Configure with environment variables

Author: henrikmagni

admin_site/os2borgerpc_admin/settings.py

@@ -15,45 +15,18 @@
 # Our customized user profile.
 AUTH_PROFILE_MODULE = "account.UserProfile"
 
-config = configparser.ConfigParser()
-config["settings"] = {}
-
-# We load settings from a file. The fallback values in this
-# `settings.py` is overwritten by the values defined in the file
-# the env var `BPC_USER_CONFIG_PATH` points to.
-
-# The `BPC_USER_CONFIG_PATH` file is for settings that should generally
-# be unique to an instance deployment.
-
-path = os.getenv("BPC_USER_CONFIG_PATH", None)
-if path:
-    try:
-        with open(path) as fp:
-            config.read_file(fp)
-        logger.info("Loaded settings file BPC_USER_CONFIG_PATH from %s" % (path))
-    except OSError as e:
-        logger.error(
-            "Loading settings file BPC_USER_CONFIG_PATH from %s failed with %s."
-            % (path, e)
-        )
-
-# use settings section as default
-settings = config["settings"]
-
-
-DEBUG = settings.getboolean("DEBUG", False)
+DEBUG = os.getenv("DEBUG", 'false').lower() == 'true'
 
 ADMINS = (
     [
-        (settings.get("ADMIN_NAME"), settings["ADMIN_EMAIL"]),
+        (os.environ.get("ADMIN_USERNAME"), os.environ["ADMIN_EMAIL"]),
     ]
-    if settings.get("ADMIN_EMAIL")
+    if os.environ.get("ADMIN_EMAIL")
     else None
 )
 
 MANAGERS = ADMINS
 
-
 # Template settings
 TEMPLATES = [
     {
@@ -87,7 +60,7 @@
         "USER": os.environ['DB_USER'],
         "PASSWORD": os.environ['DB_PASSWORD'],
         "HOST": os.environ['DB_HOST'],
-        "PORT": os.environ['DB_PORT'],
+        "PORT": os.getenv("DB_PORT", ""),
         "OPTIONS": {
             "connect_timeout": 2,  # Minimum in 2
         },
@@ -96,16 +69,13 @@
 
 # Hosts/domain names that are valid for this site; required if DEBUG is False
 # See https://docs.djangoproject.com/en/3.1/ref/settings/#allowed-hosts
-if settings.get("ALLOWED_HOSTS"):
-    ALLOWED_HOSTS = settings.get("ALLOWED_HOSTS").split(",")
-else:
-    ALLOWED_HOSTS = []
+ALLOWED_HOSTS = os.getenv("ALLOWED_HOSTS", "").split(",")
 
 # Django > 4.0 introduced changes related to CSRF. Note that the protocol has to be specified too.
 # https://docs.djangoproject.com/en/4.2/releases/4.0/#csrf
 # https://docs.djangoproject.com/en/4.2/ref/settings/#csrf-trusted-origins
-if settings.get("CSRF_TRUSTED_ORIGINS"):
-    CSRF_TRUSTED_ORIGINS = settings.get("CSRF_TRUSTED_ORIGINS").split(",")
+if os.getenv("CSRF_TRUSTED_ORIGINS", ""):
+    CSRF_TRUSTED_ORIGINS = os.getenv("CSRF_TRUSTED_ORIGINS", "").split(",")
 else:
     CSRF_TRUSTED_ORIGINS = []
 
@@ -114,11 +84,11 @@
 # although not all choices may be available on all operating systems.
 # In a Windows environment this must be set to your system time zone.
 # Timezone/Language
-TIME_ZONE = settings["TIME_ZONE"]
+TIME_ZONE = os.environ["TIME_ZONE"]
 
 # Language code for this installation. All choices can be found here:
 # http://www.i18nguy.com/unicode/language-identifiers.html
-LANGUAGE_CODE = settings["LANGUAGE_CODE"]
+LANGUAGE_CODE = os.environ["LANGUAGE_CODE"]
 
 LOCALE_PATHS = [os.path.join(install_dir, "locale")]
 
@@ -172,21 +142,21 @@
 
 
 # Storage setup
-if settings.get("GS_BUCKET_NAME"):
+if os.environ.get("GS_BUCKET_NAME"):
     # The Google Cloud Storage bucket name. For `django-storages[google]`
     # https://django-storages.readthedocs.io/en/latest/backends/gcloud.html
     # If it is set, we save all files to Google Cloud.
     DEFAULT_FILE_STORAGE = "storages.backends.gcloud.GoogleCloudStorage"
-    GS_BUCKET_NAME = settings.get("GS_BUCKET_NAME")
+    GS_BUCKET_NAME = os.environ.get("GS_BUCKET_NAME")
     GS_CREDENTIALS = service_account.Credentials.from_service_account_file(
-        settings.get("GS_CREDENTIALS_FILE")
+        os.environ.get("GS_CREDENTIALS_FILE")
     )
     GS_QUERYSTRING_AUTH = False
     GS_FILE_OVERWRITE = False
-    GS_CUSTOM_ENDPOINT = settings.get("GS_CUSTOM_ENDPOINT", None)
+    GS_CUSTOM_ENDPOINT = os.environ.get("GS_CUSTOM_ENDPOINT", None)
 
 # Make this unique, and don't share it with anybody.
-SECRET_KEY = settings["SECRET_KEY"]
+SECRET_KEY = os.environ["SECRET_KEY"]
 
 MIDDLEWARE = (
     "django.middleware.security.SecurityMiddleware",
@@ -203,14 +173,14 @@
 
 # Email settings
 
-DEFAULT_FROM_EMAIL = settings.get("DEFAULT_FROM_EMAIL")
-ADMIN_EMAIL = settings.get("ADMIN_EMAIL")
-EMAIL_HOST = settings.get("EMAIL_HOST")
-EMAIL_PORT = settings.get("EMAIL_PORT")
-SERVER_EMAIL = settings.get("SERVER_EMAIL")
-EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
-EMAIL_HOST_USER = settings.get("EMAIL_USER")
-EMAIL_HOST_PASSWORD = settings.get("EMAIL_PASSWORD")
+DEFAULT_FROM_EMAIL = os.environ.get("DEFAULT_FROM_EMAIL")
+ADMIN_EMAIL = os.environ.get("ADMIN_EMAIL")
+EMAIL_HOST = os.environ.get("EMAIL_HOST")
+EMAIL_PORT = os.environ.get("EMAIL_PORT")
+SERVER_EMAIL = os.environ.get("SERVER_EMAIL")
+EMAIL_BACKEND = "os.environ.core.mail.backends.smtp.EmailBackend"
+EMAIL_HOST_USER = os.environ.get("EMAIL_USER")
+EMAIL_HOST_PASSWORD = os.environ.get("EMAIL_PASSWORD")
 
 ROOT_URLCONF = "os2borgerpc_admin.urls"
 
@@ -300,11 +270,11 @@
     },
     "root": {
         "handlers": ["console", "mail_admins"],
-        "level": settings.get("LOG_LEVEL", fallback="ERROR"),
+        "level": os.getenv("LOG_LEVEL", "ERROR"),
     },
 }
 
-INITIALIZE_DATABASE = settings.getboolean("INITIALIZE_DATABASE", False)
+INITIALIZE_DATABASE = os.getenv("INITIALIZE_DATABASE", 'false').lower() == 'true'
 
 CRISPY_ALLOWED_TEMPLATE_PACKS = "bootstrap5"
 
@@ -313,12 +283,12 @@
 DEFAULT_AUTO_FIELD = "django.db.models.AutoField"
 
 # Handler for citizen login.
-CITIZEN_LOGIN_API_VALIDATOR = settings.get(
+CITIZEN_LOGIN_API_VALIDATOR = os.environ.get(
     "CITIZEN_LOGIN_API_VALIDATOR", "system.utils.cicero_validate"
 )
 
 # Cicero specific stuff.
-CICERO_URL = settings.get("CICERO_URL")
+CICERO_URL = os.environ.get("CICERO_URL")
 
 # All Python Markdown's officially supported extensions can be added here without
 # any extra setup.

compose.yaml

@@ -23,6 +23,27 @@ services:
             DB_USER: bpc
             DB_PASSWORD: bpc
             DB_PORT: ""
+            ALLOWED_HOSTS: "*"
+            DEBUG: True
+            SECRET_KEY: v3rys1kr3t
+            # Admin contact - fill in your own name and email as desired.
+            ADMIN_USERNAME: OS2borgerPC Admin
+            ADMIN_EMAIL: [email protected]
+            ADMIN_PASSWORD: admin
+            # Timezone/Language
+            TIME_ZONE: Europe/Copenhagen
+            LANGUAGE_CODE: da-dk
+
+            INITIALIZE_DATABASE: True
+
+            LOG_LEVEL: INFO
+
+            # IF USING THE CICERO INTEGRATION
+            CICERO_URL: CICERO_SERVER_HERE
+            # This particular line makes it both skip the connection to the Cicero server AND the validation of the username/password
+            # For that reason, depending on what you're testing, you might want to comment out this line
+            CITIZEN_LOGIN_API_VALIDATOR: system.utils.always_validate_citizen
+
         user: "${UID}:${GID}"
         build:
             context: .

dev-environment/dev-settings.ini

@@ -19,7 +19,6 @@ LABEL org.opencontainers.image.title="OS2borgerPC" \
       org.opencontainers.image.source="https://github.com/OS2borgerPC/admin-site"
 
 ENV PYTHONUNBUFFERED=1 \
-  BPC_USER_CONFIG_PATH=/user-settings.ini \
   PYTHONPATH=/code/admin_site/:$PYTHONPATH\
   DJANGO_SETTINGS_MODULE=os2borgerpc_admin.settings
 
@@ -79,19 +78,31 @@ COPY --from=frontend \
   /code/nodejs/node_modules/bootstrap-table/dist/locale/bootstrap-table-da-DK.min.js \
   /frontend/js/
 
-# Unfortunately, `collectstatic` requires all settings to be set. We include a
-# set of insecure setting here for only this purpose. We make sure to delete it
-# afterward. If `insecure-settings.ini` is found in any production image,
-# consider it a bug. See `insecure-settings.ini` for a detailed explanation.
-ENV DB_NAME="dummy" \
-    DB_USER="dummy" \
-    DB_PASSWORD="dummy" \
-    DB_HOST="dummy" \
-    DB_PORT="dummy"
+
+
+
+# WARNING: The below config is not used for anything other than `collectstatic`.
+
+# It is unsafe to add insecure defaults anywhere inside the production-ready
+# docker image. They have a tendency to be used knowingly or unknowingly as
+# fallback values. Given a misconfiguration, like a typo, this could result in a
+# insecure production system. Normally all secrets and unsafe defaults should
+# be relegated to `docker compose` or similar.
+
+# Unfortunately, Django requires all settings to run `collectstatic`. We include a
+# set of insecure setting here for only this purpose. 
+# They are only set for the RUN statement, and do not persist in the image. 
 RUN set -ex \
-  && BPC_USER_CONFIG_PATH=/code/docker/insecure-settings.ini python ./manage.py collectstatic --no-input --clear \
-  && BPC_USER_CONFIG_PATH=/code/docker/insecure-settings.ini python ./manage.py compilemessages \
-  && rm /code/docker/insecure-settings.ini
+  && export DB_NAME="insecure" \
+  DB_USER="insecure" \
+  DB_PASSWORD="insecure" \
+  DB_HOST="insecure" \
+  DB_PORT="insecure" \
+  SECRET_KEY="insecure" \
+  TIME_ZONE="Europe/Copenhagen" \
+  LANGUAGE_CODE="da-dk" \
+  && ./manage.py collectstatic --no-input --clear \
+  && ./manage.py compilemessages
 
 # Run the server as non-root user on port 9999
 USER 1001