tegwick
3f30bcd340
Keep git as source of truth: deep-link to Forgejo editor, manual refresh to drop cache, and optional signed push webhook for automatic invalidation.
130 lines
5.1 KiB
Python
130 lines
5.1 KiB
Python
"""Shared Django settings for coulomb.social."""
|
|
|
|
from pathlib import Path
|
|
|
|
from decouple import Csv, config
|
|
from dj_database_url import parse as parse_db_url
|
|
|
|
BASE_DIR = Path(__file__).resolve().parent.parent.parent
|
|
|
|
SECRET_KEY = config("SECRET_KEY", default="django-insecure-change-me-in-production")
|
|
DEBUG = config("DEBUG", default=False, cast=bool)
|
|
ALLOWED_HOSTS = config("ALLOWED_HOSTS", default="localhost,127.0.0.1", cast=Csv())
|
|
|
|
INSTALLED_APPS = [
|
|
"django.contrib.admin",
|
|
"django.contrib.auth",
|
|
"django.contrib.contenttypes",
|
|
"django.contrib.sessions",
|
|
"django.contrib.messages",
|
|
"django.contrib.staticfiles",
|
|
"coulomb_social.apps.core",
|
|
"coulomb_social.apps.members",
|
|
"coulomb_social.apps.identity",
|
|
"coulomb_social.apps.spaces",
|
|
]
|
|
|
|
MIDDLEWARE = [
|
|
"django.middleware.security.SecurityMiddleware",
|
|
"whitenoise.middleware.WhiteNoiseMiddleware",
|
|
"django.contrib.sessions.middleware.SessionMiddleware",
|
|
"django.middleware.common.CommonMiddleware",
|
|
"django.middleware.csrf.CsrfViewMiddleware",
|
|
"django.contrib.auth.middleware.AuthenticationMiddleware",
|
|
"django.contrib.messages.middleware.MessageMiddleware",
|
|
"django.middleware.clickjacking.XFrameOptionsMiddleware",
|
|
]
|
|
|
|
ROOT_URLCONF = "coulomb_social.urls"
|
|
|
|
TEMPLATES = [
|
|
{
|
|
"BACKEND": "django.template.backends.django.DjangoTemplates",
|
|
"DIRS": [BASE_DIR / "coulomb_social" / "templates"],
|
|
"APP_DIRS": True,
|
|
"OPTIONS": {
|
|
"context_processors": [
|
|
"django.template.context_processors.debug",
|
|
"django.template.context_processors.request",
|
|
"django.contrib.auth.context_processors.auth",
|
|
"django.contrib.messages.context_processors.messages",
|
|
"coulomb_social.apps.core.context_processors.site_context",
|
|
],
|
|
},
|
|
},
|
|
]
|
|
|
|
WSGI_APPLICATION = "coulomb_social.wsgi.application"
|
|
ASGI_APPLICATION = "coulomb_social.asgi.application"
|
|
|
|
DATABASES = {
|
|
"default": parse_db_url(
|
|
config(
|
|
"DATABASE_URL",
|
|
default=f"sqlite:///{BASE_DIR / 'db.sqlite3'}",
|
|
)
|
|
)
|
|
}
|
|
|
|
AUTH_USER_MODEL = "members.User"
|
|
|
|
AUTH_PASSWORD_VALIDATORS: list[dict[str, str]] = [] # no local passwords
|
|
|
|
LANGUAGE_CODE = "en-us"
|
|
TIME_ZONE = "Europe/Berlin"
|
|
USE_I18N = True
|
|
USE_TZ = True
|
|
|
|
STATIC_URL = "/static/"
|
|
STATIC_ROOT = BASE_DIR / "staticfiles"
|
|
STATICFILES_DIRS = [BASE_DIR / "static"] if (BASE_DIR / "static").exists() else []
|
|
STORAGES = {
|
|
"staticfiles": {
|
|
"BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage",
|
|
},
|
|
}
|
|
|
|
DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
|
|
|
|
LOGIN_URL = "identity:login"
|
|
LOGIN_REDIRECT_URL = "core:app_home"
|
|
LOGOUT_REDIRECT_URL = "core:landing"
|
|
|
|
# ── Tenant (KeyCape default platform tenant; Binky friendly slug later) ─────
|
|
DEFAULT_TENANT_ID = config("DEFAULT_TENANT_ID", default="tenant:coulomb")
|
|
|
|
# ── NetKingdom identity (see ADR-0001) ──────────────────────────────────────
|
|
# When OIDC_ENABLED is false, only the DEBUG dev-login path is available.
|
|
OIDC_ENABLED = config("OIDC_ENABLED", default=False, cast=bool)
|
|
OIDC_ISSUER = config("OIDC_ISSUER", default="")
|
|
OIDC_CLIENT_ID = config("OIDC_CLIENT_ID", default="")
|
|
OIDC_CLIENT_SECRET = config("OIDC_CLIENT_SECRET", default="")
|
|
OIDC_REDIRECT_URI = config("OIDC_REDIRECT_URI", default="")
|
|
OIDC_SCOPES = config("OIDC_SCOPES", default="openid profile email groups")
|
|
OIDC_DISCOVERY_URL = config("OIDC_DISCOVERY_URL", default="") # optional override
|
|
OIDC_STEP_UP_ACR = config("OIDC_STEP_UP_ACR", default="aal2")
|
|
NETKINGDOM_REGISTRATION_URL = config("NETKINGDOM_REGISTRATION_URL", default="")
|
|
|
|
# user-engine HTTP (empty base or secret → offline stub)
|
|
USER_ENGINE_BASE_URL = config("USER_ENGINE_BASE_URL", default="")
|
|
USER_ENGINE_PROXY_SECRET = config("USER_ENGINE_PROXY_SECRET", default="")
|
|
USER_ENGINE_APPLICATION_ID = config("USER_ENGINE_APPLICATION_ID", default="coulomb-social")
|
|
USER_ENGINE_EXPECTED_AUDIENCE = config(
|
|
"USER_ENGINE_EXPECTED_AUDIENCE", default="user-engine-portal"
|
|
)
|
|
|
|
# flex-auth (empty → local vocabulary; URL set → POST /v1/check fail-closed)
|
|
FLEX_AUTH_BASE_URL = config("FLEX_AUTH_BASE_URL", default="")
|
|
FLEX_AUTH_PROTECTED_SYSTEM_ID = config(
|
|
"FLEX_AUTH_PROTECTED_SYSTEM_ID", default="coulomb-social"
|
|
)
|
|
FLEX_AUTH_TIMEOUT_SECONDS = config("FLEX_AUTH_TIMEOUT_SECONDS", default=3.0, cast=float)
|
|
|
|
# ── Space content (Forgejo / ADR-0002) ──────────────────────────────────────
|
|
FORGEJO_BASE_URL = config("FORGEJO_BASE_URL", default="https://forgejo.coulomb.social")
|
|
FORGEJO_TOKEN = config("FORGEJO_TOKEN", default="") # optional; public raw needs none
|
|
FORGEJO_TIMEOUT_SECONDS = config("FORGEJO_TIMEOUT_SECONDS", default=10.0, cast=float)
|
|
# Shared secret for POST /app/spaces/hooks/forgejo/ (push → cache invalidate)
|
|
FORGEJO_WEBHOOK_SECRET = config("FORGEJO_WEBHOOK_SECRET", default="")
|
|
# Optional local root for offline tests: <root>/<space-slug>/<content_root>/index.md
|
|
SPACE_CONTENT_FIXTURE_ROOT = config("SPACE_CONTENT_FIXTURE_ROOT", default="")
|