Systemd Service Files: Run Any App as a Linux Service

[Service]
Type=simple
User=deploy
WorkingDirectory=/home/deploy/myapp
ExecStart=/usr/bin/node server.js
Restart=always
Environment=NODE_ENV=production
Environment=PORT=3000

[Service]
Type=simple
User=deploy
ExecStart=/home/deploy/myapp/server
Restart=always
LimitNOFILE=65535

[Service]
Type=oneshot
RemainAfterExit=yes
User=deploy
WorkingDirectory=/home/deploy/myapp
ExecStart=/usr/bin/docker compose up -d
ExecStop=/usr/bin/docker compose down

The pattern is always the same: specify the working directory, the start command, and the user.

After creating the service file:

# Reload systemd to pick up new file
sudo systemctl daemon-reload

# Start the service
sudo systemctl start myapi

# Enable auto-start on boot
sudo systemctl enable myapi

# Check status
sudo systemctl status myapi

# View logs (last 50 lines)
sudo journalctl -u myapi -n 50

# Follow logs in real-time
sudo journalctl -u myapi -f

# Restart after code changes
sudo systemctl restart myapi

# Stop the service
sudo systemctl stop myapi

The enable command is what makes it start on boot. Without it, the service only runs when you manually start it.

Prevent a runaway process from taking down your server:

[Service]
# Memory limit (kill if exceeded)
MemoryMax=512M
MemoryHigh=400M

# CPU limit (50% of one core)
CPUQuota=50%

# Security hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=read-only
PrivateTmp=yes
ReadWritePaths=/home/deploy/myapi/data

• MemoryMax — hard kill if memory exceeds 512MB
• MemoryHigh — throttle at 400MB (soft limit)
• CPUQuota — limit CPU usage
• ProtectSystem=strict — make the entire filesystem read-only except specified paths
• PrivateTmp — give the service its own /tmp directory

These settings are especially important for production services handling untrusted input.