Alec Perkins
604c2bbf91
- Rate limits in the shared cache for comments, issues, uploads and invites; a limited HTMX reply keeps the draft. - Content-Security-Policy (self only, no inline script or style, bucket origin for images and frames) and Permissions-Policy on every page. htmx configured not to inject styles or eval. - Moderation: deactivating a user ends their sessions and keeps their content; deleted accounts show as "ghost"; reserved usernames; the admin won't delete an org's last owner. - Admin requires a TOTP code (django-otp), with add_admin_totp to enrol. - Email provider chosen by environment through django-anymail. - Playwright browser tests: axe WCAG 2.1 AA on every page in light and dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit Canvas/CanvasText on :root fixes dark-mode contrast detection. - bin/start creates the data dir if missing; docs/operations.md runbook. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
27 lines
1 KiB
Bash
Executable file
27 lines
1 KiB
Bash
Executable file
#!/bin/sh
|
|
# Production entrypoint. Migrations run here rather than in Fly's release_command,
|
|
# because release machines don't mount the volume that holds the SQLite database.
|
|
set -eu
|
|
|
|
# The volume is mounted owned by root. Take ownership for the app user, then rerun as it.
|
|
if [ "$(id -u)" = 0 ]; then
|
|
mkdir -p "${INTENT_DATA_DIR:?}"
|
|
chown -R app:app "$INTENT_DATA_DIR"
|
|
exec setpriv --reuid=app --regid=app --init-groups env HOME=/home/app "$0" "$@"
|
|
fi
|
|
|
|
DB="${INTENT_DATA_DIR:?}/db.sqlite3"
|
|
SERVER="gunicorn config.wsgi --bind 0.0.0.0:8000 --workers 3 --access-logfile -"
|
|
|
|
if [ -z "${LITESTREAM_BUCKET:-}" ]; then
|
|
echo "LITESTREAM_BUCKET not set: running without backups" >&2
|
|
python manage.py migrate --noinput
|
|
python manage.py createcachetable
|
|
exec $SERVER
|
|
fi
|
|
|
|
# On a fresh volume, pull the latest backup before anything touches the database.
|
|
litestream restore -if-db-not-exists -if-replica-exists "$DB"
|
|
python manage.py migrate --noinput
|
|
python manage.py createcachetable
|
|
exec litestream replicate -exec "$SERVER"
|