Cage your runaway service before it kills the box

One misbehaving worker or a memory-leaking node script will eat all your RAM and take the whole server down. Don't babysit it, cage it with systemd:

— MemoryMax=300M
— CPUQuota=50%

Drop those in the unit's [Service] block. Now if it leaks, systemd kills and restarts just that service at 300M instead of letting it OOM your MySQL. One sketchy app on a shared box can't take down the neighbors anymore. Try it tonight.