timer never used if service remains

manifests/ca/gencrl.pp

@@ -30,7 +30,7 @@ define cfssl::ca::gencrl (
       content => epp('cfssl/cfssl-gencrl.service.epp', { 'ca' => $_ca }),
     }
     ~> service { "cfssl-gencrl-${_ca}.service":
-      ensure   => 'running',
+      ensure   => 'stopped',
       enable   => true,
       provider => 'systemd',
     }

templates/cfssl-gencrl.service.epp

@@ -7,7 +7,6 @@ After=cfssl.service
 
 [Service]
 Type=oneshot
-RemainAfterExit=yes
 Environment=CRL=<%= $cfssl::crldir %>/crl-<%= $ca %>.<%= $cfssl::crl_extension %>
 ExecStart=sh -c 'echo "-----BEGIN X509 CRL-----" > $CRL ; cfssl crl -db-config <%= $cfssl::confdir %>/<%= $cfssl::params::db_config_json %> -ca <%= $cfssl::confdir %>/ca/<%= $ca %>.pem -ca-key <%= $cfssl::confdir %>/ca/<%= $ca %>-key.pem | fold -w 64 >> $CRL ; echo "-----END X509 CRL-----" >> $CRL'
 

templates/cfssl-gencrl.timer.epp

@@ -6,6 +6,7 @@ Description=CFSSL CRL generator for CA <%= $ca %>
 [Timer]
 OnCalendar=*-*-* <%= $cfssl::crl_gentimer %>
 Persistent=true
+OnActiveSec=10
 
 [Install]
 WantedBy=timers.target