Allowing a non-root user to restart a service

Solution 1:

sudo is the way to go. Create a new group (appadmin for example), put your jenkins user in it, and using visudo add a new entry with a limited list of commands, for example:

Cmnd_Alias MYAPP_CMNDS = /bin/systemctl start myapp, /bin/systemctl stop myapp
%appadmin ALL=(ALL) MYAPP_CMNDS

If you want the appadmin group to be able to operate the service without entering a password first (useful if the user is only authenticated by an SSH key for example),

Cmnd_Alias MYAPP_CMNDS = /bin/systemctl start myapp, /bin/systemctl stop myapp
%appadmin ALL=(ALL) NOPASSWD: MYAPP_CMNDS