dufs, restic: Use hash-existing-file to restart services after certificate renewal