⚙️ Systemd Unit Generator

🎯 Preset

Picking a preset repopulates every field below. Edit afterwards as needed.

📄 Unit basics

🔗 [Unit] dependencies

⚙️ [Service]

🛡️ Hardening

⏱️ [Timer]

🔌 [Socket]

💾 [Mount]

👁️ [Path]

📦 [Install]

📤 Generated unit file

Filename: {{ filename }} 
{{ output || '# Fill the form to generate a unit file.' }}

📁 Files needed

  • {{ f.path }} — {{ f.description }}

⚠️ Warnings

  • {{ w }}

📖 Directive explanations

{{ e.directive }}=
{{ e.meaning }}
⚠️

ℹ️ About Systemd Unit Generator

What is a systemd unit file?

systemd is the init system used by every modern Linux distribution (Debian, Ubuntu, RHEL, Fedora, Arch, openSUSE). It supervises long-running services, schedules one-shot jobs, mounts filesystems, opens sockets, and watches paths for change. Each of these things is described by a unit file — a plain-text INI file with [Unit], [Service] / [Timer] / [Socket] / [Mount] / [Path], and [Install] sections. System-wide unit files live in /etc/systemd/system/; vendor-shipped defaults live in /lib/systemd/system/ and the user override always wins.

This generator builds a syntactically valid, lint-clean unit file from a small form. Every emitted directive is documented inline so you can see what each line does without consulting the man pages. The output is byte-identical between the browser (instant feedback) and the API (programmatic access) because both share the same TypeScript engine.

Unit types this generator supports

  • .service — long-running daemon, one-shot bootstrap, forking daemon, Type=notify service that signals readiness via sd_notify(3).
  • .timer — schedule activation of another unit via OnCalendar= (wall-clock), OnBootSec=, or OnUnitActiveSec=. Use Persistent=true to backfill missed runs after downtime.
  • .socket — socket-activated service. systemd opens the listening socket(s); the matching .service only starts on first connection.
  • .mount — filesystem mount point. The filename must match the mount path (e.g. /mnt/shared → mnt-shared.mount; systemd-escape -p handles edge cases).
  • .path — fire when a file appears, is modified, or a directory becomes non-empty. Trigger another unit via Unit=.
  • .target — synchronisation point / grouping unit. Use to express "start everything in this group together."

Key directives at a glance

  • Type= — simple (default), exec, forking (writes a PID file), oneshot (run once and exit), notify (calls sd_notify("READY=1") when ready), dbus, idle.
  • ExecStart= — must be an absolute path (optional prefixes: - ignore failures, @ override argv[0], !/!! no privilege elevation, : no env-var expansion, + full privileges).
  • Restart= — on-failure, always, on-abnormal, on-watchdog, etc. Combined with Type=oneshot + Restart=always this creates an infinite loop — the generator warns about that.
  • OnCalendar= — wall-clock schedule using the systemd.time grammar. Examples: daily, *-*-* 03:00:00, Mon..Fri 09:00.
  • WantedBy= — adds the unit to a target's .wants/ directory when you run systemctl enable. The usual answer is multi-user.target.

Hardening — apply these for production

  • PrivateTmp=true — give the process its own /tmp and /var/tmp namespace; nothing leaks to or from the global tmp.
  • ProtectSystem=strict — make almost the entire filesystem read-only to the unit. Combine with ReadWritePaths= for the writable directories your app actually needs.
  • ProtectHome=true — make /home, /root, and /run/user inaccessible.
  • NoNewPrivileges=true — block setuid / file capabilities from taking effect, so a compromise can never escalate privileges.
  • User= / Group= — never run as root unless you genuinely must.

After deploying, run systemd-analyze security <unit> to see the security score and specific recommendations.

Installation workflow

  1. Place the generated file at /etc/systemd/system/<name>.service.
  2. sudo systemctl daemon-reload
  3. sudo systemctl enable --now <name>.service
  4. sudo systemctl status <name>
  5. sudo journalctl -u <name> -f (follow the logs).

Source references

  • systemd.unit(5) — generic [Unit] / [Install] directives, dependency model, conditions.
  • systemd.service(5) — full [Service] directive reference (Type, ExecStart, Restart, ...).
  • systemd.exec(5) — execution context: User, Environment, sandboxing, capabilities, namespaces.
  • systemd.timer(5) — [Timer] directives, OnCalendar=, Persistent=.
  • systemd.socket(5) — socket activation, Listen*=, Accept=.
  • systemd.time(7) — calendar / time-span syntax for OnCalendar= and *Sec= directives.

API Usage Example:

POST /api/tools/linux/systemd-unit-generator
Content-Type: application/json

{
    "unitType": "service",
    "description": "My web app",
    "service": {
        "Type": "simple",
        "ExecStart": "/usr/bin/node /opt/webapp/server.js",
        "User": "webapp",
        "Restart": "on-failure"
    },
    "install": {
        "WantedBy": [
            "multi-user.target"
        ]
    }
}
Ready