Add WorkingDirectory to create and use the certificates within /var/lib/syncthing-relaysrv. Add RootDirectory to chroot(2) the whole thing into that directory.