""" Django settings for llm_be project. Environment-driven for local/dev/beta/prod (match company_site / scha). """ from pathlib import Path from datetime import timedelta from urllib.parse import urlparse import json import os BASE_DIR = Path(__file__).resolve().parent.parent def env(key: str, default: str | None = None) -> str | None: return os.environ.get(key, default) def env_bool(key: str, default: bool = False) -> bool: value = os.environ.get(key) if value is None: return default return value.lower() in {"1", "true", "yes", "on"} def env_list(key: str, default: str = "") -> list[str]: value = os.environ.get(key, default) if not value: return [] value = value.strip() if value.startswith("["): try: parsed = json.loads(value) except ValueError: parsed = None if isinstance(parsed, list): return [str(item).strip() for item in parsed if str(item).strip()] return [item.strip() for item in value.split(",") if item.strip()] def database_config() -> dict: database_url = env("DATABASE_URL") if database_url: parsed = urlparse(database_url) return { "default": { "ENGINE": "django.db.backends.postgresql", "NAME": parsed.path.lstrip("/"), "USER": parsed.username or "", "PASSWORD": parsed.password or "", "HOST": parsed.hostname or "", "PORT": str(parsed.port or 5432), } } if env("DB_HOST"): return { "default": { "ENGINE": "django.db.backends.postgresql", "NAME": env("DB_NAME", "chat_backend"), "USER": env("DB_USER", "chat_backend"), "PASSWORD": env("DB_PASSWORD", ""), "HOST": env("DB_HOST"), "PORT": env("DB_PORT", "5432"), } } return { "default": { "ENGINE": "django.db.backends.sqlite3", "NAME": BASE_DIR / "db.sqlite3", } } # Capacitor WebView origins (Android https://localhost, iOS capacitor://localhost). # Required so JWT API calls from native shells pass CORS/CSRF origin checks (#22). CAPACITOR_WEBVIEW_ORIGINS = ( "https://localhost", "capacitor://localhost", "http://localhost", ) def build_csrf_trusted_origins( allowed_hosts: list[str], explicit: list[str] | None = None ) -> list[str]: if explicit: return list(explicit) local_hosts = {"localhost", "127.0.0.1", "0.0.0.0"} origins: list[str] = [] for host in allowed_hosts: if not host or host == "*" or host.startswith("."): continue hostname = host.split(":")[0] scheme = "http" if hostname in local_hosts else "https" origins.append(f"{scheme}://{host}") return origins def with_capacitor_webview_origins(origins: list[str]) -> list[str]: """Append Capacitor WebView origins without duplicates (order preserved).""" seen = set(origins) merged = list(origins) for origin in CAPACITOR_WEBVIEW_ORIGINS: if origin not in seen: merged.append(origin) seen.add(origin) return merged DJANGO_ENV = (env("DJANGO_ENV", "dev") or "dev").lower() SECRET_KEY = env( "DJANGO_SECRET_KEY", "django-insecure-dev-only-change-me-before-production", ) DEBUG = env_bool("DJANGO_DEBUG", DJANGO_ENV == "dev") allowed_hosts = env_list( "DJANGO_ALLOWED_HOSTS", "localhost,127.0.0.1,0.0.0.0,chatbackend.aimloperations.com,chat.aimloperations.com", ) ALLOWED_HOSTS = allowed_hosts if allowed_hosts else ["*"] CSRF_TRUSTED_ORIGINS = with_capacitor_webview_origins( build_csrf_trusted_origins( ALLOWED_HOSTS, env_list("DJANGO_CSRF_TRUSTED_ORIGINS"), ) ) # JWT Authorization header only — no cookie credentials from the SPA/Capacitor shell. CORS_ALLOW_CREDENTIALS = False CORS_ORIGIN_ALLOW_ALL = env_bool("CORS_ORIGIN_ALLOW_ALL", True) CORS_ALLOWED_ORIGINS = with_capacitor_webview_origins( env_list( "CORS_ALLOWED_ORIGINS", "http://localhost:3000,http://127.0.0.1:3000,https://chat.aimloperations.com", ) ) # Ollama — GPU host on LAN for deployed envs; loopback for local Ollama. # Prod/beta control-node secret should set OLLAMA_BASE_URL=http://10.0.0.128:11434 OLLAMA_BASE_URL = ( env("OLLAMA_BASE_URL", "http://127.0.0.1:11434") or "http://127.0.0.1:11434" ) OLLAMA_MODEL = env( "OLLAMA_MODEL", "llama3.2" if not DEBUG else "gpt-oss:20b", ) or ("llama3.2" if not DEBUG else "gpt-oss:20b") OLLAMA_EMBED_MODEL = env("OLLAMA_EMBED_MODEL", OLLAMA_MODEL) or OLLAMA_MODEL CHROMA_PERSIST_DIRECTORY = env( "CHROMA_PERSIST_DIRECTORY", str(BASE_DIR / "chroma_db"), ) or str(BASE_DIR / "chroma_db") INSTALLED_APPS = [ "daphne", "django.contrib.admin", "django.contrib.auth", "django.contrib.contenttypes", "django.contrib.sessions", "django.contrib.messages", "whitenoise.runserver_nostatic", "django.contrib.staticfiles", "chat_backend", "finance", "rest_framework", "corsheaders", "rest_framework_simplejwt.token_blacklist", ] MIDDLEWARE = [ "django.middleware.security.SecurityMiddleware", "whitenoise.middleware.WhiteNoiseMiddleware", "django.contrib.sessions.middleware.SessionMiddleware", "corsheaders.middleware.CorsMiddleware", "django.middleware.common.CommonMiddleware", "django.middleware.csrf.CsrfViewMiddleware", "django.contrib.auth.middleware.AuthenticationMiddleware", "django.contrib.messages.middleware.MessageMiddleware", "django.middleware.clickjacking.XFrameOptionsMiddleware", ] ROOT_URLCONF = "llm_be.urls" TEMPLATES = [ { "BACKEND": "django.template.backends.django.DjangoTemplates", "DIRS": [os.path.join(BASE_DIR, "templates")], "APP_DIRS": True, "OPTIONS": { "context_processors": [ "django.template.context_processors.debug", "django.template.context_processors.request", "django.contrib.auth.context_processors.auth", "django.contrib.messages.context_processors.messages", ], }, }, ] WSGI_APPLICATION = "llm_be.wsgi.application" ASGI_APPLICATION = "llm_be.asgi.application" DATABASES = database_config() AUTH_PASSWORD_VALIDATORS = [ { "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator", }, { "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator", }, { "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator", }, { "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator", }, ] TEST_RUNNER = "llm_be.test_runner.ChatBackendTestRunner" LANGUAGE_CODE = "en-us" TIME_ZONE = "UTC" USE_I18N = True USE_L10N = True USE_TZ = True STATIC_URL = "/static/" STATIC_ROOT = BASE_DIR / "staticfiles" MEDIA_URL = "/media/" MEDIA_ROOT = BASE_DIR / "media" STORAGES = { "default": { "BACKEND": "chat_backend.storage.DatabaseStorage", }, "staticfiles": { "BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage", }, } DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField" AUTH_USER_MODEL = "chat_backend.CustomUser" REST_FRAMEWORK = { "DEFAULT_PERMISSION_CLASSES": ("rest_framework.permissions.IsAuthenticated",), "DEFAULT_AUTHENTICATION_CLASSES": ( "rest_framework_simplejwt.authentication.JWTAuthentication", ), } SIMPLE_JWT = { "ACCESS_TOKEN_LIFETIME": timedelta(hours=5), "REFRESH_TOKEN_LIFETIME": timedelta(days=14), "ROTATE_REFRESH_TOKENS": True, "BLACKLIST_AFTER_ROTATION": True, "ALGORITHM": "HS256", "SIGNING_KEY": SECRET_KEY, "VERIFYING_KEY": None, "AUTH_HEADER_TYPES": ("JWT",), "USER_ID_FIELD": "id", "USER_ID_CLAIM": "user_id", "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",), "TOKEN_TYPE_CLAIM": "token_type", } CHANNEL_LAYERS = { "default": { "BACKEND": "channels.layers.InMemoryChannelLayer", }, } EMAIL_HOST = env("EMAIL_HOST", "mail.smtp2go.com") or "mail.smtp2go.com" EMAIL_HOST_USER = env("EMAIL_HOST_USER", "") or "" EMAIL_HOST_PASSWORD = env("EMAIL_HOST_PASSWORD", "") or "" EMAIL_PORT = int(env("EMAIL_PORT", "2525") or "2525") EMAIL_USE_TLS = env_bool("EMAIL_USE_TLS", True) # Django 6 Tasks: ImmediateBackend runs in-process (no worker yet). Swap BACKEND # to a durable queue + worker when SMTP should leave the request thread. TASKS = { "default": { "BACKEND": "django.tasks.backends.immediate.ImmediateBackend", } } CAPTCHA_SECRET_KEY = env("CAPTCHA_SECRET_KEY", "") or "" USE_TLS_PROXY = env_bool("USE_TLS_PROXY", DJANGO_ENV in {"prod", "beta"}) if USE_TLS_PROXY: SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https") directory_path = env("DJANGO_LOG_DIR", str(BASE_DIR / "logs")) or str(BASE_DIR / "logs") os.makedirs(directory_path, exist_ok=True) ALLOW_IMAGE_GENERATION = env_bool("ALLOW_IMAGE_GENERATION", False) ALLOW_INTERNET_ACCESS = env_bool("ALLOW_INTERNET_ACCESS", True) # Self-serve account registration (sign-up page). Default off — enable via # control-node secret (chat_backend_.env) when ready for public sign-up. ENABLE_ACCOUNT_REGISTRATION = env_bool("ENABLE_ACCOUNT_REGISTRATION", False) # --------------------------------------------------------------------------- # OAuth SSO (Google / Microsoft) — #24 # --------------------------------------------------------------------------- GOOGLE_OAUTH_CLIENT_ID = env("GOOGLE_OAUTH_CLIENT_ID", "") or "" GOOGLE_OAUTH_CLIENT_SECRET = env("GOOGLE_OAUTH_CLIENT_SECRET", "") or "" MICROSOFT_OAUTH_CLIENT_ID = env("MICROSOFT_OAUTH_CLIENT_ID", "") or "" MICROSOFT_OAUTH_CLIENT_SECRET = env("MICROSOFT_OAUTH_CLIENT_SECRET", "") or "" # Azure AD tenant: "common" (personal + work), "organizations", or a tenant ID. MICROSOFT_OAUTH_TENANT = env("MICROSOFT_OAUTH_TENANT", "common") or "common" # Public backend origin for IdP redirect URIs (e.g. https://chatbackend.aimloperations.com). # When empty, callback URLs are built from the incoming request. OAUTH_CALLBACK_BASE_URL = (env("OAUTH_CALLBACK_BASE_URL", "") or "").rstrip("/") # --------------------------------------------------------------------------- # Finance / Stripe (subscription billing) # --------------------------------------------------------------------------- STRIPE_SECRET_KEY = env("STRIPE_SECRET_KEY", "") or "" STRIPE_PUBLISHABLE_KEY = env("STRIPE_PUBLISHABLE_KEY", "") or "" STRIPE_WEBHOOK_SECRET = env("STRIPE_WEBHOOK_SECRET", "") or "" # Optional: use a pre-created Stripe Price. When empty, Checkout uses # price_data built from SUBSCRIPTION_PRICE_* below. STRIPE_PRICE_ID = env("STRIPE_PRICE_ID", "") or "" # Subscription list price — $10.00 USD / month (amount in cents). SUBSCRIPTION_PRICE_AMOUNT_CENTS = int( env("SUBSCRIPTION_PRICE_AMOUNT_CENTS", "1000") or "1000" ) SUBSCRIPTION_PRICE_CURRENCY = ( env("SUBSCRIPTION_PRICE_CURRENCY", "usd") or "usd" ).lower() SUBSCRIPTION_PRICE_INTERVAL = ( env("SUBSCRIPTION_PRICE_INTERVAL", "month") or "month" ).lower() SUBSCRIPTION_PRODUCT_NAME = ( env("SUBSCRIPTION_PRODUCT_NAME", "Chat Subscription") or "Chat Subscription" ) FRONTEND_BASE_URL = ( env("FRONTEND_BASE_URL", "http://localhost:3000") or "http://localhost:3000" ).rstrip("/") STRIPE_CHECKOUT_SUCCESS_URL = env( "STRIPE_CHECKOUT_SUCCESS_URL", f"{FRONTEND_BASE_URL}/billing/success?session_id={{CHECKOUT_SESSION_ID}}", ) or f"{FRONTEND_BASE_URL}/billing/success?session_id={{CHECKOUT_SESSION_ID}}" STRIPE_CHECKOUT_CANCEL_URL = env( "STRIPE_CHECKOUT_CANCEL_URL", f"{FRONTEND_BASE_URL}/billing/cancel", ) or f"{FRONTEND_BASE_URL}/billing/cancel" if DJANGO_ENV in {"prod", "beta"}: # Compose treats $ in .env as variable expansion — escape each $ as $$. if not SECRET_KEY: raise ValueError( "DJANGO_SECRET_KEY is empty in prod/beta. Set it in the control-node " "secret (~/Documents/secrets/chat_backend/chat_backend_.env). " "If the value contains $, write $$ or Compose will strip/empty it." ) if SECRET_KEY.startswith("django-insecure") or "dev-only" in SECRET_KEY: raise ValueError( "DJANGO_SECRET_KEY still looks like a placeholder " "(starts with 'django-insecure' or contains 'dev-only'). " "Replace it with a real random secret and redeploy." )