SystemD: relative timer logic. Relative timer logic suits the API based updates better. There seems to be CVE updates every hour. To distribute the load evenly, this updates the database every two hours, with additional 15 minute random delay.
SystemD: use installdir path & user from docs. Docs for Production Installation suggests certain paths & user. If other paths or user are used, they could still be updated accordingly, but the current "variables" doesn't exist and might be confusing.