A red service is easier to fix when you read the journal first. systemd journalctl documents --failed and --since for units that already died. Run that before you restart anything, then open the unit log with -u.
The timestamp tells you whether the crash is new or leftover from yesterday. That is the difference between chasing a live fault and replaying an old miss.
Do not treat a leftover failed unit as today proof. Clear it after you know why it died. The short that ships later is training, not an app demo.