How to use
- app.service
Paste the unit (.service)
- Settings and sectionswith line numbers
Settings table and findings
- app.service (template)systemctl daemon-reload
Make a template and save it
Paste the contents of a unit file, or drop the file. “Try a sample” shows how it works.
In “Settings”, check each section and the meaning of each setting. Hardening suggestions are listed here too.
Open “Issues” for the list by severity. Misspelled ExecStart and root-run services are high or medium; the rest are low.
In “Make a template”, create a unit for a web app or a scheduled job. Fill in the user, paths and time, then save it.
After you change a unit, run systemctl daemon-reload, then restart the service.
What it does
Settings and meanings by section
Shows the settings and values of [Unit], [Service], [Install], [Timer] and [Socket] in tables, with a short meaning for each. Names not in the list are shown as unknown.
Misplaced keys and typos
Flags settings that have no effect in their section, such as ExecStart under [Unit]. For a spelling difference such as Restartsec, it also suggests the correct name.
Startup form checks
Flags Type and ExecStart combinations (several ExecStart lines unless oneshot), program paths that are not absolute, services without User, and an [Install] without WantedBy.
Restart checks
Checks combinations of Restart and RestartSec, and whether StartLimitIntervalSec=0 has removed the restart limit.
Hardening suggestions and starter templates
Lists the hardening settings that are not set, such as NoNewPrivileges, ProtectSystem, ProtectHome and PrivateTmp. Makes a starter for a web app or a scheduled job (timer).
Use cases
- Check where ExecStart goes and whether the User setting is right for a new web app service
- Replace a cron job with a systemd timer and get the .timer and .service shapes right
- See which hardening settings such as NoNewPrivileges and ProtectSystem an existing root service lacks
- Find out why a service keeps restarting, including StartLimit settings that remove the limit
Capability matrix
| Feature | Support | Notes |
|---|---|---|
| Reading .service, .timer and .socket files and showing their settings | Supported | — |
| Misplaced sections and typos (for setting names in the list) | Supported | — |
| Basic checks of Type, ExecStart, User, WantedBy and Restart | Supported | — |
| Whether the hardening settings are present (11 items in the list) | Partial | Only checks whether each setting is present. Effects and compatibility are not checked |
| Starter templates (web app, scheduled job) | Supported | — |
| A replacement for systemd-analyze verify or security | Not supported | It is not a replacement. Program existence, permissions and dependencies are not checked |
| Installing, starting or enabling units; running systemctl | Not supported | Not run. No network requests are made |
| Drop-in (.d) directories and template (@) expansion | Not supported | Not expanded. Only the one file you paste is read |
Limits & notes
- Input is limited to 100,000 characters and 2,000 lines. Anything beyond is not read, and you are told.
- Only setting names in the list are checked. Some valid settings may be shown as unknown.
- Hardening suggestions only show whether a setting is present. They change behavior, so test them before you enable them.
- Findings follow the systemd man pages. Defaults and setting names can differ between systemd versions.
Privacy & safety
Pasted unit files are processed only inside your browser. Nothing is sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.
FAQ
What is the minimum a service needs?
My change to a unit does not take effect.
How do Restart=always and StartLimit work together?
Should I use cron or a systemd timer?
Can I add the hardening settings as they are?
Related tools
nginx Config Studio
Build a reverse proxy, SPA, PHP-FPM or HTTP-to-HTTPS redirect config from a form, or paste your nginx.conf to list syntax errors and easy-to-miss points. Everything runs in your browser and nginx is never executed.
Docker Compose Studio
Convert docker run commands to compose.yaml, or compose.yaml back to docker run. A compose file is checked for syntax, the Compose Specification and common mistakes, and security points worth confirming are listed. Nothing is started or pulled, and your input never leaves your device.
.env Studio
Paste or drop a .env file to see its keys and values in a table, with duplicates, empty values and syntax problems flagged by line. Values are hidden by default. You can compare a .env with a .env.example, or export an example file, JSON or a Kubernetes Secret. It checks common dotenv syntax, not tool-specific rules such as docker compose variable expansion.
Apache Config Studio
Paste .htaccess, httpd.conf or a VirtualHost to see its section tree and line-numbered findings: unclosed sections, unknown directives and overly open settings. You can also generate HTTPS redirect, www and HSTS snippets.
Caddyfile Studio
Paste a Caddyfile to see its site blocks, snippets ((name) and import) and matchers (@name) as a tree, with line-numbered findings for unbalanced braces and undefined references. You can also make reverse proxy, static site, SPA and www redirect templates.
Hosts Studio
Paste a hosts file to see its IP and host name pairs in a table, with format errors, duplicates and changed localhost lines flagged by line number. It checks the syntax of hosts entries (IP, whitespace-separated names, # comments). It does not resolve names or write to your system. Save the output file and place it in the system hosts location with administrator rights.
Last updated: