The Riemann service uses sudo in order to impersonate. If the OS requires a TTY for sudo commands, the Riemann service will fail to start.
We need to either:
Validate that the root user doesn't require tty; or
(Preferred approach) Use the User and Group keywords in the service definition, and move the PostStart elsewhere (Riemann needs to run as the riemann user, and the post-start needs to run as cfyuser).