No description
Alec Perkins
604c2bbf91
- Rate limits in the shared cache for comments, issues, uploads and invites; a limited HTMX reply keeps the draft. - Content-Security-Policy (self only, no inline script or style, bucket origin for images and frames) and Permissions-Policy on every page. htmx configured not to inject styles or eval. - Moderation: deactivating a user ends their sessions and keeps their content; deleted accounts show as "ghost"; reserved usernames; the admin won't delete an org's last owner. - Admin requires a TOTP code (django-otp), with add_admin_totp to enrol. - Email provider chosen by environment through django-anymail. - Playwright browser tests: axe WCAG 2.1 AA on every page in light and dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit Canvas/CanvasText on :root fixes dark-mode contrast detection. - bin/start creates the data dir if missing; docs/operations.md runbook. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
|---|---|---|
| .forgejo/workflows | ||
| bin | ||
| config | ||
| docs | ||
| intent | ||
| static | ||
| templates | ||
| tests | ||
| .dockerignore | ||
| .env.example | ||
| .gitignore | ||
| .python-version | ||
| compose.yaml | ||
| Dockerfile | ||
| fly.toml | ||
| litestream.yml | ||
| manage.py | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||
Intent
Track the why behind features, across implementations. See docs/concept.md and docs/plan.md.
Local development
With uv:
uv sync
uv run python manage.py migrate
uv run python manage.py runserver
Or with Docker:
docker compose up --build
Then open http://localhost:8000. Data lives in data/ (uv) or the data volume (Docker).
Checks:
uv run playwright install chromium # once, for the real-browser tests
uv run ruff check . && uv run ruff format --check . && uv run pytest
uv run pytest -m "not browser" skips the browser tests for a quicker run.
Production
Fly.io, one machine with a volume at /data; Litestream backs the database up to B2 and uploads go to Tigris. Deploying, secrets, administrators, email, moderation and the restore drill are in docs/operations.md.