Since Nginx Proxy Manager handles SSL termination, Force SSL, and HSTS:
- Set SECURE_HSTS_SECONDS = 0 (NPM sends HSTS headers)
- Added SECURE_PROXY_SSL_HEADER to trust X-Forwarded-Proto from NPM
- Added SESSION_COOKIE_HTTPONLY for additional session security
- Documented NPM configuration: Force SSL = On, HSTS Enabled = On
This prevents duplicate HSTS headers and ensures Django correctly
detects HTTPS connections behind the reverse proxy.
Cookie security (SESSION/CSRF_COOKIE_SECURE) remains enabled as these
are application-level settings independent of the reverse proxy.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Created /api/ endpoint that returns JSON with:
- API status
- Available endpoints
- Version information
This fixes the "Not Found" error when accessing /api/ and
provides a useful API discovery endpoint for clients.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Django requires CSRF_TRUSTED_ORIGINS to be set for POST requests
(including login) when using HTTPS or non-standard ports. Without
this setting, login attempts fail with "CSRF verification failed".
The setting is now configurable via CSRF_TRUSTED_ORIGINS environment
variable, similar to CORS_ALLOWED_ORIGINS.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add Dockerfile for production (multi-stage build)
- Add Dockerfile.dev for development with hot reload
- Add docker-compose.yml with 5 services (web, mariadb, redis, celery-worker, celery-beat)
- Add docker-compose.dev.yml for development overrides
- Add .dockerignore for optimized builds
- Add docker/entrypoint.sh startup script
- Add .env.docker.example template
- Add Makefile for common commands
- Add deploy.sh for one-command deployment
- Update config/settings/selfhosted.py to support MariaDB via DATABASE_URL
- Add mysqlclient to requirements.txt for MariaDB support
- Update .gitignore to exclude .env.docker
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Added validation to ensure ALLOWED_HOSTS is explicitly set in production.
Changes:
- Check if ALLOWED_HOSTS environment variable is set
- Raise ValueError with helpful message if not set
- Use os.environ['ALLOWED_HOSTS'] instead of .get() to enforce requirement
- Prevents empty or missing ALLOWED_HOSTS from bypassing host validation
Security impact:
- Prevents host header injection attacks
- Blocks cache poisoning via host header manipulation
- Ensures production deployments have explicit allowed hosts configured
- Fails fast with clear error message if misconfigured
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Added tasks.firebugit.com to:
- ALLOWED_HOSTS: Allow Django to serve requests from this domain
- CSRF_TRUSTED_ORIGINS: Allow CSRF-protected requests from https://tasks.firebugit.com
This enables testing the development server via the tasks.firebugit.com domain.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Security improvements:
- selfhosted.py: Require SECRET_KEY environment variable (raises ValueError if not set)
- selfhosted.py: Validate SECRET_KEY length (minimum 50 characters)
- selfhosted.py: Warn if DEBUG=True in self-hosted mode
- development.py: Auto-generate random SECRET_KEY on each startup if not provided
- development.py: Remove production domain from ALLOWED_HOSTS
- development.py: Make CSRF_TRUSTED_ORIGINS environment-only
This prevents weak/default SECRET_KEYs from being used in production.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Implement comprehensive email verification and admin approval system for user registration. Users must verify their email before logging in, and admins must approve new users before they can access the system.
Major features:
- Email verification with UUID tokens (24hr expiry, one-time use)
- Admin approval workflow via Django admin interface
- Custom authentication backend enforcing verification and approval
- Password change functionality for authenticated users
- Enhanced profile page with proper styling and theme support
- Collect first name, last name, and timezone during registration
- Profile link added to header navigation
Email notifications:
- Verification email sent after registration
- Admin notification when users need approval
- Approval notification sent to users
Security features:
- Cryptographically secure UUID tokens
- Token expiration and one-time use enforcement
- Email enumeration protection
- Custom JWT token validation for API access
- Existing users auto-approved via data migration
Templates added:
- Email templates (verification, approval, admin notification)
- Web templates (password change, verification pages)
- Enhanced profile page with dark/light mode support
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Features:
- Django-based REST API with web interface
- Task management with tags, priorities, and due dates
- Time tracking with start/stop timers
- Subtasks support
- Task filtering (all, today, upcoming, overdue, completed)
- Tag-based organization with color coding
- Sorting by due date and priority
- Auto-assign tags when filtering
- Responsive 3-pane layout (sidebar, task list, detail panel)
- Task sharing between users
- Mobile-responsive design with dark mode support
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
