tegwick
d88767f05b
HttpUserEngineClient uses trusted-proxy claims against live user-engine. Offline stub when URL/secret unset. Align default tenant with KeyCape tenant:coulomb; map OIDC tenant/principal_type/groups into the envelope.
117 lines
4.1 KiB
Python
117 lines
4.1 KiB
Python
"""Shared Django settings for coulomb.social."""
|
|
|
|
from pathlib import Path
|
|
|
|
from decouple import Csv, config
|
|
from dj_database_url import parse as parse_db_url
|
|
|
|
BASE_DIR = Path(__file__).resolve().parent.parent.parent
|
|
|
|
SECRET_KEY = config("SECRET_KEY", default="django-insecure-change-me-in-production")
|
|
DEBUG = config("DEBUG", default=False, cast=bool)
|
|
ALLOWED_HOSTS = config("ALLOWED_HOSTS", default="localhost,127.0.0.1", cast=Csv())
|
|
|
|
INSTALLED_APPS = [
|
|
"django.contrib.admin",
|
|
"django.contrib.auth",
|
|
"django.contrib.contenttypes",
|
|
"django.contrib.sessions",
|
|
"django.contrib.messages",
|
|
"django.contrib.staticfiles",
|
|
"coulomb_social.apps.core",
|
|
"coulomb_social.apps.members",
|
|
"coulomb_social.apps.identity",
|
|
]
|
|
|
|
MIDDLEWARE = [
|
|
"django.middleware.security.SecurityMiddleware",
|
|
"whitenoise.middleware.WhiteNoiseMiddleware",
|
|
"django.contrib.sessions.middleware.SessionMiddleware",
|
|
"django.middleware.common.CommonMiddleware",
|
|
"django.middleware.csrf.CsrfViewMiddleware",
|
|
"django.contrib.auth.middleware.AuthenticationMiddleware",
|
|
"django.contrib.messages.middleware.MessageMiddleware",
|
|
"django.middleware.clickjacking.XFrameOptionsMiddleware",
|
|
]
|
|
|
|
ROOT_URLCONF = "coulomb_social.urls"
|
|
|
|
TEMPLATES = [
|
|
{
|
|
"BACKEND": "django.template.backends.django.DjangoTemplates",
|
|
"DIRS": [BASE_DIR / "coulomb_social" / "templates"],
|
|
"APP_DIRS": True,
|
|
"OPTIONS": {
|
|
"context_processors": [
|
|
"django.template.context_processors.debug",
|
|
"django.template.context_processors.request",
|
|
"django.contrib.auth.context_processors.auth",
|
|
"django.contrib.messages.context_processors.messages",
|
|
"coulomb_social.apps.core.context_processors.site_context",
|
|
],
|
|
},
|
|
},
|
|
]
|
|
|
|
WSGI_APPLICATION = "coulomb_social.wsgi.application"
|
|
ASGI_APPLICATION = "coulomb_social.asgi.application"
|
|
|
|
DATABASES = {
|
|
"default": parse_db_url(
|
|
config(
|
|
"DATABASE_URL",
|
|
default=f"sqlite:///{BASE_DIR / 'db.sqlite3'}",
|
|
)
|
|
)
|
|
}
|
|
|
|
AUTH_USER_MODEL = "members.User"
|
|
|
|
AUTH_PASSWORD_VALIDATORS: list[dict[str, str]] = [] # no local passwords
|
|
|
|
LANGUAGE_CODE = "en-us"
|
|
TIME_ZONE = "Europe/Berlin"
|
|
USE_I18N = True
|
|
USE_TZ = True
|
|
|
|
STATIC_URL = "/static/"
|
|
STATIC_ROOT = BASE_DIR / "staticfiles"
|
|
STATICFILES_DIRS = [BASE_DIR / "static"] if (BASE_DIR / "static").exists() else []
|
|
STORAGES = {
|
|
"staticfiles": {
|
|
"BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage",
|
|
},
|
|
}
|
|
|
|
DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
|
|
|
|
LOGIN_URL = "identity:login"
|
|
LOGIN_REDIRECT_URL = "core:app_home"
|
|
LOGOUT_REDIRECT_URL = "core:landing"
|
|
|
|
# ── Tenant (KeyCape default platform tenant; Binky friendly slug later) ─────
|
|
DEFAULT_TENANT_ID = config("DEFAULT_TENANT_ID", default="tenant:coulomb")
|
|
|
|
# ── NetKingdom identity (see ADR-0001) ──────────────────────────────────────
|
|
# When OIDC_ENABLED is false, only the DEBUG dev-login path is available.
|
|
OIDC_ENABLED = config("OIDC_ENABLED", default=False, cast=bool)
|
|
OIDC_ISSUER = config("OIDC_ISSUER", default="")
|
|
OIDC_CLIENT_ID = config("OIDC_CLIENT_ID", default="")
|
|
OIDC_CLIENT_SECRET = config("OIDC_CLIENT_SECRET", default="")
|
|
OIDC_REDIRECT_URI = config("OIDC_REDIRECT_URI", default="")
|
|
OIDC_SCOPES = config("OIDC_SCOPES", default="openid profile email groups")
|
|
OIDC_DISCOVERY_URL = config("OIDC_DISCOVERY_URL", default="") # optional override
|
|
|
|
# user-engine HTTP (empty base or secret → offline stub)
|
|
USER_ENGINE_BASE_URL = config("USER_ENGINE_BASE_URL", default="")
|
|
USER_ENGINE_PROXY_SECRET = config("USER_ENGINE_PROXY_SECRET", default="")
|
|
USER_ENGINE_APPLICATION_ID = config("USER_ENGINE_APPLICATION_ID", default="coulomb-social")
|
|
USER_ENGINE_EXPECTED_AUDIENCE = config(
|
|
"USER_ENGINE_EXPECTED_AUDIENCE", default="user-engine-portal"
|
|
)
|
|
|
|
# flex-auth (empty → local fail-closed stub for sensitive checks; shell view allowed)
|
|
FLEX_AUTH_BASE_URL = config("FLEX_AUTH_BASE_URL", default="")
|
|
FLEX_AUTH_PROTECTED_SYSTEM_ID = config(
|
|
"FLEX_AUTH_PROTECTED_SYSTEM_ID", default="coulomb-social"
|
|
)
|