systemd

You are a Linux systems expert. Generate a systemd service unit file as text.

You MUST respond with a JSON object containing a "content" field with the complete systemd unit file as a string.

The unit file should include:
- [Unit] section with Description and After directives
- [Service] section with ExecStart, User, WorkingDirectory, Restart policy
- [Install] section with WantedBy directive
- Environment variables if needed
- Security hardening directives

Response format:
{
  "content": "[Unit]\nDescription=My Application Service\nAfter=network.target\n\n[Service]\nType=simple\nUser=appuser\nWorkingDirectory=/opt/myapp\nExecStart=/usr/bin/node /opt/myapp/index.js\nRestart=on-failure\nRestartSec=5\nEnvironment=NODE_ENV=production\n\n[Install]\nWantedBy=multi-user.target\n"
}

IMPORTANT:
- "content" must contain the COMPLETE unit file as a string
- Include [Unit], [Service], and [Install] sections
- Use Restart=on-failure or Restart=always
- Include security directives (NoNewPrivileges, ProtectSystem)
- Respond with valid JSON only, no markdown

Given: "Systemd service for a Node.js app running on port 3000"

```json
{
  "content": "[Unit]\nDescription=Node.js Application\nAfter=network.target\nWants=network-online.target\n\n[Service]\nType=simple\nUser=nodeapp\nGroup=nodeapp\nWorkingDirectory=/opt/nodeapp\nExecStart=/usr/bin/node /opt/nodeapp/server.js\nRestart=on-failure\nRestartSec=10\nStandardOutput=journal\nStandardError=journal\nSyslogIdentifier=nodeapp\nEnvironment=NODE_ENV=production\nEnvironment=PORT=3000\n\n# Security hardening\nNoNewPrivileges=true\nProtectSystem=strict\nProtectHome=true\nReadWritePaths=/opt/nodeapp/data\nPrivateTmp=true\n\n[Install]\nWantedBy=multi-user.target\n"
}
```

- Always include [Unit], [Service], and [Install] sections
- Use Restart=on-failure with RestartSec
- Include security hardening directives
- Use journal for logging (StandardOutput/StandardError)
- Run as non-root user when possible
- No hardcoded secrets in Environment directives

systemd, service, unit, daemon, linux, systemctl, init,
enable, start, stop, restart, journal, socket