systemd's logind by default will kill off all ipc objects associated with a user when that user logs out. This includes the postgres user -- which the postgres daemon runs as. Thus if you login in as postgres (for example to do some db maintenance) then postgres itself will crash as soon as you log out, since logind kills off all shared memory segments belonging to the postgres
user. This crashes all postgres processes, and the system goes into recovery to the last good commit. You should turn this behavior off for any postgres host that uses systemd:
In /etc/systemd/logind.conf set
RemoveIPC=no
then restart logind
systemct restart systemd-logind