systemd Restart=on-failure and the loop it creates

A unit that restarts on failure and fails immediately will restart as fast as systemd allows, until the rate limit stops it — and the rate limit is what makes the service stay down.

[Service]
Restart=on-failure
RestartSec=5
StartLimitIntervalSec=300
StartLimitBurst=5

# five failures in five minutes → systemd gives up and
# leaves it in a failed state until someone resets it.

$ systemctl reset-failed app-worker
$ systemctl start app-worker

The default burst is five in ten seconds, which a process failing on a bad configuration file exhausts instantly, and the resulting state is failed with a message about a start request repeating too quickly — accurate and not obviously about your configuration error. RestartSec matters more than it looks: five seconds gives a database time to come back and makes the journal readable. An alert on the failed state is what turns this from a silent outage into a page.