Four profiles, each a complete [Service] override. Pick the one whose trade-off matches your service.
| Profile | For | Trade-off it makes |
|---|---|---|
web-app.conf |
PHP-FPM, Puma, Gunicorn, Node | Leaves MemoryDenyWriteExecute off, because it breaks every JIT |
worker.conf |
Queue consumers, schedulers | No inbound sockets; outbound network retained |
network-daemon.conf |
nginx, haproxy, named | Keeps CAP_NET_BIND_SERVICE, so cannot use PrivateUsers |
batch-isolated.conf |
Batch jobs, untrusted parsing | PrivateNetwork=true — no network at all, including loopback |
Copy into /etc/systemd/system/<unit>.service.d/, then run systemctl daemon-reload && systemctl restart <unit>.
Measure your own before and after with
systemd-analyze security <unit>, rather than trusting a score quoted in documentation — the number depends on your unit file as much as on the drop-in. The included README lists what breaks, in the order it usually breaks.