# at the top of a script that runs unattended
set -euo pipefail
PATH=/opt/reports/tools/bin:/usr/sbin:/usr/bin:/sbin:/bin
conf=${REPORT_CONF:-/opt/reports/report.conf}
[ -r "$conf" ] || { echo "cannot read $conf" >&2; exit 1; }
. "$conf"
# replace output only on success
tmp=$(mktemp "$out.XXXXXX"); trap 'rm -f -- "$tmp"' EXIT
generate > "$tmp" && mv -f -- "$tmp" "$out"
env -i /path/to/script # nothing inherited
sudo systemd-run --wait --pipe -q cmd # exactly what a service gets
systemctl show unit -p Result -p ExecMainStatus
sudo journalctl -u unit -b -o cat # what the run printed
In a unit, when it has to: Environment=, EnvironmentFile=, WorkingDirectory=, User=.