'Deploy a Django App With Gunicorn, Nginx, & HTTPS' companion repo (#121)

bsolomon1124 · bzaczynski · spacerest · web-flow · commit c17c4a4d6f84 · 2021-11-11T15:19:58.000+01:00
* 'Django Security Headers in Practice' companion repo

* Rename per PR template guidelines

* Remove logging call (redundant with httpie)

* Additional header-related settings

* Use a new SECRET_KEY

* Gunicorn configuration

* Spacing

* Update ALLOWED_HOSTS

* Typo

* SK gitignore

* Specify project requirements

* Add &lt;link&gt; to normalize.css

* Add CSP to middleware

* Set Content-Security Policy (CSP)

* Typo

* HSTS

* Increase SECURE_HSTS_SECONDS to 1 year

* Nginx configuration file

* Make the base path reachable

* Add a JS static file for collectstatic

* Path fix

* Update nginx config

* Remove localhost

* Don't specify unncessary path in STATICFILES_DIRS

* Turn of DEBUG

* Bring in line with article

* Call the toy project 'django-gunicorn-nginx'

* black

* Consolidate config under subdirectory

* Consolidate requirements under subdirectory

* Shorten requirement file names

* Pin to Django 3

* Shorten gunicorn config file names

* Loosely pin requirements

* Build out Gunicorn config

* Add util script for installing certbot

* Remove extraneous setting

* Use a template

* Add to INSTALLED_APPS; ALLOWED_HOSTS wildcard

* Remove outdated script

* Turn off DEBUG

* Include local and remote JS in template

* Update nginx sites-available config

* Update for article 0058e4b4

* Top-level sample project folders should contain a README.md file

* Pin requirements to minor rather than major version

* Add a description and intro howto in the readme

* Language edit

Co-authored-by: Bartosz Zaczyński &lt;bartosz.zaczynski@gmail.com&gt;
Co-authored-by: Sadie Parker &lt;sadiemparker@gmail.com&gt;
diff --git a/.gitignore b/.gitignore
@@ -56,6 +56,8 @@ coverage.xml
 # Django stuff:
 *.log
 local_settings.py
+*.sqlite3
+nohup.out
 
 # Flask stuff:
 instance/
diff --git a/django-gunicorn-nginx/.gitignore b/django-gunicorn-nginx/.gitignore
@@ -0,0 +1 @@
+.DJANGO_SECRET_KEY
diff --git a/django-gunicorn-nginx/README.md b/django-gunicorn-nginx/README.md
@@ -0,0 +1,24 @@
+# Securely Deploy a Django App With Gunicorn, Nginx, & HTTPS
+
+This directory contains the Django project created in the tutorial [Securely Deploy a Django App With Gunicorn, Nginx, & HTTPS](https://realpython.com/django-nginx-gunicorn/).
+
+It requires Python 3.8 or higher and Django 3.2.
+
+Here's what this repository and the tutorial illustrate:
+
+- How you can take your Django app **from development to production**
+- How you can **host your app** on a real-world public domain
+- How to introduce **Gunicorn** and **Nginx** into the request and response chain
+- How **HTTP headers** can fortify your site's HTTPS security
+
+To get started, install requirements and migrate your database:
+
+```bash
+python3 -m venv env
+source env/bin/activate
+python3 -m pip install -r requirements/prod.txt
+echo "export SECRET_KEY='$(openssl rand -hex 40)'" > .DJANGO_SECRET_KEY
+source .DJANGO_SECRET_KEY
+python3 manage.py migrate
+python3 manage.py check
+```
diff --git a/django-gunicorn-nginx/config/etc/nginx/sites-available/supersecure b/django-gunicorn-nginx/config/etc/nginx/sites-available/supersecure
@@ -0,0 +1,36 @@
+server_tokens             off;
+access_log                /var/log/nginx/supersecure.access.log;
+error_log                 /var/log/nginx/supersecure.error.log;
+
+server {
+  listen                  80 default_server;
+  return                  444;
+}
+
+server {
+  server_name             .supersecure.codes;
+  listen                  80;
+  return                  307 https://$host$request_uri;
+}
+
+server {
+
+  location / {
+    proxy_pass            http://localhost:8000;
+    proxy_set_header      Host $host;
+    proxy_set_header      X-Forwarded-Proto $scheme;
+    proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_redirect        off;
+  }
+
+  location /static {
+    autoindex             on;
+    alias                 /var/www/supersecure.codes/static/;
+  }
+
+  listen 443 ssl; # managed by Certbot
+  ssl_certificate /etc/letsencrypt/live/www.supersecure.codes/fullchain.pem; # managed by Certbot
+  ssl_certificate_key /etc/letsencrypt/live/www.supersecure.codes/privkey.pem; # managed by Certbot
+  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
diff --git a/django-gunicorn-nginx/config/gunicorn/dev.py b/django-gunicorn-nginx/config/gunicorn/dev.py
@@ -0,0 +1,20 @@
+"""Gunicorn *development* config file"""
+
+# Django WSGI application path in pattern MODULE_NAME:VARIABLE_NAME
+wsgi_app = "project.wsgi:application"
+# The granularity of Error log outputs
+loglevel = "debug"
+# The number of worker processes for handling requests
+workers = 2
+# The socket to bind
+bind = "0.0.0.0:8000"
+# Restart workers when code changes (development only!)
+reload = True
+# Write access and error info to /var/log
+accesslog = errorlog = "/var/log/gunicorn/dev.log"
+# Redirect stdout/stderr to log file
+capture_output = True
+# PID file so you can easily fetch process ID
+pidfile = "/var/run/gunicorn/dev.pid"
+# Daemonize the Gunicorn process (detach & enter background)
+daemon = True
diff --git a/django-gunicorn-nginx/config/gunicorn/prod.py b/django-gunicorn-nginx/config/gunicorn/prod.py
@@ -0,0 +1,19 @@
+"""Gunicorn *production* config file"""
+
+import multiprocessing
+
+# Django WSGI application path in pattern MODULE_NAME:VARIABLE_NAME
+wsgi_app = "project.wsgi:application"
+# The number of worker processes for handling requests
+workers = multiprocessing.cpu_count() * 2 + 1
+# The socket to bind
+bind = "0.0.0.0:8000"
+# Write access and error info to /var/log
+accesslog = "/var/log/gunicorn/access.log"
+errorlog = "/var/log/gunicorn/error.log"
+# Redirect stdout/stderr to log file
+capture_output = True
+# PID file so you can easily fetch process ID
+pidfile = "/var/run/gunicorn/prod.pid"
+# Daemonize the Gunicorn process (detach & enter background)
+daemon = True
diff --git a/django-gunicorn-nginx/manage.py b/django-gunicorn-nginx/manage.py
@@ -0,0 +1,22 @@
+#!/usr/bin/env python
+"""Django's command-line utility for administrative tasks."""
+import os
+import sys
+
+
+def main():
+    """Run administrative tasks."""
+    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "project.settings")
+    try:
+        from django.core.management import execute_from_command_line
+    except ImportError as exc:
+        raise ImportError(
+            "Couldn't import Django. Are you sure it's installed and "
+            "available on your PYTHONPATH environment variable? Did you "
+            "forget to activate a virtual environment?"
+        ) from exc
+    execute_from_command_line(sys.argv)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/django-gunicorn-nginx/myapp/__init__.py b/django-gunicorn-nginx/myapp/__init__.py
diff --git a/django-gunicorn-nginx/myapp/admin.py b/django-gunicorn-nginx/myapp/admin.py
diff --git a/django-gunicorn-nginx/myapp/apps.py b/django-gunicorn-nginx/myapp/apps.py
@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class MyappConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "myapp"
diff --git a/django-gunicorn-nginx/myapp/migrations/__init__.py b/django-gunicorn-nginx/myapp/migrations/__init__.py
diff --git a/django-gunicorn-nginx/myapp/models.py b/django-gunicorn-nginx/myapp/models.py
diff --git a/django-gunicorn-nginx/myapp/templates/myapp/home.html b/django-gunicorn-nginx/myapp/templates/myapp/home.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <title>My secure app</title>
+    <link rel="stylesheet"
+      href="https://cdn.jsdelivr.net/npm/normalize.css@8.0.1/normalize.css"
+    >
+  </head>
+  <body>
+    <p><span id="changeme">Now this is some sweet HTML!</span></p>
+    <script src="/static/js/greenlight.js"></script>
+  </body>
+</html>
diff --git a/django-gunicorn-nginx/myapp/tests.py b/django-gunicorn-nginx/myapp/tests.py
diff --git a/django-gunicorn-nginx/myapp/urls.py b/django-gunicorn-nginx/myapp/urls.py
@@ -0,0 +1,6 @@
+from django.urls import path
+from . import views
+
+urlpatterns = [
+    path("", views.index, name="index"),
+]
diff --git a/django-gunicorn-nginx/myapp/views.py b/django-gunicorn-nginx/myapp/views.py
diff --git a/django-gunicorn-nginx/project/__init__.py b/django-gunicorn-nginx/project/__init__.py
diff --git a/django-gunicorn-nginx/project/asgi.py b/django-gunicorn-nginx/project/asgi.py
@@ -0,0 +1,16 @@
+"""
+ASGI config for project project.
+
+It exposes the ASGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/3.2/howto/deployment/asgi/
+"""
+
+import os
+
+from django.core.asgi import get_asgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "project.settings")
+
+application = get_asgi_application()
diff --git a/django-gunicorn-nginx/project/settings.py b/django-gunicorn-nginx/project/settings.py
@@ -0,0 +1,145 @@
+"""
+Django settings for project project.
+
+Generated by 'django-admin startproject' using Django 3.2.7.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/3.2/topics/settings/
+
+For the full list of settings and their values, see
+https://docs.djangoproject.com/en/3.2/ref/settings/
+"""
+
+import os
+from pathlib import Path
+
+# Build paths inside the project like this: BASE_DIR / 'subdir'.
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+
+# Quick-start development settings - unsuitable for production
+# See https://docs.djangoproject.com/en/3.2/howto/deployment/checklist/
+
+# SECURITY WARNING: keep the secret key used in production secret!
+try:
+    SECRET_KEY = os.environ["SECRET_KEY"]
+except KeyError as e:
+    raise RuntimeError("Could not find a SECRET_KEY in environment") from e
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = False
+
+ALLOWED_HOSTS = [".supersecure.codes"]
+
+# Application definition
+
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+]
+
+INSTALLED_APPS += ["myapp"]
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+]
+
+MIDDLEWARE += ["csp.middleware.CSPMiddleware"]
+
+# https://django-csp.readthedocs.io/en/latest/configuration.html
+CSP_STYLE_SRC = ["'self'", "cdn.jsdelivr.net"]
+
+ROOT_URLCONF = "project.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.debug",
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "project.wsgi.application"
+
+
+# Database
+# https://docs.djangoproject.com/en/3.2/ref/settings/#databases
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": BASE_DIR / "db.sqlite3",
+    }
+}
+
+
+# Password validation
+# https://docs.djangoproject.com/en/3.2/ref/settings/#auth-password-validators
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
+    },
+]
+
+
+# Internationalization
+# https://docs.djangoproject.com/en/3.2/topics/i18n/
+
+LANGUAGE_CODE = "en-us"
+
+TIME_ZONE = "UTC"
+
+USE_I18N = True
+
+USE_L10N = True
+
+USE_TZ = True
+
+
+# Static files (CSS, JavaScript, Images)
+# https://docs.djangoproject.com/en/3.2/howto/static-files/
+
+STATIC_URL = "/static/"
+STATIC_ROOT = "/var/www/supersecure.codes/static"
+STATICFILES_DIRS = [BASE_DIR / "static"]
+
+# Default primary key field type
+# https://docs.djangoproject.com/en/3.2/ref/settings/#default-auto-field
+
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+
+# Additional header-related settings
+SECURE_REFERRER_POLICY = "no-referrer-when-downgrade"
+
+SECURE_HSTS_SECONDS = 31536000  # == 1 year; *USE A SMALL VALUE FOR TESTING!*
+SECURE_HSTS_PRELOAD = True
+SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
diff --git a/django-gunicorn-nginx/project/urls.py b/django-gunicorn-nginx/project/urls.py
@@ -0,0 +1,6 @@
+from django.urls import include, path
+
+urlpatterns = [
+    path("myapp/", include("myapp.urls")),
+    path("", include("myapp.urls")),
+]
diff --git a/django-gunicorn-nginx/project/wsgi.py b/django-gunicorn-nginx/project/wsgi.py
@@ -0,0 +1,16 @@
+"""
+WSGI config for project project.
+
+It exposes the WSGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/3.2/howto/deployment/wsgi/
+"""
+
+import os
+
+from django.core.wsgi import get_wsgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "project.settings")
+
+application = get_wsgi_application()
diff --git a/django-gunicorn-nginx/requirements/dev.txt b/django-gunicorn-nginx/requirements/dev.txt
@@ -0,0 +1 @@
+httpie==2.*
diff --git a/django-gunicorn-nginx/requirements/prod.txt b/django-gunicorn-nginx/requirements/prod.txt
@@ -0,0 +1,3 @@
+django==3.2.*
+gunicorn==20.1.*
+django-csp
diff --git a/django-gunicorn-nginx/static/js/greenlight.js b/django-gunicorn-nginx/static/js/greenlight.js
@@ -0,0 +1,9 @@
+(function () {
+    "use strict";
+    function enlarge() {
+        document.getElementById("changeme").style.color = "green";
+        document.getElementById("changeme").style.fontSize = "xx-large";
+        return false;
+    }
+    document.getElementById("changeme").addEventListener("mouseover", enlarge);
+}());
