unify service name to ppsq

deploy/README.md

@@ -8,19 +8,19 @@ AGENTS.md. Do **not** run multiple instances or web-server workers.
 ## 1. Create the service user and lay down the code
 
 ```bash
-sudo useradd --system --home /opt/pps-quarantine --shell /usr/sbin/nologin pps
-sudo mkdir -p /opt/pps-quarantine
-# copy this repo to /opt/pps-quarantine (git clone, rsync, scp — whatever you use), then:
-sudo chown -R pps:pps /opt/pps-quarantine
+sudo useradd --system --home /opt/ppsq --shell /usr/sbin/nologin ppsq
+sudo mkdir -p /opt/ppsq
+# copy this repo to /opt/ppsq (git clone, rsync, scp — whatever you use), then:
+sudo chown -R ppsq:ppsq /opt/ppsq
 ```
 
 ## 2. Install dependencies (as the service user)
 
 ```bash
-cd /opt/pps-quarantine
-sudo -u pps python3 -m venv venv
-sudo -u pps venv/bin/pip install --upgrade pip          # avoids "no matching distribution" on old pip
-sudo -u pps venv/bin/pip install -r requirements.txt     # version ranges; pip picks compatible builds
+cd /opt/ppsq
+sudo -u ppsq python3 -m venv venv
+sudo -u ppsq venv/bin/pip install --upgrade pip          # avoids "no matching distribution" on old pip
+sudo -u ppsq venv/bin/pip install -r requirements.txt     # version ranges; pip picks compatible builds
 ```
 
 Requires **Python 3.9+**. `requirements.lock` (exact pins from the dev machine) also exists,
@@ -30,11 +30,11 @@ but only install from it if that exact Python/pip combination matches — otherw
 ## 3. Configure
 
 ```bash
-sudo -u pps cp config.example.toml config.toml
-sudo -u pps chmod 600 config.toml
+sudo -u ppsq cp config.example.toml config.toml
+sudo -u ppsq chmod 600 config.toml
 # generate a session key:
 python3 -c "import secrets; print(secrets.token_urlsafe(48))"
-sudoedit config.toml   # (or edit as the pps user)
+sudoedit config.toml   # (or edit as the ppsq user)
 ```
 
 Fill in at least: `[okta]` (issuer/client_id/client_secret/redirect_uri), `[pps]` host +
@@ -42,47 +42,47 @@ API credentials, `[[auth.users]]` (your admins), a real `[app] secret_key`, and
 `[app] listen = "127.0.0.1"` + `cookie_secure = true` (you'll front it with TLS).
 `wsgi.py` refuses to boot with the placeholder or a `<32`-char secret_key.
 
-The `config.toml` and the `/opt/pps-quarantine` directory must stay **writable by `pps`** — the
+The `config.toml` and the `/opt/ppsq` directory must stay **writable by `ppsq`** — the
 admin panel rewrites `config.toml`, and `jobs.db` / `*.log` are written there.
 
 ## 4. Install and start the service
 
 ```bash
-sudo cp /opt/pps-quarantine/deploy/pps.service /etc/systemd/system/pps.service
+sudo cp /opt/ppsq/deploy/ppsq.service /etc/systemd/system/ppsq.service
 # if you used a different path/user, edit the unit first
 sudo systemctl daemon-reload
-sudo systemctl enable --now pps
+sudo systemctl enable --now ppsq
 ```
 
 ## 5. Verify
 
 ```bash
-systemctl status pps
-journalctl -u pps -f          # startup + request logs (also in /opt/pps-quarantine/app.log)
+systemctl status ppsq
+journalctl -u ppsq -f          # startup + request logs (also in /opt/ppsq/app.log)
 curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/login   # -> 200
 ```
 
 ## Reverse proxy (nginx + TLS)
 
-A ready-made site config is in [`pps.nginx.conf`](pps.nginx.conf) — it terminates TLS and
+A ready-made site config is in [`ppsq.nginx.conf`](ppsq.nginx.conf) — it terminates TLS and
 `proxy_pass`es to `127.0.0.1:8080`. Edit the `server_name` and `ssl_certificate*` paths, then:
 
 ```bash
-sudo cp deploy/pps.nginx.conf /etc/nginx/sites-available/pps
-sudo ln -s /etc/nginx/sites-available/pps /etc/nginx/sites-enabled/pps
+sudo cp deploy/ppsq.nginx.conf /etc/nginx/sites-available/ppsq
+sudo ln -s /etc/nginx/sites-available/ppsq /etc/nginx/sites-enabled/ppsq
 sudo nginx -t && sudo systemctl reload nginx
 ```
 
 Make sure the Okta `redirect_uri` matches the public HTTPS URL exactly (e.g.
-`https://pps.internal.example.com/authorize`), and set `[app] cookie_secure = true` and
+`https://ppsq.internal.example.com/authorize`), and set `[app] cookie_secure = true` and
 `listen = "127.0.0.1"` in `config.toml`.
 
 ## Day-to-day
 
 ```bash
-sudo systemctl restart pps        # after editing [app]/[okta] (restart-only keys)
-sudo systemctl stop pps
-journalctl -u pps --since '1 hour ago'
+sudo systemctl restart ppsq        # after editing [app]/[okta] (restart-only keys)
+sudo systemctl stop ppsq
+journalctl -u ppsq --since '1 hour ago'
 ```
 
 Most settings ([pps], [quarantine], users) are editable live in the admin panel and need

deploy/pps.nginx.conf → deploy/ppsq.nginx.conf

@@ -1,8 +1,8 @@
 # nginx reverse proxy for the PPS Quarantine Manager.
 #
 # Install (Debian):
-#   sudo cp deploy/pps.nginx.conf /etc/nginx/sites-available/pps
-#   sudo ln -s /etc/nginx/sites-available/pps /etc/nginx/sites-enabled/pps
+#   sudo cp deploy/ppsq.nginx.conf /etc/nginx/sites-available/ppsq
+#   sudo ln -s /etc/nginx/sites-available/ppsq /etc/nginx/sites-enabled/ppsq
 #   sudo nginx -t && sudo systemctl reload nginx
 #
 # The app listens on 127.0.0.1:8080 (set [app] listen/port in config.toml). nginx
@@ -10,17 +10,17 @@
 
 server {
     listen 80;
-    server_name pps.internal.example.com;      # <-- your hostname
+    server_name ppsq.internal.example.com;      # <-- your hostname
     # Redirect all HTTP to HTTPS.
     return 301 https://$host$request_uri;
 }
 
 server {
     listen 443 ssl;
-    server_name pps.internal.example.com;      # <-- your hostname
+    server_name ppsq.internal.example.com;      # <-- your hostname
 
-    ssl_certificate     /etc/ssl/pps.crt;      # <-- your TLS cert
-    ssl_certificate_key /etc/ssl/pps.key;      # <-- your TLS key
+    ssl_certificate     /etc/ssl/ppsq.crt;      # <-- your TLS cert
+    ssl_certificate_key /etc/ssl/ppsq.key;      # <-- your TLS key
 
     location / {
         proxy_pass http://127.0.0.1:8080;