Systemd Service Files Explained

[Unit]
Description=My Web Application
Documentation=https://example.com/docs
After=network.target postgresql.service
Wants=postgresql.service

[Service]
Type=simple
User=appuser
Group=appgroup
WorkingDirectory=/opt/myapp
ExecStart=/usr/bin/node /opt/myapp/server.js
Restart=always
RestartSec=5

# Environment
Environment=NODE_ENV=production
Environment=PORT=3000
EnvironmentFile=/opt/myapp/.env

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/myapp/data /var/log/myapp

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=myapp

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable myapp
sudo systemctl start myapp
sudo systemctl status myapp

# Oneshot example (database migration)
[Service]
Type=oneshot
ExecStart=/opt/myapp/migrate.sh
RemainAfterExit=yes

# Always restart (production services)
Restart=always
RestartSec=5

# Only restart on failure (not on clean exit)
Restart=on-failure
RestartSec=10

# Limit restart attempts
StartLimitIntervalSec=300
StartLimitBurst=5
# 5 restarts in 300 seconds, then give up

[Unit]
# Start after these services
After=network.target postgresql.service redis.service

# Start these services if not running
Wants=postgresql.service redis.service

# Fail if these aren't available
Requires=postgresql.service

# Only start if this is present
ConditionPathExists=/opt/myapp/server.js

[Service]
# Pre-start commands
ExecStartPre=/opt/myapp/check-config.sh
ExecStartPre=/opt/myapp/migrate.sh

# Main process
ExecStart=/usr/bin/node /opt/myapp/server.js

# Graceful reload
ExecReload=/bin/kill -HUP $MAINPID

# Cleanup on stop
ExecStopPost=/opt/myapp/cleanup.sh

[Service]
# Memory limit (kill if exceeded)
MemoryMax=512M
MemoryHigh=384M

# CPU quota (50% of one core)
CPUQuota=50%

# File descriptor limit
LimitNOFILE=65536

# Process limit
LimitNPROC=4096

[Unit]
Description=Daily backup timer

[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true
RandomizedDelaySec=300

[Install]
WantedBy=timers.target

[Unit]
Description=Backup job

[Service]
Type=oneshot
ExecStart=/opt/scripts/backup.sh
User=backup

sudo systemctl enable backup.timer
sudo systemctl start backup.timer
systemctl list-timers

OnCalendar=hourly              # Every hour
OnCalendar=daily               # Every day at midnight
OnCalendar=weekly              # Every Monday at midnight
OnCalendar=*-*-* 06:00:00     # Every day at 6 AM
OnCalendar=Mon-Fri *-*-* 09:00:00  # Weekdays at 9 AM
OnCalendar=*-*-01 00:00:00    # First of every month

# Check status
systemctl status myapp

# View logs
journalctl -u myapp -f              # Follow live
journalctl -u myapp --since "1h ago"  # Last hour
journalctl -u myapp -p err          # Errors only

# Check why a service failed
systemctl show myapp --property=Result
systemctl show myapp --property=ExecMainStatus

# Analyze boot order
systemd-analyze blame
systemd-analyze critical-chain myapp.service

[Service]
# Run as non-root
User=appuser
Group=appgroup

# Filesystem restrictions
ProtectSystem=strict        # Mount / as read-only
ProtectHome=true            # Hide /home
PrivateTmp=true             # Isolated /tmp
ReadWritePaths=/opt/myapp/data

# Network restrictions
PrivateNetwork=false        # Set true if no network needed
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX

# System call filtering
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM

# Other hardening
NoNewPrivileges=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true