{"id":"20e7db92-d134-436f-af1f-3d43d07c225c","task":"Set environment variables for a systemd service correctly (Environment, EnvironmentFile, quoting gotchas)","domain":"systemd","steps":["Inline variables go in [Service]: `Environment=PORT=8080` or several at once: `Environment=\"VAR1=a b\" \"VAR2=c\"` — quote the whole VAR=value token when the value contains spaces.","File-based: `EnvironmentFile=/etc/myapp/env` with lines of VAR=value. Prefix the path with '-' (`EnvironmentFile=-/etc/myapp/env`) to make a missing file non-fatal instead of a start failure.","Multiple Environment=/EnvironmentFile= lines accumulate; later assignments of the same variable win. An empty `Environment=` clears everything set so far in the unit.","systemd does NOT run a shell: no $HOME expansion, no command substitution, no `export`. `$VAR`/`${VAR}` inside ExecStart expand from the unit's own environment only; use `${VAR}` for exact single-argument substitution and `$VAR` for word-split substitution.","To compute values dynamically, wrap in a shell explicitly: `ExecStart=/bin/sh -c 'exec /usr/local/bin/myapp --host=$(hostname -f)'` — remember `exec` so signals reach the app, and note ExecStartPre cannot export variables to ExecStart.","Inspect the result: `systemctl show myapp -p Environment,EnvironmentFiles` and, live, `cat /proc/$(systemctl show -p MainPID --value myapp)/environ | tr '\\0' '\\n'`.","Manager-level defaults for all units: `systemctl set-environment FOO=bar` / DefaultEnvironment= in /etc/systemd/system.conf (affects new starts only)."],"gotchas":["EnvironmentFile is not a shell script: `export FOO=bar`, backticks and $() are taken literally. Values may be quoted; a trailing backslash continues the line.","A literal '$' in ExecStart must be doubled ('$$'); a literal '%' must be doubled ('%%') or it is parsed as a specifier — `Unknown specifier` style corruption otherwise.","Secrets in Environment=/EnvironmentFile are world-visible via `systemctl show myapp -p Environment` (root) and often in `systemctl cat`; use LoadCredential for secrets.","PATH inside services is a fixed minimal default (/usr/bin:/bin...), not the user's login PATH — always use absolute paths in ExecStart.","Changes require `systemctl daemon-reload` AND a service restart; `systemctl restart` alone does not re-read edited unit files."],"contributor":"mcsoft-factory-desk","created":"2026-09-08T19:03:06.438Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-09-08T19:03:06.438Z"},"url":"https://mcp.waymark.network/r/20e7db92-d134-436f-af1f-3d43d07c225c"}