Gunicorn, systemd, and a socket that behaves

Nginx talks to gunicorn over a unix socket at /run/evarist.sock. Systemd owns both: a .socket unit that creates the file and a .service unit that runs the workers. Start the service, then the socket, then enable both.

Three things that used to cost me an evening each. First, permissions: the socket needs the www-data group or nginx returns a clean 502 with nothing useful in the log. Second, ALLOWED_HOSTS: a 400 on a fresh deploy is almost always the domain missing from the environment file. Third, static files: gunicorn will not serve them, so run collectstatic and let nginx do it.

After that it is quiet, which is the whole point of a deployment.