...why in the fuck is systemd not killing this process.

I get a helpful 'hey, theres leftover processes running from the last time you tried to stop this service. I dunno why they're there, lul."

I take back everything good I said about systemd.

>left over process
fuckin' kill it then.

My only recourse to run kill -9 against the http://suricata.pid , then remove the pid file before starting a new instance, and marking it with "-" in front of the pre-start command because if you don't the entire service bombs of the execstartpre action fails.

...why do I have to do this for suricata.

found out how to specify the pidfile so that systemd explicity knows what to fuckin kill. I don't know /why/ thats needed, but here we be.

okay well, I got all of that running properly, and even got the changing privs to a user account to work after some painful chown trial and error and grinding through logs to figure out what the fuck was complaining. neat.

one more reverted snapshot, lets test and see if all the reconfigs stick and actually work in tandem and I can finally push this.