Aug 26 - Enhance security 2

Deloy.md

@@ -266,12 +266,22 @@ atomically on any error.
 
 ## Step 8 — Test Gunicorn manually
 
-Before installing the systemd service, verify Gunicorn can start the app:
+Before installing the systemd service, verify Gunicorn can start the app.
+
+> **Do not add `--preload`.** `create_app()` starts an APScheduler thread for the
+> hourly cleanup of `token_blacklist` / `recovery_challenges` / `totp_used_codes`
+> / expired shares. Threads do not survive `fork()`, so under `--preload` the
+> scheduler would live only in the arbiter — which serves no requests — and the
+> cleanup would silently never run. `gunicorn.conf.py` pins `preload_app = False`
+> for this reason.
 
 ```bash
 source /home/spuser/.venv/bin/activate
 cd /home/spuser/PassKeeper
-gunicorn --workers 4 --bind 127.0.0.1:5000 --preload wsgi:app
+gunicorn -c gunicorn.conf.py wsgi:app
+
+# Validate the config without starting the server:
+gunicorn --check-config -c gunicorn.conf.py wsgi:app
 ```
 
 You should see lines like:
@@ -527,8 +537,12 @@ pip install -r requirements.txt
 export FLASK_APP=wsgi.py FLASK_ENV=production
 flask db upgrade
 
-# Reload Gunicorn zero-downtime (sends USR2 to master)
-sudo systemctl reload passkeeper
+# Restart Gunicorn to pick up the new code.
+# NOT `reload` — ExecReload sends HUP, which re-reads gunicorn.conf.py and
+# recycles workers but does NOT reload changed Python source. Using reload after
+# a code deploy leaves the old code running and looks like the deploy silently
+# did nothing.
+sudo systemctl restart passkeeper
 
 # Verify
 sudo systemctl status passkeeper