DevSecOps overhaul

.env.example

@@ -1,47 +1,46 @@
 # 🌐 Frontend
+FRONTEND_PORT=8015 # Don't forget to update CSRF_TRUSTED_ORIGINS in backend and FRONTEND_URL in backend and ORIGIN in frontend if you make changes to this.
 PUBLIC_SERVER_URL=http://server:8000 # PLEASE DON'T CHANGE :) - Should be the service name of the backend with port 8000, even if you change the port in the backend service. Only change if you are using a custom more complex setup.
 ORIGIN=http://localhost:8015
 BODY_SIZE_LIMIT=Infinity
-FRONTEND_PORT=8015
 
 # 🐘 PostgreSQL Database
-PGHOST=db
-POSTGRES_DB=database
-POSTGRES_USER=adventure
+PGHOST=db # Supposed to match the host of the postgis database
+POSTGRES_DB=adventureloga
+POSTGRES_USER=adventurelog
 POSTGRES_PASSWORD=changeme123
 
 # 🔒 Django Backend
-SECRET_KEY=changeme123
-DJANGO_ADMIN_USERNAME=admin
-DJANGO_ADMIN_PASSWORD=admin
-DJANGO_ADMIN_EMAIL=admin@example.com
-PUBLIC_URL=http://localhost:8016 # Match the outward port, used for the creation of image urls
-CSRF_TRUSTED_ORIGINS=http://localhost:8016,http://localhost:8015
-DEBUG=False
-FRONTEND_URL=http://localhost:8015 # Used for email generation. This should be the url of the frontend
-BACKEND_PORT=8016
+SECRET_KEY=changeme123 # Replace with the actual secret key
+DJANGO_ADMIN_USERNAME=admin # Replace with the actual admin username
+DJANGO_ADMIN_PASSWORD=admin  # Replace with the actual admin password
+DJANGO_ADMIN_EMAIL=admin@example.com  # Replace with the actual admin email
+BACKEND_PORT=8016 # Don't forget to update CSRF_TRUSTED_ORIGINS and PUBLIC_URL in backend, and PUBLIC_SERVER_URL in frontend if you make changes to this.
+PUBLIC_URL=http://localhost:8016 # Replace with your domain where the backend is accessible publicly, used for the creation of image urls
+CSRF_TRUSTED_ORIGINS=http://localhost:8016,http://localhost:8015 # Replace with your domain, if applicable
+FRONTEND_URL=http://localhost:8015 # Replace with your domain where the frontend is accessible, used for email generation.
+# Disabling Registration: https://adventurelog.app/docs/configuration/disable_registration.html
+# DISABLE_REGISTRATION=False
+# DISABLE_REGISTRATION_MESSAGE='Registration is disabled for this instance of AdventureLog.'
 
-# Optional: use Google Maps integration
-# https://adventurelog.app/docs/configuration/google_maps_integration.html
-# GOOGLE_MAPS_API_KEY=your_google_maps_api_key
-
-# Optional: disable registration
-# https://adventurelog.app/docs/configuration/disable_registration.html
-DISABLE_REGISTRATION=False
-# DISABLE_REGISTRATION_MESSAGE=Registration is disabled for this instance of AdventureLog.
 
-# Optional: Use email
-# https://adventurelog.app/docs/configuration/email.html
+# Integrations
+## Email: https://adventurelog.app/docs/configuration/email.html
 # EMAIL_BACKEND=email
-# EMAIL_HOST=smtp.gmail.com
-# EMAIL_USE_TLS=True
+# EMAIL_HOST=smtp.mail.com
+# EMAIL_USE_TLS=False
 # EMAIL_PORT=587
-# EMAIL_USE_SSL=False
+# EMAIL_USE_SSL=True
 # EMAIL_HOST_USER=user
 # EMAIL_HOST_PASSWORD=password
-# DEFAULT_FROM_EMAIL=user@example.com
+# DEFAULT_FROM_EMAIL=adventurelog@example.com
 
-# Optional: Use Umami for analytics
-# https://adventurelog.app/docs/configuration/analytics.html
+## Google Maps: https://adventurelog.app/docs/configuration/google_maps_integration.html
+# GOOGLE_MAPS_API_KEY=your_google_maps_api_key
+
+## Umami for analytics: https://adventurelog.app/docs/configuration/analytics.html
 # PUBLIC_UMAMI_SRC=https://cloud.umami.is/script.js # If you are using the hosted version of Umami
-# PUBLIC_UMAMI_WEBSITE_ID=
+# PUBLIC_UMAMI_WEBSITE_ID=
+
+# Extra configuration
+DEBUG=false # Use to enable debugging

.github/.docker-compose-database.yml

@@ -6,8 +6,8 @@ services:
     ports:
       - "127.0.0.1:5432:5432"
     environment:
-      POSTGRES_DB: database
-      POSTGRES_USER: adventure
+      POSTGRES_DB: adventurelog
+      POSTGRES_USER: adventurelog
       POSTGRES_PASSWORD: changeme123
     volumes:
       - postgres_data:/var/lib/postgresql/data/

.github/workflows/backend-beta.yml

@@ -36,11 +36,42 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: set lower case owner name
-        run: |
-          echo "REPO_OWNER=${OWNER,,}" >>${GITHUB_ENV}
+      - name: Set build metadata
+        id: vars
         env:
-          OWNER: "${{ github.repository_owner }}"
+          OWNER: '${{ github.repository_owner }}'
+        run: |
+          echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+          echo "GIT_TAG=$(git describe --tags --abbrev=0 --exact-match 2>/dev/null || echo unknown)" >> $GITHUB_OUTPUT
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
+          echo "REPO_OWNER=${OWNER,,}" >> $GITHUB_OUTPUT
+
+      - name: Build and push Docker images
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            --build-arg GIT_SHA=${{ steps.vars.outputs.GIT_SHA }} \
+            --build-arg GIT_TAG=${{ steps.vars.outputs.GIT_TAG }} \
+            --build-arg BUILD_DATE=${{ steps.vars.outputs.BUILD_DATE }} \
+            -t ghcr.io/$REPO_OWNER/$IMAGE_NAME:beta \
+            -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:beta \
+            ./backend
+
+      # Notify on success
+      # - name: Notify Discord on success
+      #   if: success()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"✅ Build and push succeeded for backend beta\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}
 
-      - name: Build Docker images
-        run: docker buildx build --platform linux/amd64,linux/arm64 --push -t ghcr.io/$REPO_OWNER/$IMAGE_NAME:beta -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:beta ./backend
+      # # Notify on failure
+      # - name: Notify Discord on failure
+      #   if: failure()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"❌ Build or push failed for backend beta\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}

.github/workflows/backend-latest.yml

@@ -35,12 +35,43 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-
-      - name: set lower case owner name
-        run: |
-          echo "REPO_OWNER=${OWNER,,}" >>${GITHUB_ENV}
+
+      - name: Set build metadata
+        id: vars
         env:
           OWNER: '${{ github.repository_owner }}'
+        run: |
+          echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+          echo "GIT_TAG=$(git describe --tags --abbrev=0 --exact-match 2>/dev/null || echo unknown)" >> $GITHUB_OUTPUT
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
+          echo "REPO_OWNER=${OWNER,,}" >> $GITHUB_OUTPUT
+
+      - name: Build and push Docker images
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            --build-arg GIT_SHA=${{ steps.vars.outputs.GIT_SHA }} \
+            --build-arg GIT_TAG=${{ steps.vars.outputs.GIT_TAG }} \
+            --build-arg BUILD_DATE=${{ steps.vars.outputs.BUILD_DATE }} \
+            -t ghcr.io/${{ steps.vars.outputs.REPO_OWNER }}/$IMAGE_NAME:latest \
+            -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:latest \
+            ./backend
+
+      # Notify on success
+      # - name: Notify Discord on success
+      #   if: success()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"✅ Build and push succeeded for backend latest\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}
 
-      - name: Build Docker images
-        run: docker buildx build --platform linux/amd64,linux/arm64 --push -t ghcr.io/$REPO_OWNER/$IMAGE_NAME:latest -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:latest ./backend 
+      # # Notify on failure
+      # - name: Notify Discord on failure
+      #   if: failure()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"❌ Build or push failed for backend latest\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}

.github/workflows/backend-release.yml

@@ -33,11 +33,43 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: set lower case owner name
-        run: |
-          echo "REPO_OWNER=${OWNER,,}" >>${GITHUB_ENV}
+      - name: Set build metadata
+        id: vars
         env:
-          OWNER: "${{ github.repository_owner }}"
+          OWNER: '${{ github.repository_owner }}'
+        run: |
+          echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+          echo "GIT_TAG=$(git describe --tags --abbrev=0 --exact-match 2>/dev/null || echo unknown)" >> $GITHUB_OUTPUT
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
+          echo "REPO_OWNER=${OWNER,,}" >> $GITHUB_OUTPUT
+
+      - name: Build and push Docker images
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            --build-arg GIT_SHA=${{ steps.vars.outputs.GIT_SHA }} \
+            --build-arg GIT_TAG=${{ steps.vars.outputs.GIT_TAG }} \
+            --build-arg BUILD_DATE=${{ steps.vars.outputs.BUILD_DATE }} \
+            -t ghcr.io/${{ steps.vars.outputs.REPO_OWNER }}/$IMAGE_NAME:${{ github.event.release.tag_name }} \
+            -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:${{ github.event.release.tag_name }} \
+            ./backend
+
+
+      # # Notify on success
+      # - name: Notify Discord on success
+      #   if: success()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"✅ Build and push succeeded for backend release ${{ github.event.release.tag_name }}\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}
 
-      - name: Build Docker images
-        run: docker buildx build --platform linux/amd64,linux/arm64 --push -t ghcr.io/$REPO_OWNER/$IMAGE_NAME:${{ github.event.release.tag_name }} -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:${{ github.event.release.tag_name }} ./backend
+      # # Notify on failure
+      # - name: Notify Discord on failure
+      #   if: failure()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"❌ Build or push failed for backend release ${{ github.event.release.tag_name }}\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}

.github/workflows/backend-test.yml

@@ -37,10 +37,10 @@ jobs:
         working-directory: backend/server
         env:
           PGHOST: "127.0.0.1"
-          PGDATABASE: "database"
-          PGUSER: "adventure"
-          PGPASSWORD: "changeme123"
-          SECRET_KEY: "changeme123"
+          POSTGRES_DB: "adventurelog"
+          POSTGRES_USER: "adventurelog"
+          POSTGRES_PASSWORD: "changeme123"
+          SECRET_KEY: "secretkey"
           DJANGO_ADMIN_USERNAME: "admin"
           DJANGO_ADMIN_PASSWORD: "admin"
           DJANGO_ADMIN_EMAIL: "admin@example.com"

.github/workflows/cdn-beta.yml

@@ -36,11 +36,40 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: set lower case owner name
-        run: |
-          echo "REPO_OWNER=${OWNER,,}" >>${GITHUB_ENV}
+      - name: Set build metadata
+        id: vars
         env:
-          OWNER: "${{ github.repository_owner }}"
+          OWNER: '${{ github.repository_owner }}'
+        run: |
+          echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
+          echo "REPO_OWNER=${OWNER,,}" >> $GITHUB_OUTPUT
 
       - name: Build Docker images
-        run: docker buildx build --platform linux/amd64,linux/arm64 --push -t ghcr.io/$REPO_OWNER/$IMAGE_NAME:beta -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:beta ./cdn
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            --build-arg GIT_SHA=${{ steps.vars.outputs.GIT_SHA }} \
+            --build-arg BUILD_DATE=${{ steps.vars.outputs.BUILD_DATE }} \
+            -t ghcr.io/${{ steps.vars.outputs.REPO_OWNER }}/$IMAGE_NAME:beta \
+            -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:beta \
+            ./cdn
+
+      # Notify on success
+      # - name: Notify Discord on success
+      #   if: success()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"✅ Build and push succeeded for CDN beta\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}
+
+      # # Notify on failure
+      # - name: Notify Discord on failure
+      #   if: failure()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"❌ Build or push failed for CDN beta\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}

.github/workflows/cdn-latest.yml

@@ -36,11 +36,40 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: set lower case owner name
-        run: |
-          echo "REPO_OWNER=${OWNER,,}" >>${GITHUB_ENV}
+      - name: Set build metadata
+        id: vars
         env:
-          OWNER: "${{ github.repository_owner }}"
+          OWNER: '${{ github.repository_owner }}'
+        run: |
+          echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
+          echo "REPO_OWNER=${OWNER,,}" >> $GITHUB_OUTPUT
 
       - name: Build Docker images
-        run: docker buildx build --platform linux/amd64,linux/arm64 --push -t ghcr.io/$REPO_OWNER/$IMAGE_NAME:latest -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:latest ./cdn
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            --build-arg GIT_SHA=${{ steps.vars.outputs.GIT_SHA }} \
+            --build-arg BUILD_DATE=${{ steps.vars.outputs.BUILD_DATE }} \
+            -t ghcr.io/${{ steps.vars.outputs.REPO_OWNER }}/$IMAGE_NAME:latest \
+            -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:latest \
+            ./cdn
+
+      # Notify on success
+      # - name: Notify Discord on success
+      #   if: success()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"✅ Build and push succeeded for CDN latest\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}
+
+      # # Notify on failure
+      # - name: Notify Discord on failure
+      #   if: failure()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"❌ Build or push failed for CDN latest\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}

.github/workflows/cdn-release.yml

@@ -33,11 +33,41 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: set lower case owner name
-        run: |
-          echo "REPO_OWNER=${OWNER,,}" >>${GITHUB_ENV}
+      - name: Set build metadata
+        id: vars
         env:
-          OWNER: "${{ github.repository_owner }}"
+          OWNER: '${{ github.repository_owner }}'
+        run: |
+          echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
+          echo "REPO_OWNER=${OWNER,,}" >> $GITHUB_OUTPUT
 
       - name: Build Docker images
-        run: docker buildx build --platform linux/amd64,linux/arm64 --push -t ghcr.io/$REPO_OWNER/$IMAGE_NAME:${{ github.event.release.tag_name }} -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:${{ github.event.release.tag_name }} ./cdn
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            --build-arg GIT_SHA=${{ steps.vars.outputs.GIT_SHA }} \
+            --build-arg BUILD_DATE=${{ steps.vars.outputs.BUILD_DATE }} \
+            -t ghcr.io/${{ steps.vars.outputs.REPO_OWNER }}/$IMAGE_NAME:${{ github.event.release.tag_name }} \
+            -t ${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:${{ github.event.release.tag_name }} \
+            ./cdn
+
+      # Notify on success
+      # - name: Notify Discord on success
+      #   if: success()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"✅ Build and push succeeded for CDN release ${{ github.event.release.tag_name }}\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}
+
+      # # Notify on failure
+      # - name: Notify Discord on failure
+      #   if: failure()
+      #   run: |
+      #     curl -H "Content-Type: application/json" \
+      #       -X POST \
+      #       -d "{\"username\": \"CI Bot\", \"content\": \"❌ Build or push failed for CDN release ${{ github.event.release.tag_name }}\"}" \
+      #       ${{ secrets.DISCORD_WEBHOOK_BUILD }}
+