bitcoind.service: Can't open PID file /run/bitcoind/bitcoind.pid (yet?) after start: Operation not permitted

On Ubuntu 20.04 LTS, I made a service / systemd unit for bitcoind, but when I start it, I get this error:

Can't open PID file /run/bitcoind/bitcoind.pid (yet?) after start: Operation not permitted

Which sounds like a permission issue(?), but my understanding is that the PID file and/or folder containing it is kind of ephemeral, like only appearing while the service is running, and so how would you assign lasting permissions to something that comes and goes? It also seems off that permissions would need to be altered at all for this. What can I do to get the unit running correctly?

● bitcoind.service - Bitcoin daemon
     Loaded: loaded (/etc/systemd/system/bitcoind.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Sun 2021-06-20 09:46:57 CDT; 14s ago
    Process: 104861 ExecStart=/usr/local/bin/bitcoind -daemon -pid=/run/bitcoind/bitcoind.pid -conf=/home/first/.bitcoin/bitcoin.conf -datadir=/blockchain/.bitcoin/data (code=exited, status=0/SUCCESS)
   Main PID: 104866 (code=exited, status=1/FAILURE)

Jun 20 09:46:57 server systemd[1]: Starting Bitcoin daemon...
Jun 20 09:46:57 server systemd[1]: bitcoind.service: Can't open PID file /run/bitcoind/bitcoind.pid (yet?) after start: Operation not permitted
Jun 20 09:46:57 server systemd[1]: Started Bitcoin daemon.
Jun 20 09:46:57 server systemd[1]: bitcoind.service: Main process exited, code=exited, status=1/FAILURE
Jun 20 09:46:57 server systemd[1]: bitcoind.service: Failed with result 'exit-code'.

I'm using this bitcoind.service file adapted from Stadicus' Raspibolt setup guide:

# RaspiBolt: systemd unit for bitcoind
# /etc/systemd/system/bitcoind.service

[Unit]
Description=Bitcoin daemon
After=network.target

[Service]

# Service execution
###################

ExecStart=/usr/local/bin/bitcoind -daemon \
                                  -pid=/run/bitcoind/bitcoind.pid \
                                  -conf=/home/first/.bitcoin/bitcoin.conf \
                                  -datadir=/blockchain/.bitcoin/data


# Process management
####################
Type=forking
PIDFile=/run/bitcoind/bitcoind.pid
#ExecStartPost=/bin/sh -c 'chown first:first /run/bitcoind/bitcoind.pid'
#Restart=on-failure
#TimeoutSec=300
#RestartSec=30


# Directory creation and permissions
####################################

# Run as bitcoin:bitcoin
User=first
Group=first

# /run/bitcoind
RuntimeDirectory=bitcoind
RuntimeDirectoryMode=0710

# Hardening measures
####################

# Provide a private /tmp and /var/tmp.
PrivateTmp=true

# Mount /usr, /boot/ and /etc read-only for the process.
ProtectSystem=full

# Deny access to /home, /root and /run/user
ProtectHome=true

# Disallow the process and all of its children to gain
# new privileges through execve().
NoNewPrivileges=true

# Use a new /dev namespace only populated with API pseudo devices
# such as /dev/null, /dev/zero and /dev/random.
PrivateDevices=true

# Deny the creation of writable and executable memory mappings.
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target

You can see I tried adding this to the bitcoind.service file:

ExecStartPost=/bin/sh -c 'chown first:first /run/bitcoind/bitcoind.pid'

But it didn't work and seems to execute before a bitcoind.pid file exists.

Two findings:

1. The 'Hardening Measures' section of my bitcoin.service files contains:

# Deny access to /home, /root and /run/user
ProtectHome=true

/home/.bitcoin is where I have the bitcoin.conf file, so that's the problem. Relocating bitcoin.conf elsewhere, or disabling ProtectHome allows the service to start successfully in this particular case.

2. The following error message was unrelated to the service failure:

Can't open PID file /run/bitcoind/bitcoind.pid (yet?) after start: Operation not permitted

This message comes up sporadically even when the service is starting normally and so, apparently, it's not an issue at all in this case.

Can't open PID file /run/bitcoind/bitcoind.pid

Either /run or /run/bitcoid or /run/bitcoind/bitcoind.pid does not exist or if it does it is not owned by the user of group that needs it.

User=first would assume user is "first" and when the pid file is owned by another user(/group) then "first" you also get a "permission denied".

# Run as bitcoin:bitcoin
User=first
Group=first

Mind that it states here that it should be:

# Run as bitcoin:bitcoin
User=bitcoin
Group=bitcoin

and not "first".