简单 systemd 服务

[Unit]
Description=Service

[Service]
ExecStart=/path/to/exec
WorkingDirectory=/path/to/dir
Restart=always
RestartSec=10s
Type=simple
TimeoutStartSec=10
TimeoutStopSec=15
DynamicUser=yes
; /var/lib/private/foobar
StateDirectory=foobar
EnvironmentFile=-/etc/foobar/env

ProtectSystem=strict
PrivateTmp=yes
[Install]
WantedBy=multi-user.target

还可以加：

LogsDirectory=foobar
RuntimeDirectory=foobar
LoadCredential=config.json:/usr/local/etc/foobar/config.json

其中 Credential 被程序读取的时候是 ${CREDENTIALS_DIRECTORY}/config.json ，也可以是 /run/credentials/name.service/config.json 。