diff --git a/tools/dnc/README.md b/tools/dnc/README.md
index 6fe2748..fffb379 100644
--- a/tools/dnc/README.md
+++ b/tools/dnc/README.md
@@ -46,8 +46,10 @@
 To initiate, generate a certificate authority and a server certificate:
 
 ```shell
-sudo dhtnet-crtmgr --setup -o /etc/dhtnet/
+sudo dhtnet-crtmgr --setup -o /usr/local/etc/dhtnet/
 ```
+The server will cache some values in `/var/run/dhtnet`. If this must be changed,
+you can remove the line `Environment="DHTNET_CACHE_DIR=/var/run/dhtnet"` in `dnc.service.in`.
 Then, launch the dnc service:
 ```shell
 systemctl start dnc.service
diff --git a/tools/dnc/dnc.cpp b/tools/dnc/dnc.cpp
index 3923716..bce0388 100644
--- a/tools/dnc/dnc.cpp
+++ b/tools/dnc/dnc.cpp
@@ -62,9 +62,7 @@
          const bool anonymous)
     : logger(dht::log::getStdLogger())
     , ioContext(std::make_shared<asio::io_context>()),
-    iceFactory(std::make_shared<IceTransportFactory>(logger)),
-    certStore(std::make_shared<tls::CertificateStore>(PATH/"certstore", logger)),
-    trustStore(std::make_shared<tls::TrustStore>(*certStore))
+    iceFactory(std::make_shared<IceTransportFactory>(logger))
 {
     ioContextRunner = std::thread([context = ioContext, logger = logger] {
         try {
@@ -76,6 +74,9 @@
         }
     });
 
+    certStore = std::make_shared<tls::CertificateStore>(cachePath()/"certStore", logger);
+    trustStore = std::make_shared<tls::TrustStore>(*certStore);
+
     auto ca = identity.second->issuer;
     trustStore->setCertificateStatus(ca->getId().toString(), tls::TrustStore::PermissionStatus::ALLOWED);
 
diff --git a/tools/dnc/systemd/dnc.service.in b/tools/dnc/systemd/dnc.service.in
index dedcea4..3f0568e 100644
--- a/tools/dnc/systemd/dnc.service.in
+++ b/tools/dnc/systemd/dnc.service.in
@@ -2,42 +2,20 @@
 Description=Dnc server
 Documentation=man:dnc(1)
 After=network.target
+Wants=network-online.target
+Documentation=https://git.jami.net/savoirfairelinux/dhtnet/blob/master/tools/dvpn/README.md
 
 [Service]
-Type=simple
-User=dnc
-Group=dnc
+Type=exec
+Environment="DHTNET_CACHE_DIR=/var/run/dhtnet"
 ExecStart=@bindir@/dnc -l -d @sysconfdir@/dhtnet/dnc.yaml -c @sysconfdir@/dhtnet/id/id-server.crt -p @sysconfdir@/dhtnet/id/id-server.pem
 Restart=on-failure
-RestartSec=2s
-LimitNOFILE=65536
-DynamicUser=yes
-KillMode=process
-WorkingDirectory=/tmp
-
-# Hardening
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-LockPersonality=yes
-NoNewPrivileges=yes
-PrivateDevices=yes
-PrivateTmp=yes
-PrivateUsers=yes
-ProtectClock=yes
-ProtectControlGroups=yes
-ProtectHome=yes
-ProtectHostname=yes
-ProtectKernelLogs=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
 ProtectSystem=strict
-ReadOnlyDirectories=/
-ReadWriteDirectories=-/proc/self
-ReadWriteDirectories=-/var/run
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-RestrictNamespaces=yes
-RestrictRealtime=yes
-SystemCallArchitectures=native
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+PrivateDevices=yes
 SystemCallFilter=@system-service
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target
\ No newline at end of file