""" Django settings for passbook project. Generated by 'django-admin startproject' using Django 2.1.3. For more information on this file, see https://docs.djangoproject.com/en/2.1/topics/settings/ For the full list of settings and their values, see https://docs.djangoproject.com/en/2.1/ref/settings/ """ import importlib import os import sys import structlog from celery.schedules import crontab from sentry_sdk import init as sentry_init from sentry_sdk.integrations.celery import CeleryIntegration from sentry_sdk.integrations.django import DjangoIntegration from passbook import __version__ from passbook.lib.config import CONFIG from passbook.lib.logging import add_process_id from passbook.lib.sentry import before_send LOGGER = structlog.get_logger() # Build paths inside the project like this: os.path.join(BASE_DIR, ...) BASE_DIR = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))) STATIC_ROOT = BASE_DIR + "/static" # Quick-start development settings - unsuitable for production # See https://docs.djangoproject.com/en/2.1/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! SECRET_KEY = CONFIG.y( "secret_key", "9$@r!d^1^jrn#fk#1#@ks#9&i$^s#1)_13%$rwjrhd=e8jfi_s" ) # noqa Debug DEBUG = CONFIG.y_bool("debug") INTERNAL_IPS = ["127.0.0.1"] ALLOWED_HOSTS = ["*"] SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https") LOGIN_URL = "passbook_core:auth-login" # CSRF_FAILURE_VIEW = 'passbook.core.views.errors.CSRFErrorView.as_view' # Custom user model AUTH_USER_MODEL = "passbook_core.User" if DEBUG: CSRF_COOKIE_NAME = "passbook_csrf_debug" LANGUAGE_COOKIE_NAME = "passbook_language_debug" SESSION_COOKIE_NAME = "passbook_session_debug" SESSION_COOKIE_SAMESITE = None else: CSRF_COOKIE_NAME = "passbook_csrf" LANGUAGE_COOKIE_NAME = "passbook_language" SESSION_COOKIE_NAME = "passbook_session" SESSION_COOKIE_DOMAIN = CONFIG.y("domain", None) AUTHENTICATION_BACKENDS = [ "django.contrib.auth.backends.ModelBackend", "guardian.backends.ObjectPermissionBackend", ] # Application definition INSTALLED_APPS = [ "django.contrib.admin", "django.contrib.auth", "django.contrib.contenttypes", "django.contrib.sessions", "django.contrib.messages", "django.contrib.staticfiles", "django.contrib.postgres", "rest_framework", "drf_yasg", "guardian", "django_prometheus", "passbook.static.apps.PassbookStaticConfig", "passbook.admin.apps.PassbookAdminConfig", "passbook.api.apps.PassbookAPIConfig", "passbook.lib.apps.PassbookLibConfig", "passbook.flows.apps.PassbookFlowsConfig", "passbook.policies.apps.PassbookPoliciesConfig", "passbook.audit.apps.PassbookAuditConfig", "passbook.crypto.apps.PassbookCryptoConfig", "passbook.recovery.apps.PassbookRecoveryConfig", "passbook.sources.saml.apps.PassbookSourceSAMLConfig", "passbook.sources.ldap.apps.PassbookSourceLDAPConfig", "passbook.sources.oauth.apps.PassbookSourceOAuthConfig", "passbook.providers.app_gw.apps.PassbookApplicationApplicationGatewayConfig", "passbook.providers.oauth.apps.PassbookProviderOAuthConfig", "passbook.providers.oidc.apps.PassbookProviderOIDCConfig", "passbook.providers.saml.apps.PassbookProviderSAMLConfig", "passbook.providers.samlv2.apps.PassbookProviderSAMLv2Config", "passbook.stages.login.apps.PassbookStageLoginConfig", "passbook.stages.identification.apps.PassbookStageIdentificationConfig", "passbook.stages.otp.apps.PassbookStageOTPConfig", "passbook.stages.captcha.apps.PassbookStageCaptchaConfig", "passbook.stages.password.apps.PassbookStagePasswordConfig", "passbook.stages.email.apps.PassbookStageEmailConfig", "passbook.policies.expiry.apps.PassbookPolicyExpiryConfig", "passbook.policies.reputation.apps.PassbookPolicyReputationConfig", "passbook.policies.hibp.apps.PassbookPolicyHIBPConfig", "passbook.policies.password.apps.PassbookPoliciesPasswordConfig", "passbook.policies.webhook.apps.PassbookPoliciesWebhookConfig", "passbook.policies.expression.apps.PassbookPolicyExpressionConfig", ] GUARDIAN_MONKEY_PATCH = False SWAGGER_SETTINGS = { "DEFAULT_INFO": "passbook.api.v2.urls.info", } REST_FRAMEWORK = { "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.LimitOffsetPagination", "PAGE_SIZE": 100, "DEFAULT_FILTER_BACKENDS": [ "django_filters.rest_framework.DjangoFilterBackend", "rest_framework.filters.OrderingFilter", "rest_framework.filters.SearchFilter", ], "DEFAULT_PERMISSION_CLASSES": ( # 'rest_framework.permissions.IsAuthenticated', "passbook.api.permissions.CustomObjectPermissions", ), "DEFAULT_AUTHENTICATION_CLASSES": ( "rest_framework.authentication.SessionAuthentication", # 'rest_framework_jwt.authentication.JSONWebTokenAuthentication', ), } CACHES = { "default": { "BACKEND": "django_redis.cache.RedisCache", "LOCATION": ( f"redis://:{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}:6379" f"/{CONFIG.y('redis.cache_db')}" ), "OPTIONS": {"CLIENT_CLASS": "django_redis.client.DefaultClient",}, } } DJANGO_REDIS_IGNORE_EXCEPTIONS = True DJANGO_REDIS_LOG_IGNORED_EXCEPTIONS = True SESSION_ENGINE = "django.contrib.sessions.backends.cache" SESSION_CACHE_ALIAS = "default" MIDDLEWARE = [ "django_prometheus.middleware.PrometheusBeforeMiddleware", "django.contrib.sessions.middleware.SessionMiddleware", "django.contrib.auth.middleware.AuthenticationMiddleware", "django.middleware.security.SecurityMiddleware", "django.middleware.common.CommonMiddleware", "django.middleware.csrf.CsrfViewMiddleware", "django.contrib.messages.middleware.MessageMiddleware", "django.middleware.clickjacking.XFrameOptionsMiddleware", "django_prometheus.middleware.PrometheusAfterMiddleware", ] ROOT_URLCONF = "passbook.root.urls" TEMPLATES = [ { "BACKEND": "django.template.backends.django.DjangoTemplates", "DIRS": [], "APP_DIRS": True, "OPTIONS": { "context_processors": [ "django.template.context_processors.debug", "django.template.context_processors.request", "django.contrib.auth.context_processors.auth", "django.contrib.messages.context_processors.messages", ], }, }, ] WSGI_APPLICATION = "passbook.root.wsgi.application" # Database # https://docs.djangoproject.com/en/2.1/ref/settings/#databases DATABASES = { "default": { "ENGINE": "django_prometheus.db.backends.postgresql", "HOST": CONFIG.y("postgresql.host"), "NAME": CONFIG.y("postgresql.name"), "USER": CONFIG.y("postgresql.user"), "PASSWORD": CONFIG.y("postgresql.password"), } } # Password validation # https://docs.djangoproject.com/en/2.1/ref/settings/#auth-password-validators AUTH_PASSWORD_VALIDATORS = [ { "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator", }, {"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",}, {"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",}, {"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",}, ] # Internationalization # https://docs.djangoproject.com/en/2.1/topics/i18n/ LANGUAGE_CODE = "en-us" TIME_ZONE = "UTC" USE_I18N = True USE_L10N = True USE_TZ = True # Celery settings # Add a 10 minute timeout to all Celery tasks. CELERY_TASK_SOFT_TIME_LIMIT = 600 CELERY_BEAT_SCHEDULE = { "clean_nonces": { "task": "passbook.core.tasks.clean_nonces", "schedule": crontab(minute="*/5"), # Run every 5 minutes } } CELERY_CREATE_MISSING_QUEUES = True CELERY_TASK_DEFAULT_QUEUE = "passbook" CELERY_BROKER_URL = ( f"redis://:{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}" f":6379/{CONFIG.y('redis.message_queue_db')}" ) CELERY_RESULT_BACKEND = ( f"redis://:{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}" f":6379/{CONFIG.y('redis.message_queue_db')}" ) # Database backup if CONFIG.y("postgresql.backup"): INSTALLED_APPS += ["dbbackup"] DBBACKUP_STORAGE = "storages.backends.s3boto3.S3Boto3Storage" DBBACKUP_CONNECTORS = { "default": {"CONNECTOR": "dbbackup.db.postgresql.PgDumpConnector"} } AWS_ACCESS_KEY_ID = CONFIG.y("postgresql.backup.access_key") AWS_SECRET_ACCESS_KEY = CONFIG.y("postgresql.backup.secret_key") AWS_STORAGE_BUCKET_NAME = CONFIG.y("postgresql.backup.bucket") AWS_S3_ENDPOINT_URL = CONFIG.y("postgresql.backup.host") AWS_DEFAULT_ACL = None LOGGER.info( "Database backup is configured", host=CONFIG.y("postgresql.backup.host") ) # Add automatic task to backup CELERY_BEAT_SCHEDULE["db_backup"] = { "task": "passbook.lib.tasks.backup_database", "schedule": crontab(minute=0, hour=0), # Run every day, midnight } # Sentry integration _ERROR_REPORTING = CONFIG.y_bool("error_reporting", False) if not DEBUG and _ERROR_REPORTING: LOGGER.info("Error reporting is enabled.") sentry_init( dsn="https://33cdbcb23f8b436dbe0ee06847410b67@sentry.beryju.org/3", integrations=[DjangoIntegration(), CeleryIntegration()], send_default_pii=True, before_send=before_send, release="passbook@%s" % __version__, ) # Static files (CSS, JavaScript, Images) # https://docs.djangoproject.com/en/2.1/howto/static-files/ STATIC_URL = "/static/" structlog.configure_once( processors=[ structlog.stdlib.add_log_level, structlog.stdlib.add_logger_name, add_process_id, structlog.stdlib.PositionalArgumentsFormatter(), structlog.processors.TimeStamper(), structlog.processors.StackInfoRenderer(), structlog.processors.format_exc_info, structlog.stdlib.ProcessorFormatter.wrap_for_formatter, ], context_class=structlog.threadlocal.wrap_dict(dict), logger_factory=structlog.stdlib.LoggerFactory(), wrapper_class=structlog.stdlib.BoundLogger, cache_logger_on_first_use=True, ) LOG_PRE_CHAIN = [ # Add the log level and a timestamp to the event_dict if the log entry # is not from structlog. structlog.stdlib.add_log_level, structlog.processors.TimeStamper(), ] LOGGING = { "version": 1, "disable_existing_loggers": False, "formatters": { "plain": { "()": structlog.stdlib.ProcessorFormatter, "processor": structlog.processors.JSONRenderer(sort_keys=True), "foreign_pre_chain": LOG_PRE_CHAIN, }, "colored": { "()": structlog.stdlib.ProcessorFormatter, "processor": structlog.dev.ConsoleRenderer(colors=DEBUG), "foreign_pre_chain": LOG_PRE_CHAIN, }, }, "handlers": { "console": { "level": "DEBUG", "class": "logging.StreamHandler", "formatter": "colored" if DEBUG else "plain", }, }, "loggers": {}, } LOG_LEVEL = "DEBUG" if DEBUG else "WARNING" _LOGGING_HANDLER_MAP = { "": LOG_LEVEL, "passbook": LOG_LEVEL, "django": "WARNING", "celery": "WARNING", "grpc": LOG_LEVEL, "oauthlib": LOG_LEVEL, "oauth2_provider": LOG_LEVEL, "oidc_provider": LOG_LEVEL, } for handler_name, level in _LOGGING_HANDLER_MAP.items(): # pyright: reportGeneralTypeIssues=false LOGGING["loggers"][handler_name] = { "handlers": ["console"], "level": level, "propagate": False, } TEST = False TEST_RUNNER = "xmlrunner.extra.djangotestrunner.XMLTestRunner" TEST_OUTPUT_VERBOSE = 2 TEST_OUTPUT_FILE_NAME = "unittest.xml" if any("test" in arg for arg in sys.argv): LOGGING = None TEST = True CELERY_TASK_ALWAYS_EAGER = True _DISALLOWED_ITEMS = [ "INSTALLED_APPS", "MIDDLEWARE", "AUTHENTICATION_BACKENDS", "CELERY_BEAT_SCHEDULE", ] # Load subapps's INSTALLED_APPS for _app in INSTALLED_APPS: if _app.startswith("passbook"): if "apps" in _app: _app = ".".join(_app.split(".")[:-2]) try: app_settings = importlib.import_module("%s.settings" % _app) INSTALLED_APPS.extend(getattr(app_settings, "INSTALLED_APPS", [])) MIDDLEWARE.extend(getattr(app_settings, "MIDDLEWARE", [])) AUTHENTICATION_BACKENDS.extend( getattr(app_settings, "AUTHENTICATION_BACKENDS", []) ) CELERY_BEAT_SCHEDULE.update( getattr(app_settings, "CELERY_BEAT_SCHEDULE", {}) ) for _attr in dir(app_settings): if not _attr.startswith("__") and _attr not in _DISALLOWED_ITEMS: globals()[_attr] = getattr(app_settings, _attr) except ImportError: pass if DEBUG: INSTALLED_APPS.append("debug_toolbar") MIDDLEWARE.append("debug_toolbar.middleware.DebugToolbarMiddleware") # Load Dummy/Debug objects INSTALLED_APPS += [ "passbook.stages.dummy.apps.PassbookStageDummyConfig", "passbook.policies.dummy.apps.PassbookPolicyDummyConfig", ] INSTALLED_APPS.append("passbook.core.apps.PassbookCoreConfig")