to pass to it.  The
           # signing key is only supplied when using the Ristretto issuer.
@@ -121,12 +126,6 @@ in {
               "--http-port 80";
         in
           "${cfg.package}/bin/PaymentServer-exe ${issuerArgs} ${databaseArgs} ${httpsArgs}";
-        Type = "simple";
-        # It really shouldn't ever exit on its own!  If it does, it's a bug
-        # we'll have to fix.  Restart it and hope it doesn't happen too much
-        # before we can fix whatever the issue is.
-        Restart = "always";
-      };
     };
 
     # Certificate renewal.  We must declare that we *require* it in our