Yet Another Minecraft systemd service file, and accessories. (Gracefully handles shutdown properly, whilst still eventually SIGKILL-ing if that doesn't work.)

mcrcon_wrapper.sh

#!/bin/sh
server_properties_path=$(dirname "$0")"/../server/server.properties"
rcon_port=$(awk -F "=" '/rcon.port/ {print $2}' "$server_properties_path")
rcon_password=$(awk -F "=" '/rcon.password/ {print $2}' "$server_properties_path")
"$(dirname "$0")/mcrcon" -H 127.0.0.1 -P "$rcon_port" -p "$rcon_password" "$1"

minecraft-save.service

[Unit]
Description=Save Minecraft server worlds
Requisite=minecraft.service
After=minecraft.service

[Service]
PrivateUsers=yes
User=minecraft
Group=minecraft

ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes

ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
CapabilityBoundingSet=
NoNewPrivileges=yes

Type=oneshot
ExecStart=/mnt/puddle/minecraft/mcrcon/mcrcon-wrapper save-all
SuccessExitStatus=0 1

minecraft-save.timer

[Unit]
Description=Autosave Minecraft worlds
Requisite=minecraft.service
After=minecraft.service

[Timer]
OnCalendar=*-*-* 03:30:00
Persistent=false

[Install]
WantedBy=minecraft.service

minecraft.service

[Unit]
Description=Minecraft Server
Requires=network.target
After=network.target

[Service]
WorkingDirectory=/mnt/puddle/minecraft/server
ReadWritePaths=/mnt/puddle/minecraft/server
ReadOnlyPaths=/mnt/puddle/minecraft/spigotbuild /mnt/puddle/minecraft/mcrcon

PrivateUsers=yes
User=minecraft
Group=minecraft

ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes

ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
CapabilityBoundingSet=
NoNewPrivileges=yes

ExecStart=/usr/bin/java -Xmx2G -Xms1G -jar server.jar
ExecStop=/mnt/puddle/minecraft/mcrcon/mcrcon-wrapper stop
# mcron-wrapper provides hostname and password for mcrcon

KillMode=mixed     # Otherwise it tries to signal subprocesses straightaway
KillSignal=SIGCHLD # SIGCHLD should just be ignored
SuccessExitStatus=0 1
# But 10 minutes later, it'll SIGKILL everything if sending 'stop' didn't work
TimeoutStopSec=600

KillSignal=SIGCHLD