on-failure instead of always as we cannot otherwise kill the service