99 lines
3.9 KiB
Python
99 lines
3.9 KiB
Python
|
from __future__ import annotations
|
|||
|
|
|
|||
|
|
import os
|
|||
|
|
import secrets
|
|||
|
|
from pathlib import Path
|
|||
|
|
|
|||
|
|
|
|||
|
|
BASE_DIR = Path(__file__).resolve().parents[1]
|
|||
|
|
DATA_DIR = Path(os.getenv("CODEXPI_DATA_DIR", BASE_DIR / "data"))
|
|||
|
|
DATA_DIR.mkdir(parents=True, exist_ok=True)
|
|||
|
|
|
|||
|
|
|
|||
|
|
def env_bool(name: str, default: bool) -> bool:
|
|||
|
|
value = os.getenv(name)
|
|||
|
|
return default if value is None else value.lower() in {"1", "true", "yes", "on"}
|
|||
|
|
|
|||
|
|
|
|||
|
|
def secret_key() -> str:
|
|||
|
|
configured_file = os.getenv("CODEXPI_DJANGO_SECRET_KEY_FILE")
|
|||
|
|
if configured_file:
|
|||
|
|
value = Path(configured_file).read_text(encoding="utf-8").strip()
|
|||
|
|
if len(value) < 32:
|
|||
|
|
raise RuntimeError("CODEXPI_DJANGO_SECRET_KEY_FILE doit contenir un secret d’au moins 32 caractères")
|
|||
|
|
return value
|
|||
|
|
configured = os.getenv("CODEXPI_DJANGO_SECRET_KEY")
|
|||
|
|
if configured:
|
|||
|
|
if len(configured) < 32:
|
|||
|
|
raise RuntimeError("CODEXPI_DJANGO_SECRET_KEY doit contenir au moins 32 caractères")
|
|||
|
|
return configured
|
|||
|
|
path = DATA_DIR / "django_secret_key"
|
|||
|
|
if not path.exists():
|
|||
|
|
try:
|
|||
|
|
descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
|
|||
|
|
with os.fdopen(descriptor, "w", encoding="utf-8") as target:
|
|||
|
|
target.write(secrets.token_urlsafe(64))
|
|||
|
|
except FileExistsError:
|
|||
|
|
pass
|
|||
|
|
return path.read_text(encoding="utf-8").strip()
|
|||
|
|
|
|||
|
|
|
|||
|
|
SECRET_KEY = secret_key()
|
|||
|
|
DEBUG = False
|
|||
|
|
ALLOWED_HOSTS = [item.strip() for item in os.getenv("CODEXPI_DJANGO_ALLOWED_HOSTS", "localhost,127.0.0.1,.ts.net,nginx").split(",") if item.strip()]
|
|||
|
|
CSRF_TRUSTED_ORIGINS = [item.strip() for item in os.getenv("CODEXPI_TRUSTED_ORIGINS", "https://*.ts.net").split(",") if item.strip()]
|
|||
|
|
|
|||
|
|
INSTALLED_APPS = [
|
|||
|
|
"django.contrib.auth",
|
|||
|
|
"django.contrib.contenttypes",
|
|||
|
|
"django.contrib.sessions",
|
|||
|
|
"django_ui.identity",
|
|||
|
|
]
|
|||
|
|
MIDDLEWARE = [
|
|||
|
|
"django.middleware.security.SecurityMiddleware",
|
|||
|
|
"django.contrib.sessions.middleware.SessionMiddleware",
|
|||
|
|
"django.middleware.common.CommonMiddleware",
|
|||
|
|
"django.middleware.csrf.CsrfViewMiddleware",
|
|||
|
|
"django.contrib.auth.middleware.AuthenticationMiddleware",
|
|||
|
|
"django.middleware.clickjacking.XFrameOptionsMiddleware",
|
|||
|
|
]
|
|||
|
|
ROOT_URLCONF = "django_ui.urls"
|
|||
|
|
ASGI_APPLICATION = "django_ui.asgi.application"
|
|||
|
|
WSGI_APPLICATION = "django_ui.wsgi.application"
|
|||
|
|
|
|||
|
|
DATABASES = {"default": {"ENGINE": "django.db.backends.sqlite3", "NAME": DATA_DIR / "django.sqlite3", "OPTIONS": {"timeout": 30}}}
|
|||
|
|
DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
|
|||
|
|
USE_TZ = True
|
|||
|
|
TIME_ZONE = "Europe/Paris"
|
|||
|
|
|
|||
|
|
AUTH_PASSWORD_VALIDATORS = [
|
|||
|
|
{"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"},
|
|||
|
|
{"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator", "OPTIONS": {"min_length": 12}},
|
|||
|
|
{"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator"},
|
|||
|
|
{"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"},
|
|||
|
|
]
|
|||
|
|
PASSWORD_HASHERS = [
|
|||
|
|
"django.contrib.auth.hashers.Argon2PasswordHasher",
|
|||
|
|
"django.contrib.auth.hashers.PBKDF2PasswordHasher",
|
|||
|
|
]
|
|||
|
|
|
|||
|
|
SESSION_ENGINE = "django.contrib.sessions.backends.db"
|
|||
|
|
SESSION_COOKIE_NAME = os.getenv("CODEXPI_COOKIE_NAME", "codexpi_session")
|
|||
|
|
SESSION_COOKIE_AGE = int(os.getenv("CODEXPI_SESSION_HOURS", "12")) * 3600
|
|||
|
|
SESSION_COOKIE_SECURE = env_bool("CODEXPI_COOKIE_SECURE", True)
|
|||
|
|
SESSION_COOKIE_HTTPONLY = True
|
|||
|
|
SESSION_COOKIE_SAMESITE = "Strict"
|
|||
|
|
SESSION_SAVE_EVERY_REQUEST = False
|
|||
|
|
CSRF_COOKIE_SECURE = SESSION_COOKIE_SECURE
|
|||
|
|
CSRF_COOKIE_HTTPONLY = True
|
|||
|
|
CSRF_COOKIE_SAMESITE = "Strict"
|
|||
|
|
CSRF_HEADER_NAME = "HTTP_X_CSRF_TOKEN"
|
|||
|
|
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
|
|||
|
|
USE_X_FORWARDED_HOST = True
|
|||
|
|
SECURE_CONTENT_TYPE_NOSNIFF = True
|
|||
|
|
SECURE_REFERRER_POLICY = "no-referrer"
|
|||
|
|
SECURE_HSTS_SECONDS = 31_536_000
|
|||
|
|
X_FRAME_OPTIONS = "DENY"
|
|||
|
|
|
|||
|
|
CACHES = {"default": {"BACKEND": "django.core.cache.backends.locmem.LocMemCache", "LOCATION": "codexpi-login-limiter"}}
|