Generate a unique SECRET_KEY_FILE when deploying a new django instance (ref: build_suite.sh)
#531
Conversation
wlorenzetti
added
feature
Raruto
changed the title
SECRET_KEY_FILE when deploying a new django instance (ref: build_suite.sh)
g3w-admin/base/settings/__init__.py
Outdated
|
|
||
| # Read SECRET_KEY from SECRET_KEY_FILE environment variable | ||
| try: | ||
| with open(os.getenv('SECRET_KEY_FILE', '/shared-volume/.secret_key')) as f: |
There was a problem hiding this comment.
Just to know, have you also considered this other topic? Manage sensitive data with Docker secrets (related to: g3w-suite/g3w-suite-docker#71)
When you deploy, Docker mounts a file under
/run/secrets/<secret_name>in the services. These files are never persisted in disk, but are managed in memory.
If I'm not mistaken, within the compose file, it's possible to use the secrets: attribute without enable a "swarm" mode.
There was a problem hiding this comment.
Yes but in this way if someone want deploy it by classic way (without docker), can do it, no?
There was a problem hiding this comment.
@Raruto I think we can merge it, do you approve it?
Raruto
added
config
ci_scripts/build_suite.sh
Outdated
|
|
||
| echo "Create unique django SECRET_KEY" | ||
| SECRET_KEY=$(python3 -c "from django.core.management.utils import get_random_secret_key;sk=get_random_secret_key();print (sk)") | ||
| touch ${BUILD_DONE_FILE} | ||
| echo ${SECRET_KEY} >> ${SECRET_KEY_FILE} | ||
|
|
There was a problem hiding this comment.
Could we move this inside a dedicated management command? --> Distributing Django projects with unique SECRET_KEYs
Is it feasible to run these such of commands in a pre-installation phase?
There was a problem hiding this comment.
I can move the code inside a dedicated management command, as inside the stackoverflow solution you which you mentioned, but I prefer to leave the file containing the secret key as a hidden file instead of a .py module.
What do you mean with
pre-installation phase
build_suite.sh is just in a pre-installation phase, no?
There was a problem hiding this comment.
I mean, I don't know if we can run the manage.py commands before a django project is installed / created.
It's just a doubt, since I don't exactly know the whole flow..
There was a problem hiding this comment.
Ok, I just try it on a new docker deploy and it works fine.
…om cdjango command to classic python cli module.
Closes: #523