Justin Wheeler
be5135a6b6
Replace the three config files read at import time (`config.yml`, `client_secrets.json`, `fas-admin-details.json`) with environment variables. This was the single biggest barrier to running the app in containers — Django settings would crash on import if these files did not exist on disk. Settings changes (`base.py`): - Remove `yaml` import and `config.yml` reading entirely - `ADMINS` set to empty list (Django admin email notifications unused) - OIDC endpoints configurable via env vars (defaulting to Fedora staging at `iddev.fedorainfracloud.org`) - `OIDC_RP_IDP_SIGN_KEY` moved to env var (was hardcoded RSA key) - New `OIDC_SUPERUSER_USERNAMES` setting (comma-separated env var) replaces the `config.yml` `auth.admins` list - `REDIS_HOST` and `REDIS_PORT` configurable via env vars - Consistent multi-line formatting for all `os.environ.get` calls that include default values Settings changes (`dev.py`): - Remove `client_secrets.json` and `fas-admin-details.json` file reads (`base.py` already reads OIDC and FAS credentials from env vars) - Database connection configurable via `DB_HOST`, `DB_NAME`, `DB_USERNAME`, `DB_PASSWORD` env vars (defaults match `podman-compose.yml`) - Remove commented-out Gmail SMTP config - Remove `import json` (no longer needed) Auth changes (`auth.py`): - Remove `yaml` import and `config.yml` reading - Use `settings.OIDC_SUPERUSER_USERNAMES` instead of `cfg['auth']['admins']` - `provider_logout` reads `OIDC_OP_LOGOUT_URL` from env - Modernize `super(`) calls and bare `except` clause Container changes: - `Containerfile`: Install `poetry-plugin-export` (required in Poetry 2.x) and use `poetry export` to generate `requirements.txt` for `pip install` - Commit `poetry.lock` for reproducible builds Also: - Remove `pyyaml` from `pyproject.toml` (no longer needed) - Delete `generate_client_secrets.sh` and `config.yml.example` - Add `.env` to `.gitignore` - Expand `.env.example` with all new env vars Assisted-by: Claude Opus 4.6 (1M context) Signed-off-by: Justin Wheeler <jwheel@fedoraproject.org>
39 lines
1.2 KiB
Bash
39 lines
1.2 KiB
Bash
# Copy this file to .env and fill in the values.
|
|
# Used by podman-compose for local development.
|
|
|
|
# Django
|
|
SECRET_KEY=only-for-development
|
|
# DJANGO_SETTINGS_MODULE=happinesspackets.settings.dev
|
|
|
|
# Database (defaults match podman-compose.yml)
|
|
# DB_HOST=db
|
|
# DB_NAME=postgres
|
|
# DB_USERNAME=postgres
|
|
# DB_PASSWORD=example
|
|
|
|
# Redis (for cache in deployment.py)
|
|
# REDIS_URL=redis://redis:6379/1
|
|
|
|
# OIDC credentials (register at Fedora OIDC provider)
|
|
OIDC_RP_CLIENT_ID=
|
|
OIDC_RP_CLIENT_SECRET=
|
|
# OIDC_RP_IDP_SIGN_KEY=
|
|
|
|
# OIDC endpoints (defaults to Fedora staging)
|
|
# OIDC_OP_AUTHORIZATION_ENDPOINT=https://id.fedoraproject.org/openidc/Authorization
|
|
# OIDC_OP_TOKEN_ENDPOINT=https://id.fedoraproject.org/openidc/Token
|
|
# OIDC_OP_USER_ENDPOINT=https://id.fedoraproject.org/openidc/UserInfo
|
|
# OIDC_OP_LOGOUT_URL=https://id.fedoraproject.org/logout
|
|
|
|
# FAS admin account for username lookups
|
|
ADMIN_USERNAME=
|
|
ADMIN_PASSWORD=
|
|
|
|
# Comma-separated list of FAS usernames granted superuser on OIDC login
|
|
OIDC_SUPERUSER_USERNAMES=jflory7
|
|
|
|
# Email (deployment.py only)
|
|
# SERVER_EMAIL=root@localhost
|
|
# DEFAULT_FROM_EMAIL=Happiness Packets <fedora.happinesspackets@gmail.com>
|
|
# EMAIL_USER=
|
|
# EMAIL_PASSWORD=
|