diff --git a/devserver/README.md b/devserver/README.md
index bd450c4..8d959ac 100644
--- a/devserver/README.md
+++ b/devserver/README.md
@@ -6,6 +6,18 @@ A server for hosting a variety of small devICT services.
 - Ansible to configure the base host setup
 - Docker+compose to run the services
 
+## Common commands
+
+See the [`justfile`](justfile) — run `just --list` from this directory.
+
 ## Services
 
-- (TODO) Event service
+-  [events](https://tangled.org/devict.org/events)
+
+## Secrets
+
+We use [infisical](https://infisical.com/) for remote secrets management.
+
+Each service on the host has a separate machine identity with it's own client ID and auth secret.
+
+In the service's role, we get a token to inject into the service container
diff --git a/devserver/ansible/deploy-svc-events.yaml b/devserver/ansible/deploy-svc-events.yaml
new file mode 100644
index 0000000..1f27b96
--- /dev/null
+++ b/devserver/ansible/deploy-svc-events.yaml
@@ -0,0 +1,46 @@
+---
+# Lightweight deploy: pull the latest events image and restart the
+# svc-events systemd service — without re-applying the whole playbook.
+#
+# The svc-events run.sh already runs `docker compose up --pull=always`, so
+# a plain `systemctl restart` would pull too. We pull explicitly first so
+# that a registry/network failure surfaces *before* we take the running
+# container down.
+#
+# Run from devserver/ansible/:
+#   ansible-playbook deploy-svc-events.yaml
+
+- name: Pull latest events image and restart service
+  hosts: devserver
+  become: true
+  vars_files:
+    - roles/svc-events/defaults/main.yaml
+
+  tasks:
+    - name: Pull latest events image
+      ansible.builtin.command:
+        cmd: docker compose pull
+        chdir: "{{ svc_events_deploy_dir }}"
+      changed_when: true
+      register: _svc_events_pull
+
+    - name: Show pull output
+      ansible.builtin.debug:
+        var: _svc_events_pull.stdout_lines
+
+    - name: Restart svc-events.service
+      ansible.builtin.systemd:
+        name: svc-events.service
+        state: restarted
+        daemon_reload: true
+
+    - name: Show svc-events service status
+      ansible.builtin.command:
+        cmd: systemctl --no-pager status svc-events.service
+      changed_when: false
+      failed_when: false
+      register: _svc_events_status
+
+    - name: Print service status
+      ansible.builtin.debug:
+        var: _svc_events_status.stdout_lines
diff --git a/devserver/ansible/playbook.yaml b/devserver/ansible/site.yaml
similarity index 100%
rename from devserver/ansible/playbook.yaml
rename to devserver/ansible/site.yaml