Linux systemd Service Files Cheat Sheet

sudo nano /etc/systemd/system/myapp.service

# Open a new service file under /etc/systemd/system.

[Unit]
Description=My App
After=network.target

[Service]
Type=simple
User=myapp
WorkingDirectory=/opt/myapp
ExecStart=/usr/bin/node /opt/myapp/server.js
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

# Minimal custom service unit.

sudo systemctl daemon-reload

# Refresh manager state after writing a new service.

sudo systemctl enable --now myapp.service

# Activate the new custom service.

sudo systemctl edit nginx

# Edit a unit override file.

[Service]
Environment=NODE_ENV=production
Environment=PORT=8080

# Set environment values in a drop-in.

[Service]
ExecStart=
ExecStart=/usr/local/bin/myapp --config /etc/myapp/config.yml

# Clear old ExecStart then set new one.

systemctl cat myapp.service

# Print final unit and all overrides.

[Service]
EnvironmentFile=/etc/myapp/myapp.env

# Use an external env file.

[Service]
User=myapp
Group=myapp

# Specify service user and group.

[Service]
WorkingDirectory=/opt/myapp

# Run service from a specific directory.

[Unit]
Wants=network-online.target
After=network-online.target

# Set ordering and dependency relationship.

[Unit]
Requires=postgresql.service
After=postgresql.service

# Fail if the required unit is absent or stopped.

[Service]
Restart=on-failure
RestartSec=5

# Automatic restart policy.

[Service]
Type=oneshot
ExecStart=/usr/local/bin/cleanup.sh
RemainAfterExit=yes

# Configure a one-time task service.

[Service]
Type=notify
NotifyAccess=main

# Service signals readiness to systemd.

[Service]
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/myapp

# Apply a few common hardening options.

[Service]
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE

# Reduce privilege scope.

systemd-analyze security myapp.service

# Score a custom service for security posture.