Dockerize scha + Gitea CI/CD auto-deploy via server-infra (#21)

## Summary
- Dockerize SCHA Wheaton (uv packaging, Dockerfile, compose, entrypoint) and move secrets/DB config to env-driven `scha/settings/`.
- Add Gitea Actions: unit tests on push/PR to `master`, auto-deploy on green master push via `server-infra/scripts/deploy.sh --app scha --env prod`.
- Prod compose uses shared external Postgres only (no bundled DB); control-node secret template at `.env.prod.example`.

Closes #19 (Part A). Depends on companion server-infra PR for catalog/host_apps registration.

## Test plan
- [ ] `uv sync --frozen` + `DJANGO_ENV=dev DJANGO_SECRET_KEY=test uv run python manage.py check`
- [ ] `docker compose build` succeeds locally
- [ ] `docker compose up` serves app against bundled Postgres
- [ ] `./scripts/validate-env.sh ~/Documents/secrets/scha/scha_prod.env` passes
- [ ] After merge + server-infra catalog live: push to master runs Unit Tests then Deploy

Reviewed-on: #21

scha/settings.py

@@ -1,135 +0,0 @@
-"""
-Django settings for scha project.
-
-Generated by 'django-admin startproject' using Django 4.2.10.
-
-For more information on this file, see
-https://docs.djangoproject.com/en/4.2/topics/settings/
-
-For the full list of settings and their values, see
-https://docs.djangoproject.com/en/4.2/ref/settings/
-"""
-
-from pathlib import Path
-
-# Build paths inside the project like this: BASE_DIR / 'subdir'.
-BASE_DIR = Path(__file__).resolve().parent.parent
-
-
-# Quick-start development settings - unsuitable for production
-# See https://docs.djangoproject.com/en/4.2/howto/deployment/checklist/
-
-# SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = "django-insecure-0&6)5#t(wghsn$q7pg#s!x+_!s_y#labf6dh*8q%34q25iuag*"
-
-# SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
-
-ALLOWED_HOSTS = []
-
-
-# Application definition
-
-INSTALLED_APPS = [
-    "schasite.apps.SchasiteConfig",
-    "django.contrib.admin",
-    "django.contrib.auth",
-    "django.contrib.contenttypes",
-    "django.contrib.sessions",
-    "django.contrib.messages",
-    "django.contrib.staticfiles",
-    "phonenumber_field",
-    "django_recaptcha",
-]
-
-MIDDLEWARE = [
-    "django.middleware.security.SecurityMiddleware",
-    "django.contrib.sessions.middleware.SessionMiddleware",
-    "django.middleware.common.CommonMiddleware",
-    "django.middleware.csrf.CsrfViewMiddleware",
-    "django.contrib.auth.middleware.AuthenticationMiddleware",
-    "django.contrib.messages.middleware.MessageMiddleware",
-    "django.middleware.clickjacking.XFrameOptionsMiddleware",
-]
-
-ROOT_URLCONF = "scha.urls"
-CSRF_TRUSTED_ORIGINS = ["https://schawheaton.aimloperations.com","https://www.schawheaton.aimloperations.com", "https://www.schawheaton.com", "https://schawheaton.com"]
-TEMPLATES = [
-    {
-        "BACKEND": "django.template.backends.django.DjangoTemplates",
-        "DIRS": [],
-        "APP_DIRS": True,
-        "OPTIONS": {
-            "context_processors": [
-                "django.template.context_processors.debug",
-                "django.template.context_processors.request",
-                "django.contrib.auth.context_processors.auth",
-                "django.contrib.messages.context_processors.messages",
-            ],
-        },
-    },
-]
-
-WSGI_APPLICATION = "scha.wsgi.application"
-
-
-# Database
-# https://docs.djangoproject.com/en/4.2/ref/settings/#databases
-
-DATABASES = {
-    "default": {
-        "ENGINE": "django.db.backends.sqlite3",
-        "NAME": BASE_DIR / "db.sqlite3",
-    }
-}
-
-
-# Password validation
-# https://docs.djangoproject.com/en/4.2/ref/settings/#auth-password-validators
-
-AUTH_PASSWORD_VALIDATORS = [
-    {
-        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
-    },
-    {
-        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
-    },
-    {
-        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
-    },
-    {
-        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
-    },
-]
-
-
-# Internationalization
-# https://docs.djangoproject.com/en/4.2/topics/i18n/
-
-LANGUAGE_CODE = "en-us"
-
-TIME_ZONE = "UTC"
-
-USE_I18N = True
-
-USE_TZ = True
-
-
-# Static files (CSS, JavaScript, Images)
-# https://docs.djangoproject.com/en/4.2/howto/static-files/
-
-STATIC_URL = "static/"
-
-# Default primary key field type
-# https://docs.djangoproject.com/en/4.2/ref/settings/#default-auto-field
-
-DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
-STRIPE_PUBLISHABLE_KEY = "pk_test_51OxENZDV0RPXOyxGkZnncLFbpVoQq6qxUSN08BPDTpHjrm2UTtvOrBG2A2IQhX3oxdYd6amGaci00SKchYZ5DUUN00jTBzhh62"
-STRIPE_SECRET_KEY = "sk_test_51OxENZDV0RPXOyxGkULVr0MvVvXgNWsKjWiP54a9ls02LgsgXnzEwP0IQ0VjvP4Wt4RrPx1FvzHSbLvChQGOKvv800Ui0NBvIA"
-STRIPE_ENDPOINT_SECRET = (
-    "whsec_a38b2d115b64d86713397e2718e2d42e5d263139dfbac6c0badc6f9ca8f72557"
-)
-
-# Recaptcha Stuff
-RECAPTCHA_PUBLIC_KEY = "6LesfrkpAAAAAGJ5vYp4KuuGcyfk70HkihCwp3d3"
-RECAPTCHA_PRIVATE_KEY = "6LesfrkpAAAAABCcDGli5cZiq1hfS0lfRiXg0mlI"

scha/settings/__init__.py

@@ -0,0 +1,12 @@
+"""Load environment-specific Django settings based on DJANGO_ENV."""
+
+import os
+
+_environment = os.environ.get("DJANGO_ENV", "dev").lower()
+
+if _environment == "prod":
+    from .prod import *  # noqa: F403
+elif _environment == "beta":
+    from .beta import *  # noqa: F403
+else:
+    from .dev import *  # noqa: F403

scha/settings/base.py

@@ -0,0 +1,186 @@
+"""Shared Django settings for all environments."""
+
+import json
+import os
+from pathlib import Path
+from urllib.parse import urlparse
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent
+
+
+def env(key: str, default: str | None = None) -> str | None:
+    return os.environ.get(key, default)
+
+
+def env_bool(key: str, default: bool = False) -> bool:
+    value = os.environ.get(key)
+    if value is None:
+        return default
+    return value.lower() in {"1", "true", "yes", "on"}
+
+
+def env_list(key: str, default: str = "") -> list[str]:
+    value = os.environ.get(key, default)
+    if not value:
+        return []
+    value = value.strip()
+    if value.startswith("["):
+        try:
+            parsed = json.loads(value)
+        except ValueError:
+            parsed = None
+        if isinstance(parsed, list):
+            return [str(item).strip() for item in parsed if str(item).strip()]
+    return [item.strip() for item in value.split(",") if item.strip()]
+
+
+def database_config() -> dict:
+    database_url = env("DATABASE_URL")
+    if database_url:
+        parsed = urlparse(database_url)
+        return {
+            "default": {
+                "ENGINE": "django.db.backends.postgresql",
+                "NAME": parsed.path.lstrip("/"),
+                "USER": parsed.username or "",
+                "PASSWORD": parsed.password or "",
+                "HOST": parsed.hostname or "",
+                "PORT": str(parsed.port or 5432),
+            }
+        }
+
+    if env("DB_HOST"):
+        return {
+            "default": {
+                "ENGINE": "django.db.backends.postgresql",
+                "NAME": env("DB_NAME", "scha"),
+                "USER": env("DB_USER", "scha"),
+                "PASSWORD": env("DB_PASSWORD", ""),
+                "HOST": env("DB_HOST"),
+                "PORT": env("DB_PORT", "5432"),
+            }
+        }
+
+    return {
+        "default": {
+            "ENGINE": "django.db.backends.sqlite3",
+            "NAME": BASE_DIR / "db.sqlite3",
+        }
+    }
+
+
+def build_csrf_trusted_origins(
+    allowed_hosts: list[str], explicit: list[str] | None = None
+) -> list[str]:
+    """Build CSRF_TRUSTED_ORIGINS for Django 4+ Origin checks on HTTPS POSTs."""
+    if explicit:
+        return explicit
+
+    local_hosts = {"localhost", "127.0.0.1", "0.0.0.0"}
+    origins: list[str] = []
+    for host in allowed_hosts:
+        if not host or host == "*" or host.startswith("."):
+            continue
+        hostname = host.split(":")[0]
+        scheme = "http" if hostname in local_hosts else "https"
+        origins.append(f"{scheme}://{host}")
+    return origins
+
+
+SECRET_KEY = env(
+    "DJANGO_SECRET_KEY",
+    "django-insecure-dev-only-change-me-before-production",
+)
+
+DEBUG = env_bool("DJANGO_DEBUG", False)
+
+allowed_hosts = env_list("DJANGO_ALLOWED_HOSTS", "*")
+ALLOWED_HOSTS = allowed_hosts if allowed_hosts else ["*"]
+
+CSRF_TRUSTED_ORIGINS = build_csrf_trusted_origins(
+    ALLOWED_HOSTS,
+    env_list("DJANGO_CSRF_TRUSTED_ORIGINS"),
+)
+
+INSTALLED_APPS = [
+    "schasite.apps.SchasiteConfig",
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "whitenoise.runserver_nostatic",
+    "django.contrib.staticfiles",
+    "phonenumber_field",
+    "django_recaptcha",
+]
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "whitenoise.middleware.WhiteNoiseMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+]
+
+ROOT_URLCONF = "scha.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.debug",
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "scha.wsgi.application"
+
+DATABASES = database_config()
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
+    },
+]
+
+LANGUAGE_CODE = "en-us"
+TIME_ZONE = "UTC"
+USE_I18N = True
+USE_TZ = True
+
+STATIC_URL = "static/"
+STATIC_ROOT = BASE_DIR / "staticfiles"
+STORAGES = {
+    "staticfiles": {
+        "BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage",
+    },
+}
+
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+
+STRIPE_PUBLISHABLE_KEY = env("STRIPE_PUBLISHABLE_KEY", "")
+STRIPE_SECRET_KEY = env("STRIPE_SECRET_KEY", "")
+STRIPE_ENDPOINT_SECRET = env("STRIPE_ENDPOINT_SECRET", "")
+
+RECAPTCHA_PUBLIC_KEY = env("RECAPTCHA_PUBLIC_KEY", "")
+RECAPTCHA_PRIVATE_KEY = env("RECAPTCHA_PRIVATE_KEY", "")

scha/settings/beta.py

@@ -0,0 +1,18 @@
+"""Beta/staging settings."""
+
+from .base import *  # noqa: F403
+from .logging import build_logging_config, logging_level_for_env
+
+DEBUG = env_bool("DJANGO_DEBUG", False)  # noqa: F405
+
+if DEBUG:
+    import warnings
+
+    warnings.warn("DEBUG is enabled in beta environment.", stacklevel=1)
+
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+USE_X_FORWARDED_HOST = True
+SESSION_COOKIE_SECURE = not DEBUG
+CSRF_COOKIE_SECURE = not DEBUG
+
+LOGGING = build_logging_config(logging_level_for_env("beta"), "beta")

scha/settings/dev.py

@@ -0,0 +1,14 @@
+"""Development settings."""
+
+from .base import *  # noqa: F403
+from .logging import build_logging_config, logging_level_for_env
+
+DEBUG = True
+
+STORAGES = {
+    "staticfiles": {
+        "BACKEND": "django.contrib.staticfiles.storage.StaticFilesStorage",
+    },
+}
+
+LOGGING = build_logging_config(logging_level_for_env("dev"), "dev")

scha/settings/logging.py

@@ -0,0 +1,58 @@
+"""Environment-specific logging configuration."""
+
+import os
+
+
+def build_logging_config(level: str, environment: str) -> dict:
+    """Return a Django LOGGING dict for the given level and environment name."""
+    return {
+        "version": 1,
+        "disable_existing_loggers": False,
+        "formatters": {
+            "verbose": {
+                "format": (
+                    f"{{levelname}} {{asctime}} {{name}} {{process:d}} {{thread:d}} "
+                    f"[env={environment}] {{message}}"
+                ),
+                "style": "{",
+            },
+            "simple": {
+                "format": f"{{levelname}} [env={environment}] {{message}}",
+                "style": "{",
+            },
+        },
+        "handlers": {
+            "console": {
+                "class": "logging.StreamHandler",
+                "formatter": "verbose" if environment == "dev" else "simple",
+            },
+        },
+        "root": {
+            "handlers": ["console"],
+            "level": level,
+        },
+        "loggers": {
+            "django": {
+                "handlers": ["console"],
+                "level": level,
+                "propagate": False,
+            },
+            "django.request": {
+                "handlers": ["console"],
+                "level": "ERROR" if environment == "prod" else level,
+                "propagate": False,
+            },
+        },
+    }
+
+
+def logging_level_for_env(environment: str) -> str:
+    override = os.environ.get("DJANGO_LOG_LEVEL")
+    if override:
+        return override.upper()
+
+    if environment == "dev":
+        return "DEBUG"
+    if environment == "beta":
+        return "INFO"
+    return "WARNING"

scha/settings/prod.py

@@ -0,0 +1,16 @@
+"""Production settings."""
+
+from .base import *  # noqa: F403
+from .logging import build_logging_config, logging_level_for_env
+
+DEBUG = False
+
+if not env("DJANGO_SECRET_KEY"):  # noqa: F405
+    raise ValueError("DJANGO_SECRET_KEY must be set in production.")
+
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+USE_X_FORWARDED_HOST = True
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+
+LOGGING = build_logging_config(logging_level_for_env("prod"), "prod")