Make a systemd service shut down gracefully (ExecStop, TimeoutStopSec, KillMode, KillSignal)

Documented steps

1. Default stop sequence: systemd sends KillSignal (default SIGTERM) to the cgroup per KillMode, waits up to TimeoutStopSec (default 90s), then sends FinalKillSignal (default SIGKILL) to whatever survives.
2. Tune for the app in [Service]: KillSignal=SIGINT # if the app only handles Ctrl-C style shutdown TimeoutStopSec=30 KillMode=mixed
3. KillMode values: control-group (default; signal every process in the cgroup), mixed (SIGTERM only to the main process, SIGKILL later to the whole group — good for apps that orchestrate their own children), process (main process only — orphans children, avoid unless necessary), none (deprecated).
4. ExecStop= runs a command INSTEAD of the initial signal (e.g. `ExecStop=/usr/local/bin/myapp-ctl drain`); after it exits, remaining processes are still killed per KillMode. It runs only if the service started successfully.
5. Apps that need to finish in-flight work should trap SIGTERM, stop accepting new work, drain, then exit 0. Exit codes during stop: exiting with 0 or with the signal it was sent counts as clean.
6. Notify progress on slow stops: send `STOPPING=1` and use `sd_notify(0, "EXTEND_TIMEOUT_USEC=...")` (systemd 236+) to extend the stop window dynamically.
7. Verify behavior: `systemctl stop myapp` then `journalctl -u myapp -e` — a forced kill logs `myapp.service: State 'stop-sigterm' timed out. Killing.` followed by `Killing process ... with signal SIGKILL.`