Systemd Service Specification
The service unit ID comes from config.ini.system_id:
{
"system_id": "<system_id>"
}
The final system service must be:
<system_id>.service
Retained within the application installation directory:
/usr/local/<app_id>/init.d/<system_id>.service
Standard Service File:
Standard Service File (with security hardening):
[Unit]
Description=<service_description>
After=network.target
StartLimitBurst=5
StartLimitIntervalSec=60
[Service]
Type=simple
User=<appid>
Group=<appid>
WorkingDirectory=/usr/local/<appid>
ExecStart=/usr/local/<appid>/bin/<binary_name>
EnvironmentFile=/usr/local/<appid>/<appid>.env
TimeoutStartSec=30
TimeoutStopSec=10
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/<appid> /var/log/<appid>
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
Systemd Directive Reference:
| Directive | Value | Required | Description |
|---|---|---|---|
User | <appid> | ✅ Yes | Run the service as a dedicated non-root user |
Group | <appid> | ✅ Yes | Run the service with a dedicated group |
WorkingDirectory | /usr/local/<appid> | ✅ Yes | Working directory for the service |
NoNewPrivileges | true | ✅ Yes | Prevent privilege escalation |
ProtectSystem | strict | ✅ Yes | Mount /usr, /boot, /etc as read-only |
ProtectHome | true | ✅ Yes | Hide the /home directory |
TimeoutStartSec | 30 | ✅ Yes | Service startup timeout (seconds) |
TimeoutStopSec | 10 | ✅ Yes | Graceful stop timeout (seconds) |
AmbientCapabilities | CAP_NET_BIND_SERVICE | Conditional | Only needed when binding to ports below 1024 |
ReadWritePaths | /var/lib/<appid> /var/log/<appid> | ✅ Yes | Explicitly declare writable paths |
LimitNOFILE | 65536 | Recommended | File descriptor limit |
StartLimitBurst | 5 | Recommended | Maximum restart count within the interval |
StartLimitIntervalSec | 60 | Recommended | Restart limit interval (seconds) |
Important
The service unit configuration file must not configure Restart and RestartSec parameters. The application's start, stop, and restart lifecycle is uniformly managed by the TOS App Center. Developer-configured auto-restart strategies may conflict with the platform management logic, leading to inconsistent application states. StartLimitBurst and StartLimitIntervalSec are retained and unaffected.