Aug 26 - Enhance security

scripts/passkeeper.service

@@ -8,7 +8,7 @@
 #   journalctl -xeu passkeeper.service
 #
 # Phase 5 additions vs original:
-#   - WatchdogSec: systemd kills and restarts a hung Gunicorn within 30 s
+#   - Restart=on-failure: systemd restarts Gunicorn if the master exits non-zero
 #   - Gunicorn --timeout: workers that don't respond within 25 s are replaced
 #   - Gunicorn --graceful-timeout: allows in-flight requests to finish on reload
 #   - PrivateTmp, NoNewPrivileges, ProtectSystem: basic systemd sandboxing
@@ -43,11 +43,23 @@ ExecStart=/home/spuser/.venv/bin/gunicorn \
 # Reload (zero-downtime): send USR2 to Gunicorn master
 ExecReload=/bin/kill -s USR2 $MAINPID
 
-# Watchdog: systemd sends SIGKILL if Gunicorn doesn't send keepalives within 30 s.
-# Requires gunicorn to be started with --preload OR the watchdog plugin; here we
-# rely on the worker timeout (25 s) to recycle hung workers before the 30 s
-# watchdog fires, which restarts the entire service.
-WatchdogSec=30s
+# NO WatchdogSec here — deliberately.
+#
+# WatchdogSec requires the service to send WATCHDOG=1 keepalives over the sd_notify
+# socket. Gunicorn only does that when systemd exports NOTIFY_SOCKET, which happens
+# only under Type=notify (+ NotifyAccess=main). This unit is Type=simple (the
+# default), so no keepalive was ever sent, systemd treated the service as hung, and
+# SIGKILLed it every ~30 s. Restart=on-failure then brought it back after RestartSec,
+# producing a repeating window of 502s from Nginx.
+#
+# Hung *workers* are already handled by Gunicorn's own --timeout above; a crashed
+# *master* is already handled by Restart=on-failure below. The watchdog added no
+# coverage, only outages.
+#
+# To re-enable it properly (optional), all three lines are required:
+#   Type=notify
+#   NotifyAccess=main
+#   WatchdogSec=30s
 
 Restart=on-failure
 RestartSec=5s