Dockerize Django app with dev/beta/prod env config and uv.

Replace hardcoded settings with environment-driven config, add Docker
compose for local and production deploys, migrate from pip to uv, and
split Gitea workflows so PRs run tests only while master pushes deploy.

.env.example

@@ -4,8 +4,6 @@ DJANGO_ENV=dev
 DJANGO_DEBUG=true
 DJANGO_SECRET_KEY=change-me-for-local-development
 DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0
-# Optional; when unset, http:// origins are derived for local hosts.
-# DJANGO_CSRF_TRUSTED_ORIGINS=http://localhost:8000,http://127.0.0.1:8000
 
 # Database (docker-compose sets DATABASE_URL for the web service)
 DATABASE_URL=postgres://company_site:company_site@db:5432/company_site

.env.prod.example

@@ -7,8 +7,6 @@ DJANGO_ENV=prod
 DJANGO_DEBUG=false
 DJANGO_SECRET_KEY=replace-with-a-long-random-secret
 DJANGO_ALLOWED_HOSTS=aimloperations.com,www.aimloperations.com
-# Optional override; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
-# DJANGO_CSRF_TRUSTED_ORIGINS=https://aimloperations.com,https://www.aimloperations.com
 
 # Logging (optional override; defaults: dev=DEBUG, beta=INFO, prod=WARNING)
 # DJANGO_LOG_LEVEL=WARNING

.gitea/workflows/deploy.yml

@@ -1,6 +1,6 @@
 name: Deploy Company Site
 
-# Runs after Unit Tests completes on master. Direct pushes only (not PRs).
+# Deploy pipeline runs only on pushes to master (never on pull requests).
 on:
   workflow_run:
     workflows: [Unit Tests]
@@ -8,14 +8,34 @@ on:
     branches: [master]
 
 jobs:
-  docker:
+  test:
-    if: gitea.event.workflow_run.conclusion == 'success' && gitea.event.workflow_run.event == 'push'
     runs-on: self-hosted
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
+
-          ref: ${{ gitea.event.workflow_run.head_sha }}
+      - name: Install uv
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Install dependencies
+        run: uv sync --frozen
+
+      - name: Run unit tests
+        env:
+          DJANGO_ENV: dev
+          DJANGO_SECRET_KEY: test-secret-key
+        run: |
+          cd company_site
+          uv run python manage.py test
+
+  docker:
+    runs-on: self-hosted
+    needs: test
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
 
       - name: Build Docker image
         run: docker compose build
@@ -33,13 +53,12 @@ jobs:
   deploy:
     if: gitea.event.workflow_run.conclusion == 'success' && gitea.event.workflow_run.event == 'push'
     runs-on: self-hosted
-    needs: docker
+    needs: [test, docker]
-    env:
-      SERVER_INFRA_ROOT: /home/westfarn/Documents/repos/server-infra
     steps:
-      - name: Deploy company_site prod
+      - name: Checkout
-        run: |
+        uses: actions/checkout@v4
-          "${SERVER_INFRA_ROOT}/scripts/deploy.sh" \
+        with:
-            --app company_site \
+          ref: ${{ gitea.event.workflow_run.head_sha }}
-            --env prod \
+
-            --ref "${{ gitea.event.workflow_run.head_sha }}"
+      - name: Deploy to live site
+        run: bash scripts/deploy.sh "${{ gitea.workspace }}"

.gitea/workflows/unittests.yml

@@ -13,18 +13,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install uv
+      - name: Set up Python environment
         run: |
-          curl -LsSf https://astral.sh/uv/install.sh | sh
+          python3 -m venv .venv
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          .venv/bin/pip install --upgrade pip
-
+          .venv/bin/pip install -r requirements.txt
-      - name: Install dependencies
-        run: uv sync --frozen
 
       - name: Run unit tests
-        env:
-          DJANGO_ENV: dev
-          DJANGO_SECRET_KEY: test-secret-key
         run: |
           cd company_site
-          uv run python manage.py test
+          ../.venv/bin/python manage.py test

company_site/company_site/settings/base.py

@@ -1,6 +1,5 @@
 """Shared Django settings for all environments."""
 
-import json
 import os
 from pathlib import Path
 from urllib.parse import urlparse
@@ -23,15 +22,6 @@ def env_list(key: str, default: str = "") -> list[str]:
     value = os.environ.get(key, default)
     if not value:
         return []
-    value = value.strip()
-    # Accept a JSON array (e.g. '["a","b"]') as well as a comma-separated list.
-    if value.startswith("["):
-        try:
-            parsed = json.loads(value)
-        except ValueError:
-            parsed = None
-        if isinstance(parsed, list):
-            return [str(item).strip() for item in parsed if str(item).strip()]
     return [item.strip() for item in value.split(",") if item.strip()]
 
 
@@ -82,34 +72,6 @@ WEBMCP_ENABLED = env_bool("WEBMCP_ENABLED", False)
 allowed_hosts = env_list("DJANGO_ALLOWED_HOSTS", "*")
 ALLOWED_HOSTS = allowed_hosts if allowed_hosts else ["*"]
 
-
-def build_csrf_trusted_origins(
-    allowed_hosts: list[str], explicit: list[str] | None = None
-) -> list[str]:
-    """Build CSRF_TRUSTED_ORIGINS for Django 4+ Origin checks on HTTPS POSTs.
-
-    Prefer DJANGO_CSRF_TRUSTED_ORIGINS when set. Otherwise derive from ALLOWED_HOSTS:
-    https for public hosts, http for local loopback hosts.
-    """
-    if explicit:
-        return explicit
-
-    local_hosts = {"localhost", "127.0.0.1", "0.0.0.0"}
-    origins: list[str] = []
-    for host in allowed_hosts:
-        if not host or host == "*" or host.startswith("."):
-            continue
-        hostname = host.split(":")[0]
-        scheme = "http" if hostname in local_hosts else "https"
-        origins.append(f"{scheme}://{host}")
-    return origins
-
-
-CSRF_TRUSTED_ORIGINS = build_csrf_trusted_origins(
-    ALLOWED_HOSTS,
-    env_list("DJANGO_CSRF_TRUSTED_ORIGINS"),
-)
-
 INSTALLED_APPS = [
     "public.apps.PublicConfig",
     "financial.apps.FinancialConfig",
@@ -185,7 +147,7 @@ STATIC_URL = "static/"
 STATIC_ROOT = BASE_DIR / "staticfiles"
 STORAGES = {
     "staticfiles": {
-        "BACKEND": "company_site.storage.TolerantManifestStaticFilesStorage",
+        "BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage",
     },
 }
 

company_site/company_site/settings/beta.py

@@ -11,10 +11,4 @@ if DEBUG:
 
   warnings.warn("DEBUG is enabled in beta environment.", stacklevel=1)
 
-# Same reverse-proxy assumptions as production when TLS is terminated upstream.
-SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
-USE_X_FORWARDED_HOST = True
-SESSION_COOKIE_SECURE = not DEBUG
-CSRF_COOKIE_SECURE = not DEBUG
-
 LOGGING = build_logging_config(logging_level_for_env("beta"), "beta")

company_site/company_site/settings/prod.py

@@ -9,10 +9,4 @@ TIANJI_ENABLED = env_bool("TIANJI_ENABLED", True)  # noqa: F405
 if not env("DJANGO_SECRET_KEY"):  # noqa: F405
   raise ValueError("DJANGO_SECRET_KEY must be set in production.")
 
-# App sits behind a reverse proxy that terminates TLS (docker :8000).
-SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
-USE_X_FORWARDED_HOST = True
-SESSION_COOKIE_SECURE = True
-CSRF_COOKIE_SECURE = True
-
 LOGGING = build_logging_config(logging_level_for_env("prod"), "prod")

company_site/company_site/storage.py

@@ -1,32 +0,0 @@
-"""Custom static files storage.
-
-WhiteNoise's manifest storage post-processes JS/CSS during ``collectstatic`` and
-strictly resolves every referenced file, including ``sourceMappingURL`` comments
-in vendored bundles. Some third-party assets reference ``.map`` files that are
-not shipped, which makes ``collectstatic`` fail hard.
-
-``TolerantManifestStaticFilesStorage`` leaves such unresolved references
-untouched instead of raising, so a missing source map can't break the build.
-"""
-
-from whitenoise.storage import CompressedManifestStaticFilesStorage
-
-
-class TolerantManifestStaticFilesStorage(CompressedManifestStaticFilesStorage):
-    # Don't 500 at runtime when a {% static %} reference isn't in the manifest;
-    # fall back to the plain name (mirrors non-manifest storage behaviour).
-    manifest_strict = False
-
-    def _stored_name(self, name, hashed_files):
-        """Tolerate missing references during collectstatic post-processing."""
-        try:
-            return super()._stored_name(name, hashed_files)
-        except ValueError:
-            return name
-
-    def stored_name(self, name):
-        """Tolerate missing manifest entries at request time."""
-        try:
-            return super().stored_name(name)
-        except ValueError:
-            return name

company_site/public/tests.py

@@ -1,90 +1,12 @@
 from unittest.mock import patch
 
-from django.contrib.auth.models import User
 from django.test import Client, TestCase, override_settings
 from django.urls import reverse
 
-from company_site.settings.base import build_csrf_trusted_origins
+from .models import Contact
-
-from .models import Contact, EmailMessage
 from .seo import SERVICE_URL_NAMES, get_service_entries
 
 
-class CsrfTrustedOriginsTests(TestCase):
-    def test_derives_https_origins_from_public_hosts(self):
-        origins = build_csrf_trusted_origins(
-            ["aimloperations.com", "www.aimloperations.com"]
-        )
-
-        self.assertEqual(
-            origins,
-            [
-                "https://aimloperations.com",
-                "https://www.aimloperations.com",
-            ],
-        )
-
-    def test_derives_http_origins_for_local_hosts(self):
-        origins = build_csrf_trusted_origins(["localhost", "127.0.0.1"])
-
-        self.assertEqual(origins, ["http://localhost", "http://127.0.0.1"])
-
-    def test_explicit_origins_win(self):
-        origins = build_csrf_trusted_origins(
-            ["aimloperations.com"],
-            ["https://custom.example"],
-        )
-
-        self.assertEqual(origins, ["https://custom.example"])
-
-
-class LogoutCsrfTests(TestCase):
-    def setUp(self):
-        self.client = Client(enforce_csrf_checks=True)
-        self.user = User.objects.create_user(username="logout_user", password="pass")
-
-    def test_logout_post_with_csrf_succeeds(self):
-        self.client.login(username="logout_user", password="pass")
-        self.client.get("/")
-        csrf = self.client.cookies["csrftoken"].value
-
-        response = self.client.post(
-            reverse("logout"),
-            {"csrfmiddlewaretoken": csrf},
-        )
-
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, "/")
-        self.assertNotIn("_auth_user_id", self.client.session)
-
-
-class PreviewEmailAuthTests(TestCase):
-    def setUp(self):
-        self.client = Client()
-        self.user = User.objects.create_user(username="previewer", password="pass")
-        self.email = EmailMessage.objects.create(
-            subject="Preview subject",
-            body="Preview body content",
-            recipient="recipient@example.com",
-        )
-        self.url = reverse("preview_email", kwargs={"pk": self.email.pk})
-
-    def test_unauthenticated_user_is_redirected_to_login(self):
-        response = self.client.get(self.url)
-
-        self.assertEqual(response.status_code, 302)
-        self.assertIn("/accounts/login/", response.url)
-
-    def test_authenticated_user_can_preview_email(self):
-        self.client.login(username="previewer", password="pass")
-
-        response = self.client.get(self.url)
-
-        self.assertEqual(response.status_code, 200)
-        self.assertContains(response, "Preview subject")
-        self.assertContains(response, "Preview body content")
-
-
 @override_settings(
     DEBUG=True,
     EMAIL_BACKEND="django.core.mail.backends.locmem.EmailBackend",

docker-compose.yml

@@ -18,14 +18,11 @@ services:
     build: .
     ports:
       - "8000:8000"
-    # No required env_file — CI has no .env. Defaults below; for local secrets:
+    env_file:
-    #   docker compose --env-file .env up
+      - .env
     environment:
-      DJANGO_ENV: ${DJANGO_ENV:-dev}
+      DJANGO_ENV: dev
-      DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:-dev-only-change-me}
+      DATABASE_URL: postgres://company_site:company_site@db:5432/company_site
-      DJANGO_DEBUG: ${DJANGO_DEBUG:-true}
-      DJANGO_ALLOWED_HOSTS: ${DJANGO_ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0}
-      DATABASE_URL: ${DATABASE_URL:-postgres://company_site:company_site@db:5432/company_site}
     depends_on:
       db:
         condition: service_healthy