Linux
systemd Unit Generator
Generate a hardened service or timer unit, with the directives that are silently ignored in the wrong section put in the right one.
A timer activates the service of the same name, so a scheduled job needs both files. Switch tabs to generate the other one.
The process stays in the foreground
An absolute path. systemd does not run this through a shell, so pipes and variable expansion do not work here.
Orders after network-online.target and pulls it in. network.target alone only means the stack is up, not that an address is assigned.
Emitted with a leading dash, so a missing file does not stop the unit starting. Put credentials here with mode 0600 rather than in Environment=, which any local user can read with systemctl show.
Read-only filesystem, no capabilities, restricted syscalls and address families. Check the result with systemd-analyze security.
One per line or comma separated. Becomes ReadWritePaths=, which is the only thing that stays writable under ProtectSystem=strict.
sudo install -m 0644 my-app.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now my-app
systemctl status my-app
journalctl -u my-app -f- Install to /etc/systemd/system/my-app.service, then run systemctl daemon-reload, systemctl enable --now my-app.
- ProtectSystem=strict makes the whole filesystem read-only apart from ReadWritePaths. If the service writes logs or state elsewhere, add those paths or it will fail on first write.
- CapabilityBoundingSet= drops every capability. If the service must bind a port below 1024, add AmbientCapabilities=CAP_NET_BIND_SERVICE and CapabilityBoundingSet=CAP_NET_BIND_SERVICE.