systemd-service-creator

name	systemd-service-creator
description	Scaffold, install, and audit personal systemd services and timers attached to personal-services.target for workspace applications. Use when creating systemd units, setting up background daemons, or registering custom personal timers.
version	1.0.0
kind	pipeline
triggers	["create systemd service","create systemd timer","scaffold systemd unit","add personal service","register systemd service"]
intent	system
created_at	2026-07-31T00:00:00.000Z
updated_at	2026-07-31T00:00:00.000Z
guardrails	["Always attach personal units to personal-services.target in [Install] WantedBy.","In template unit files (e.g. app@.service), use raw %i (lowercase) in ExecStart and Description rather than %I (uppercase), as %I path-unescapes dashes.","Never edit generated systemd units directly in /etc/systemd/system without keeping source files in $SERVICES_PATH or repo source trees."]
resources	["<SKILL_PATH>/scripts/run.sh","<SKILL_PATH>/scripts/manage.py","<SKILL_PATH>/references/output.md"]
tools	["bash","python3"]

Systemd Service Creator

This skill governs scaffolding, installing, and auditing personal systemd service and timer unit files across your workspace applications.

---

1. Architecture & Tagging Contract

All personal services and timers registered by workspace applications are tagged and grouped using systemd's target dependency mechanism:

• Target Grouping (personal-services.target): Every personal service or timer generated by this skill includes personal-services.target under [Install] WantedBy=:

  [Install]
  WantedBy=multi-user.target personal-services.target  # Services
  WantedBy=timers.target personal-services.target      # Timers
  

• Discovery in linux-system-manager: linux-system-manager scans personal-services.target dependencies directly via systemctl list-dependencies personal-services.target. Any app installing a unit attached to this target automatically appears under Section 5 (Personal Services & Timers).

---

2. Hardening & Guardrail Rules

1. Security Sandbox Defaults: Generated .service units include standard security options: ProtectSystem=strict, ProtectKernelTunables=true, ProtectKernelModules=true, ProtectControlGroups=true, PrivateDevices=true, NoNewPrivileges=true.
2. Template Units (app@.service): Always use %i (lowercase) for instance names in ExecStart and Description. Systemd path-unescapes %I (uppercase), translating dashes (-) to slashes (/), which breaks config resolution for profiles with dashes.
3. Mount Services: For foreground FUSE mounts (like rclone), add SuccessExitStatus=143 SIGTERM and an ExecStopPost cleanup command to prevent clean shutdowns from recording false failures in systemd.

---

3. Workflow