systemd Service Generator

Generate a systemd unit for a Laravel queue worker, a Node.js app or a Go binary, with restart policy, environment, a dedicated user and sandboxing.

Free · No sign-up · Your inputs stay in your browser

Input

Generate a systemd service unit

Unit nameDescriptionExecStartAn absolute path to the executable; systemd does not search PATH the way a shell does.Working directoryUserEnvironment (one KEY=value per line)EnvironmentFile (optional)RestartSandboxing (read-only system, private /tmp, no privilege escalation)Writable pathsProtectSystem=strict makes everything else read-only.

Output

/etc/systemd/system/laravel-worker.service

745 characters

[Unit]
Description=Laravel queue worker
After=network-online.target mysql.service redis-server.service
Wants=network-online.target
StartLimitIntervalSec=60
StartLimitBurst=5

[Service]
Type=simple
User=www-data
Group=www-data
WorkingDirectory=/var/www/app
ExecStart=/usr/bin/php /var/www/app/artisan queue:work --sleep=3 --tries=3 --max-time=3600
Environment=APP_ENV=production
Restart=always
RestartSec=5
KillSignal=SIGTERM
TimeoutStopSec=3600

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/www/app/storage /var/www/app/bootstrap/cache
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true

[Install]
WantedBy=multi-user.target

Install with: sudo systemctl daemon-reload && sudo systemctl enable --now laravel-worker. Follow logs with journalctl -u laravel-worker -f. systemd-analyze security laravel-worker scores the sandboxing. A queue worker should be restarted on deploy (php artisan queue:restart) so it loads the new code.

Runs in this browser. Nothing you paste is sent to a server.

About this tool

Method, assumptions, practical next steps, and limits.

Why systemd rather than a process manager

systemd is already on the server, restarts crashed processes, starts them at boot, collects their output in the journal and can sandbox them without containers. Restart=always with RestartSec=5 keeps a worker up; the StartLimit settings stop a crash loop from spinning forever.

Sandboxing

ProtectSystem=strict makes the whole file system read-only for the service except the paths in ReadWritePaths, so a compromised process cannot rewrite your code. systemd-analyze security name.service scores the unit. Each directive is explained in systemd.exec(5).

Frequently asked questions

Where do I put the unit file?

/etc/systemd/system/name.service, then run systemctl daemon-reload and systemctl enable --now name.

How do I see my service's logs?

journalctl -u name -f follows them; add --since "10 min ago" to narrow down.

Is what I paste sent anywhere?

No. The tool runs entirely in your browser with JavaScript. Nothing you type or paste is sent to our server or stored.

systemd Service Generator

Generate a systemd service unit

/etc/systemd/system/laravel-worker.service

Why systemd rather than a process manager

Sandboxing

Frequently asked questions

Similar tools

Sequence Generator

Quoted Printable Decoder

Find and Replace