Instead of hand-rolling our own systemd integration, we can rely on RPM
macros maintained for us. This results in the following changes in the
main package's scriptlets:

    --- scripts.old	2019-02-14 10:50:21.039974337 +0100
    +++ scripts.new	2019-02-14 10:49:24.649144061 +0100
    @@ -12,14 +12,24 @@

     exit 0
     postinstall scriptlet (using /bin/sh):
    -/bin/systemctl daemon-reload >/dev/null 2>&1 || :
    -chown varnishlog:varnish /var/log/varnish/
     /sbin/ldconfig
    +
    +if [ $1 -eq 1 ] ; then
    +        # Initial installation
    +        systemctl preset varnish varnishncsa >/dev/null 2>&1 || :
    +fi
     preuninstall scriptlet (using /bin/sh):
    -if [ $1 -lt 1 ]; then
    -  # Package removal, not upgrade
    -  /bin/systemctl --no-reload disable varnish.service > /dev/null 2>&1 || :
    -  /bin/systemctl stop varnish.service > /dev/null 2>&1 || :
    -  /bin/systemctl stop varnishncsa.service > /dev/null 2>&1 || :
    +
    +if [ $1 -eq 0 ] ; then
    +        # Package removal, not upgrade
    +        systemctl --no-reload disable varnish varnishncsa > /dev/null 2>&1 || :
    +        systemctl stop varnish varnishncsa > /dev/null 2>&1 || :
     fi
    -postuninstall program: /sbin/ldconfig
    +postuninstall scriptlet (using /bin/sh):
    +/sbin/ldconfig
    +
    +systemctl daemon-reload >/dev/null 2>&1 || :
    +if [ $1 -ge 1 ] ; then
    +        # Package upgrade, not uninstall
    +        systemctl try-restart varnish varnishncsa >/dev/null 2>&1 || :
    +fi

The only major change is that the varnish and varnishncsa services will
be restarted during a varnish upgrade. This is needed because otherwise
reloading a VCL that uses vmod_std after the upgrade (and without
restarting) would fail because the running varnishd wouldn't recognize
the shared object's expected ABI.

One unrelated change is the handling of /var/log/varnish/ ownership. As
it was done until now a fresh install would yield a corrupted package:

    $ rpm --verify varnish
    .....UG..    /var/log/varnish

Since we already create the users and group before installing the files,
we can already ask RPM to chown the directory itself.