drop-in

A file whose name ends in .conf, sitting under /etc/systemd/system/nginx.service.d/, parsed after the packaged unit and merged into it: you write the one line you are changing instead of copying thirty that the next apt upgrade would take back. Merged, not substituted — that is where the hour goes. For LimitNOFILE=, Restart= or User=, the last assignment read wins; for a list-valued setting — ExecStart=, ExecStartPre=, Environment=, After= — it is appended. Ask for a second ExecStart= on a Type=forking unit and you get exactly that: Refusing, Loaded: bad-setting, while the nginx already running keeps serving, so the breakage waits for the next restart to appear. A bare ExecStart= empties the list before yours. And a hand-written drop-in needs systemctl daemon-reload: restart alone replays the definition already in memory, systemctl show -P LimitNOFILESoft still answers 1024, and you conclude the file does nothing. systemctl edit reloads on exit.