Replace the three config files read at import time (`config.yml`,
`client_secrets.json`, `fas-admin-details.json`) with environment
variables. This was the single biggest barrier to running the app in
containers — Django settings would crash on import if these files did
not exist on disk.
Settings changes (`base.py`):
- Remove `yaml` import and `config.yml` reading entirely
- `ADMINS` set to empty list (Django admin email notifications unused)
- OIDC endpoints configurable via env vars (defaulting to Fedora staging
at `iddev.fedorainfracloud.org`)
- `OIDC_RP_IDP_SIGN_KEY` moved to env var (was hardcoded RSA key)
- New `OIDC_SUPERUSER_USERNAMES` setting (comma-separated env var)
replaces the `config.yml` `auth.admins` list
- `REDIS_HOST` and `REDIS_PORT` configurable via env vars
- Consistent multi-line formatting for all `os.environ.get` calls that
include default values
Settings changes (`dev.py`):
- Remove `client_secrets.json` and `fas-admin-details.json` file reads
(`base.py` already reads OIDC and FAS credentials from env vars)
- Database connection configurable via `DB_HOST`, `DB_NAME`,
`DB_USERNAME`, `DB_PASSWORD` env vars (defaults match
`podman-compose.yml`)
- Remove commented-out Gmail SMTP config
- Remove `import json` (no longer needed)
Auth changes (`auth.py`):
- Remove `yaml` import and `config.yml` reading
- Use `settings.OIDC_SUPERUSER_USERNAMES` instead of
`cfg['auth']['admins']`
- `provider_logout` reads `OIDC_OP_LOGOUT_URL` from env
- Modernize `super(`) calls and bare `except` clause
Container changes:
- `Containerfile`: Install `poetry-plugin-export` (required in Poetry
2.x) and use `poetry export` to generate `requirements.txt` for
`pip install`
- Commit `poetry.lock` for reproducible builds
Also:
- Remove `pyyaml` from `pyproject.toml` (no longer needed)
- Delete `generate_client_secrets.sh` and `config.yml.example`
- Add `.env` to `.gitignore`
- Expand `.env.example` with all new env vars
Assisted-by: Claude Opus 4.6 (1M context)
Signed-off-by: Justin Wheeler <jwheel@fedoraproject.org>
Replace the broken Docker setup (Python 3.6 Alpine, `pipenv`, hardcoded
credentials) with a modern Podman-based development environment using
Red Hat Universal Base Images for OpenShift compatibility.
`Containerfile` (replaces `Dockerfile`):
- Multi-stage build: builder stage installs Poetry and dependencies,
runtime stage copies only the installed packages for a smaller image
- Base image: UBI 9 Python 3.12 (OpenShift-certified)
- Runs as non-root `USER 1001` (required by OpenShift SCC)
- Gunicorn as the application server instead of Django's runserver
- No longer calls `generate_client_secrets.sh` during build
`podman-compose.yml` (replaces `docker-compose.yml`):
- PostgreSQL 17, Redis 7, RabbitMQ 3 with health checks
- `depends_on` with `service_healthy` conditions instead of links
- Named volume (`pgdata`) for PostgreSQL persistence
- SELinux `:z` labels on bind mounts for Fedora hosts
- Gunicorn with `--reload` for development hot-reload
Also adds:
- `.env.example` — template for local development secrets
- `.containerignore` — excludes .git, secrets, and build artifacts
from the container image
Closes#222.
Closes#265.
Assisted-by: Claude Opus 4.6 (1M context)
Signed-off-by: Justin Wheeler <jwheel@fedoraproject.org>
