EN
My tools

systemd Service & Timer File Generator

Write a systemd .service unit — ExecStart, user, environment, restart policy and security hardening — plus an optional .timer, with the install commands.

Becomes myapp.service (and myapp.timer).
myapp.service
Install commands
Lines in the unit
29

ProtectSystem=strict makes the whole file system read-only for the service except /dev, /proc, /sys and the ReadWritePaths; add any directory it must write to. ProtectHome=yes hides /home — remove it if the app lives there.

My tools →
Advertisement

systemd starts, supervises and restarts services on almost every modern Linux distribution. A unit file tells it what to run, as which user, with which environment and what to do when the process dies — and a few extra lines sandbox the service so a compromise does less damage. This generator writes the .service file, an optional .timer to run it on a schedule (the systemd replacement for cron), and the commands to install and enable them.

How to use this tool

  1. Name the unit and give the full command in ExecStart (absolute path first).
  2. Set the working directory, the user and the environment variables.
  3. Choose the type and restart policy; keep hardening on and list the paths the service must write to.
  4. Optionally pick a schedule, then copy the files to /etc/systemd/system and run the commands shown.

Formula

[Unit] (description, ordering) + [Service] (Type, User, Environment, ExecStart, Restart, hardening) + [Install] (WantedBy)

After= and Wants=network-online.target start the service once the network is up. Restart=on-failure with RestartSec restarts a crashed process after a pause. A timer unit with OnCalendar= starts the service on schedule; such services are Type=oneshot and are enabled through the timer, so they have no [Install] section. Environment values are quoted, and % is written %% because it starts a specifier.

Example

The defaults produce myapp.service: Type=simple, User=myapp, WorkingDirectory=/opt/myapp, Environment="NODE_ENV=production", ExecStart=/usr/bin/node /opt/myapp/server.js, Restart=on-failure, RestartSec=5, the hardening block with ReadWritePaths=/opt/myapp/data, and WantedBy=multi-user.target. Install it with sudo systemctl daemon-reload and sudo systemctl enable --now myapp.service.

Frequently asked questions

Where do unit files go?

Your own units belong in /etc/systemd/system/. Run sudo systemctl daemon-reload after every change, then restart the service.

Why does my service fail with "Read-only file system"?

ProtectSystem=strict makes everything read-only except the paths in ReadWritePaths. Add the directories the app writes to (data, uploads, logs), or switch the hardening off to test.

Timer or cron?

Timers log to the journal, can catch up on missed runs (Persistent=true), avoid overlapping runs and use the same sandboxing as services. systemd-analyze calendar checks an OnCalendar expression.

Sources

Last updated:

Cite or embed this tool
APA

kakaoCalc. (2026, November 8). systemd Service & Timer File Generator. https://kakao.mobile/tools/systemd-service-generator/

MLA

“systemd Service & Timer File Generator.” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/systemd-service-generator/.

Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms

Advertisement