lokses
719d0b737b
- AcoreDiscoverRunner собирает tests/tests_* всех локальных приложений (manage.py test находил 38 тестов из ~466 — теперь все). - CACHES на Redis (отдельная DB от Celery) + обязательный requirepass в production, SECURE_HSTS_PRELOAD. - Фикс stored-XSS в админке: format_html вместо mark_safe + f-string. - Утилиты безопасности/тестов, шифрование полей. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
55 lines
2.5 KiB
Bash
55 lines
2.5 KiB
Bash
# Django
|
||
# За Traefik: acore.settings.production, DEBUG=False, gunicorn на :8000 внутри LXC.
|
||
DJANGO_SETTINGS_MODULE=acore.settings.local
|
||
DEBUG=True
|
||
SECRET_KEY=change-me-in-production
|
||
ALLOWED_HOSTS=10.10.31.3,localhost,127.0.0.1
|
||
# Публичное имя через Traefik (Host rule) — добавьте к ALLOWED_HOSTS:
|
||
# ALLOWED_HOSTS=portal.example.local,10.10.31.3
|
||
# PORTAL_BASE_URL=https://portal.example.local
|
||
# CSRF_TRUSTED_ORIGINS=https://portal.example.local
|
||
DATABASE_URL=postgres://acore:CHANGE_ME@10.10.31.2:5432/acore
|
||
|
||
# Fernet field encryption for ConnectorConfig / bot tokens / Carbonio passwords.
|
||
# MUST be set in production (acore.settings.production refuses empty value).
|
||
# Keep equal to the key used when secrets were encrypted, or re-encrypt after rotation.
|
||
# Prefer a value DISTINCT from SECRET_KEY once you are ready to rotate.
|
||
FIELD_ENCRYPTION_KEY=
|
||
|
||
# Mattermost integrations (fail-closed when empty)
|
||
MATTERMOST_SLASH_COMMAND_TOKEN=
|
||
# Interactive button actions; defaults to slash token if unset
|
||
MATTERMOST_INTERACTIVE_TOKEN=
|
||
PORTAL_BASE_URL=http://localhost:8000
|
||
|
||
# Карты Leaflet: CARTO basemaps требуют бесплатный API key (иначе — OpenStreetMap).
|
||
# https://carto.com/basemaps/apikey/
|
||
# CARTO_BASEMAPS_API_KEY=
|
||
|
||
# ACORE → PNMS identity sync (must match PNMS ACORE_SYNC_TOKEN).
|
||
# В production DEBUG=False требует https:// — в payload уходит password_hash (PBKDF2).
|
||
# PNMS_SYNC_ENABLED=1
|
||
# PNMS_BASE_URL=https://pnms.example
|
||
# PNMS_ACORE_TOKEN=
|
||
|
||
# ACORE → MSORTER (сотрудники в группе «Почта»). Токен = MSORTER ACORE_SYNC_TOKEN.
|
||
# В production DEBUG=False требует https://.
|
||
# MSORTER_SYNC_ENABLED=1
|
||
# MSORTER_BASE_URL=https://msorter.example
|
||
# MSORTER_ACORE_TOKEN=
|
||
|
||
# ACORE → PVMS (посещаемость). Токен = PVMS ACORE_SYNC_TOKEN.
|
||
# PVMS_ATTENDANCE_SOT=1 после dump: портал и /api/attendance/register/ идут в PVMS.
|
||
# PVMS_SYNC_ENABLED=1
|
||
# PVMS_BASE_URL=https://pvms.example
|
||
# PVMS_ACORE_TOKEN=
|
||
# PVMS_REPORT_TOKEN= # опционально отдельный для /api/reports/; иначе = ACORE_TOKEN
|
||
# PVMS_ATTENDANCE_SOT=0
|
||
|
||
# Redis cache for production (login throttle across workers). Separate DB from Celery /0.
|
||
# Production требует пароль в URL (requirepass). Временно: REDIS_ALLOW_UNAUTHENTICATED=1.
|
||
# CACHE_URL=redis://:CHANGE_ME@127.0.0.1:6379/1
|
||
# CELERY_BROKER_URL=redis://:CHANGE_ME@127.0.0.1:6379/0
|
||
# CELERY_RESULT_BACKEND=redis://:CHANGE_ME@127.0.0.1:6379/0
|
||
# REDIS_ALLOW_UNAUTHENTICATED=1
|