Internal
Public Access
Keith SmithandClaude Sonnet 4.5
a22c3eed50
Security improvements: - selfhosted.py: Require SECRET_KEY environment variable (raises ValueError if not set) - selfhosted.py: Validate SECRET_KEY length (minimum 50 characters) - selfhosted.py: Warn if DEBUG=True in self-hosted mode - development.py: Auto-generate random SECRET_KEY on each startup if not provided - development.py: Remove production domain from ALLOWED_HOSTS - development.py: Make CSRF_TRUSTED_ORIGINS environment-only This prevents weak/default SECRET_KEYs from being used in production. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
100 lines
2.8 KiB
Python
100 lines
2.8 KiB
Python
"""
|
|
Self-hosted settings for KeepItGoing.
|
|
|
|
Use this for users running their own instance.
|
|
"""
|
|
|
|
import os
|
|
import sys
|
|
from .base import *
|
|
|
|
# Security
|
|
SECRET_KEY = os.environ.get('SECRET_KEY')
|
|
if not SECRET_KEY:
|
|
raise ValueError(
|
|
"SECRET_KEY environment variable is required for self-hosted deployment. "
|
|
"Generate one with: python -c \"from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())\""
|
|
)
|
|
|
|
# Validate SECRET_KEY strength
|
|
if len(SECRET_KEY) < 50:
|
|
print("WARNING: SECRET_KEY is too short. Use at least 50 characters for security.", file=sys.stderr)
|
|
|
|
DEBUG = os.environ.get('DEBUG', 'False').lower() == 'true'
|
|
|
|
# Force DEBUG to False in self-hosted mode for security
|
|
if DEBUG:
|
|
print("WARNING: DEBUG=True in self-hosted mode is a security risk!", file=sys.stderr)
|
|
|
|
ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', 'localhost,127.0.0.1').split(',')
|
|
|
|
# Database - PostgreSQL for self-hosted
|
|
DATABASES = {
|
|
'default': {
|
|
'ENGINE': 'django.db.backends.postgresql',
|
|
'NAME': os.environ.get('POSTGRES_DB', 'keepitgoing'),
|
|
'USER': os.environ.get('POSTGRES_USER', 'keepitgoing'),
|
|
'PASSWORD': os.environ.get('POSTGRES_PASSWORD', 'keepitgoing'),
|
|
'HOST': os.environ.get('POSTGRES_HOST', 'db'),
|
|
'PORT': os.environ.get('POSTGRES_PORT', '5432'),
|
|
}
|
|
}
|
|
|
|
# Redis/Celery
|
|
REDIS_URL = os.environ.get('REDIS_URL', 'redis://redis:6379/0')
|
|
CELERY_BROKER_URL = REDIS_URL
|
|
CELERY_RESULT_BACKEND = REDIS_URL
|
|
|
|
# Cache
|
|
CACHES = {
|
|
'default': {
|
|
'BACKEND': 'django.core.cache.backends.redis.RedisCache',
|
|
'LOCATION': REDIS_URL,
|
|
}
|
|
}
|
|
|
|
# CORS - configurable for self-hosted
|
|
CORS_ALLOWED_ORIGINS = os.environ.get(
|
|
'CORS_ALLOWED_ORIGINS',
|
|
'http://localhost:8000'
|
|
).split(',')
|
|
|
|
# Static files
|
|
STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'
|
|
|
|
# Email - configurable
|
|
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
|
|
EMAIL_HOST = os.environ.get('EMAIL_HOST', '')
|
|
EMAIL_PORT = int(os.environ.get('EMAIL_PORT', 587))
|
|
EMAIL_HOST_USER = os.environ.get('EMAIL_HOST_USER', '')
|
|
EMAIL_HOST_PASSWORD = os.environ.get('EMAIL_HOST_PASSWORD', '')
|
|
EMAIL_USE_TLS = os.environ.get('EMAIL_USE_TLS', 'True').lower() == 'true'
|
|
DEFAULT_FROM_EMAIL = os.environ.get('DEFAULT_FROM_EMAIL', 'noreply@localhost')
|
|
|
|
# Self-hosted mode - no billing
|
|
SAAS_MODE = False
|
|
BILLING_ENABLED = False
|
|
USAGE_LIMITS_ENABLED = False
|
|
|
|
# Logging
|
|
LOGGING = {
|
|
'version': 1,
|
|
'disable_existing_loggers': False,
|
|
'formatters': {
|
|
'verbose': {
|
|
'format': '{levelname} {asctime} {module} {message}',
|
|
'style': '{',
|
|
},
|
|
},
|
|
'handlers': {
|
|
'console': {
|
|
'class': 'logging.StreamHandler',
|
|
'formatter': 'verbose',
|
|
},
|
|
},
|
|
'root': {
|
|
'handlers': ['console'],
|
|
'level': 'INFO',
|
|
},
|
|
}
|