Internal
Public Access
Keith SmithandClaude Sonnet 5
f41939983a
README.md: backfill the Changelog with the 2026.9.5, 2026.8.31.1, 2026.8.31, and v1.2.0 releases that were missing (it jumped straight from 1.0.0 to 1.1.0). Also correct the stale "Mobile App Support"/"Mobile App Integration" sections - the native Android app is retired, and the sync protocol they describe now powers the offline PWA instead. Remove Firebug IT branding/contact info across README.md, API.md, and the site footer, and drop the stale tasks.firebugit.com fallback from development.py's ALLOWED_HOSTS/CSRF_TRUSTED_ORIGINS. AllowMobileAppFramingMiddleware detected the native app via a 'com.firebugit.keepitgoing' User-Agent check to allow WebView iframe embedding. With that app retired, replaced it with SecurityHeadersMiddleware, which applies the same X-Frame-Options/CSP headers unconditionally instead of only for non-mobile requests - same protection for real users, dead branch and dead branding gone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
74 lines
2.0 KiB
Python
74 lines
2.0 KiB
Python
"""
|
|
Development settings for KeepItGoing.
|
|
|
|
Use this for local development.
|
|
"""
|
|
|
|
import os
|
|
import sys
|
|
from django.core.management.utils import get_random_secret_key
|
|
from .base import *
|
|
|
|
# SECURITY WARNING: keep the secret key used in production secret!
|
|
# Generate a random key for development on each startup if not provided
|
|
SECRET_KEY = os.environ.get('SECRET_KEY')
|
|
if not SECRET_KEY:
|
|
SECRET_KEY = get_random_secret_key()
|
|
print(f"WARNING: Using auto-generated SECRET_KEY for development. Set SECRET_KEY env var to persist sessions.", file=sys.stderr)
|
|
|
|
# SECURITY WARNING: don't run with debug turned on in production!
|
|
DEBUG = True
|
|
|
|
# Development-only hosts
|
|
ALLOWED_HOSTS = ['localhost', '127.0.0.1', '[::1]', '10.0.2.2', '192.168.1.241']
|
|
|
|
# CSRF - for development testing only
|
|
CSRF_TRUSTED_ORIGINS = os.environ.get('CSRF_TRUSTED_ORIGINS', '').split(',') if os.environ.get('CSRF_TRUSTED_ORIGINS') else []
|
|
|
|
# Database - SQLite for development
|
|
DATABASES = {
|
|
'default': {
|
|
'ENGINE': 'django.db.backends.sqlite3',
|
|
'NAME': BASE_DIR / 'db.sqlite3',
|
|
}
|
|
}
|
|
|
|
# Redis/Celery - use memory broker for development if Redis not available
|
|
CELERY_BROKER_URL = os.environ.get('REDIS_URL', 'memory://')
|
|
CELERY_RESULT_BACKEND = os.environ.get('REDIS_URL', 'cache+memory://')
|
|
|
|
# CORS - allow all in development
|
|
CORS_ALLOW_ALL_ORIGINS = True
|
|
|
|
# Email - console backend for development
|
|
EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
|
|
|
|
# Logging
|
|
LOGGING = {
|
|
'version': 1,
|
|
'disable_existing_loggers': False,
|
|
'formatters': {
|
|
'verbose': {
|
|
'format': '{levelname} {asctime} {module} {message}',
|
|
'style': '{',
|
|
},
|
|
},
|
|
'handlers': {
|
|
'console': {
|
|
'class': 'logging.StreamHandler',
|
|
'formatter': 'verbose',
|
|
},
|
|
},
|
|
'root': {
|
|
'handlers': ['console'],
|
|
'level': 'INFO',
|
|
},
|
|
'loggers': {
|
|
'django': {
|
|
'handlers': ['console'],
|
|
'level': 'INFO',
|
|
'propagate': False,
|
|
},
|
|
},
|
|
}
|