Alec Perkins
99f810d043
- Signed-out visitors get the same login redirect for missing and private projects, so the redirect no longer reveals private ones. - Production refuses the console email backend; sign-in codes must never reach the logs. - Database cache shared by all workers for allauth rate limits; invite sending throttled per sender and per recipient. - Email invite links are claimed on first use and the token rotated, so a token copied from request logs is worthless. - allauth password URLs removed; adding an email requires a fresh code and notifies existing addresses. - Markdown drops remote images until uploads exist. - Project and org slugs lowercased; only superusers can grant staff status or permissions in the admin. - Container runs as a non-root user; CI actions pinned to commits. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
40 lines
1.6 KiB
Docker
40 lines
1.6 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
FROM python:3.13-slim-trixie AS base
|
|
COPY --from=ghcr.io/astral-sh/uv:0.13.6 /uv /usr/local/bin/uv
|
|
ENV PYTHONUNBUFFERED=1 \
|
|
UV_COMPILE_BYTECODE=1 \
|
|
UV_LINK_MODE=copy \
|
|
UV_PYTHON_DOWNLOADS=never \
|
|
# Outside /app so the compose bind mount doesn't hide it.
|
|
UV_PROJECT_ENVIRONMENT=/opt/venv \
|
|
PATH="/opt/venv/bin:$PATH"
|
|
WORKDIR /app
|
|
|
|
|
|
FROM base AS dev
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
--mount=type=bind,source=uv.lock,target=uv.lock \
|
|
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
|
|
uv sync --locked --no-install-project
|
|
ENV DJANGO_SETTINGS_MODULE=config.settings.dev
|
|
CMD ["sh", "-c", "python manage.py migrate --noinput && python manage.py runserver 0.0.0.0:8000"]
|
|
|
|
|
|
FROM base AS prod
|
|
COPY --from=litestream/litestream:0.5.17 /usr/local/bin/litestream /usr/local/bin/litestream
|
|
# The app runs as this user; bin/start drops to it after making the data volume writable.
|
|
RUN useradd --system --uid 1000 --create-home app
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
--mount=type=bind,source=uv.lock,target=uv.lock \
|
|
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
|
|
uv sync --locked --no-install-project --no-dev
|
|
COPY litestream.yml /etc/litestream.yml
|
|
COPY . .
|
|
# Placeholder settings: collectstatic needs the prod settings to import, nothing more.
|
|
RUN DJANGO_SETTINGS_MODULE=config.settings.prod DJANGO_SECRET_KEY=collectstatic \
|
|
EMAIL_BACKEND=django.core.mail.backends.dummy.EmailBackend \
|
|
python manage.py collectstatic --noinput
|
|
ENV DJANGO_SETTINGS_MODULE=config.settings.prod
|
|
EXPOSE 8000
|
|
CMD ["bin/start"]
|