westfarn
0b76b781e3
Unit Tests / test (push) Successful in 3s
## Summary
- Root cause: `docker-compose.yml` used `${DATABASE_URL:-…}`, so the Act runner’s host/`prod` `DATABASE_URL` was interpolated into the web service. Containerized deploy tests then ran against shared Postgres instead of the bundled compose `db`.
- Stop reading host `DATABASE_URL` in compose (use `COMPOSE_DATABASE_URL` override only).
- Deploy docker step: unset DB secrets, dedicated compose project name, `up --wait db`, force test `DATABASE_URL` to `postgres://scha:scha@db:5432/scha`, `down -v` on exit (ephemeral DB).
- Clear `DATABASE_URL`/`DB_HOST` in `unittests.yml` / `ci.yml` so host sqlite-fallback tests cannot hit prod either.
## Test plan
- [ ] Merge to `master` and watch Unit Tests + Deploy docker job.
- [ ] Confirm docker step connects only to compose `db` (no traffic/errors against `10.0.0.230`).
- [ ] Confirm `docker compose -p scha-ci-<sha> …` volumes cleaned after job (`down -v`).
- [ ] Local: `docker compose up --build` still works with bundled Postgres.
Reviewed-on: #24
SCHA Wheaton
Django site for SCHA Wheaton. Packaging via uv; production deploy via server-infra.
Local development
Prerequisites
- Python 3.12+
- uv
- Docker + Docker Compose (optional, recommended)
uv (host)
cp .env.example .env
uv sync
uv run python manage.py migrate
uv run python manage.py runserver
Without DATABASE_URL / DB_HOST, settings fall back to SQLite (db.sqlite3).
Docker (dev, bundled Postgres)
docker compose up --build
App: http://localhost:8000 — Postgres via bundled db (postgres://scha:scha@db:5432/scha).
Compose does not read host DATABASE_URL (avoids CI/prod leaks); override with COMPOSE_DATABASE_URL if needed.
Environment variables
| Variable | Dev default | Prod required | Notes |
|---|---|---|---|
DJANGO_ENV |
dev |
prod / beta |
Selects settings module |
DJANGO_SECRET_KEY |
insecure default | yes | Must be set in prod |
DJANGO_DEBUG |
env default / true in dev |
false |
|
DJANGO_ALLOWED_HOSTS |
* |
yes | Comma-separated |
DJANGO_CSRF_TRUSTED_ORIGINS |
derived from hosts | optional | Comma-separated full origins |
DATABASE_URL |
SQLite fallback | yes | Shared Postgres in prod |
WEB_PORT |
n/a (compose) | 8002 |
Host port for prod compose |
STRIPE_* |
empty | yes (prod/beta) | Publishable, secret, webhook |
RECAPTCHA_* |
empty | yes (prod/beta) | Public + private |
Templates: .env.example (local), .env.prod.example (control-node secret).
Control-node secret path (server-infra):
~/Documents/secrets/scha/scha_prod.env
Validate with:
./scripts/validate-env.sh ~/Documents/secrets/scha/scha_prod.env
Production (docker-compose.prod.yml)
- Single
webservice; no bundled DB —DATABASE_URLpoints at shared Postgres (10.0.0.230). - Host port from
WEB_PORT(catalog: 8002). - Deployed by
server-infra/scripts/deploy.sh --app scha --env prod --ref <sha>.
CI / CD (Gitea Actions)
| Workflow | Trigger | Action |
|---|---|---|
unittests.yml |
push + PR → master |
uv sync + manage.py test |
ci.yml |
PR → master |
same unit tests |
deploy.yml |
after Unit Tests succeeds on master push |
docker build + tests on ephemeral compose Postgres → deploy.sh |
Deploy never runs on PRs.
Security note
Stripe and reCAPTCHA keys previously lived in settings.py. Treat them as compromised; rotate and set real values only in the control-node env file (never commit).