From ce3a9e57d67b93b6c101b222b37c77189bd7f9c3 Mon Sep 17 00:00:00 2001 From: Daniel Prange Date: Thu, 30 Apr 2026 14:16:07 +0300 Subject: [PATCH 1/5] feat: update Dockerfile, use common uwsgi config - Make Dockerfile more in line with other projects' Dockerfiles - Use City of Helsinki common uwsgi configurations - Require hashes in pip install - Do not install dependencies of dependencies Refs: RATYK-199 --- .docker/Dockerfile | 58 ++++++++++++++++++++++++++++++++-------------- .docker/uwsgi.ini | 4 ++++ 2 files changed, 44 insertions(+), 18 deletions(-) diff --git a/.docker/Dockerfile b/.docker/Dockerfile index e60fe00..d29e431 100644 --- a/.docker/Dockerfile +++ b/.docker/Dockerfile @@ -2,55 +2,77 @@ FROM registry.access.redhat.com/ubi9/python-312 AS appbase # ============================== +# Branch or tag used to pull python-uwsgi-common. +ARG UWSGI_COMMON_REF="main" + USER root WORKDIR /app ENV PYTHONDONTWRITEBYTECODE 1 ENV PYTHONUNBUFFERED 1 -COPY --chown=default:root requirements*.txt . +COPY requirements.txt . +COPY requirements-prod.txt . -RUN dnf update -y && dnf install -y \ +RUN dnf update -y \ + && dnf install -y \ nmap-ncat \ gettext \ && pip install -U pip setuptools wheel \ - && pip install --no-cache-dir -r requirements.txt \ - && pip install --no-cache-dir -r requirements-prod.txt \ - && mkdir -p /usr/local/lib/uwsgi/plugins \ - && uwsgi --build-plugin https://github.com/City-of-Helsinki/uwsgi-sentry \ - && mv sentry_plugin.so /usr/local/lib/uwsgi/plugins/ \ + && pip install --require-hashes --no-deps --no-cache-dir -r requirements.txt \ + && pip install --require-hashes --no-deps --no-cache-dir -r requirements-prod.txt \ && dnf clean all +# Build and copy specific python-uwsgi-common files. +ADD https://github.com/City-of-Helsinki/python-uwsgi-common/archive/"${UWSGI_COMMON_REF}".tar.gz /usr/src/ +RUN mkdir -p /usr/src/python-uwsgi-common \ + && tar --strip-components=1 -xzf /usr/src/"${UWSGI_COMMON_REF}".tar.gz -C /usr/src/python-uwsgi-common \ + && mkdir /etc/uwsgi \ + && cp /usr/src/python-uwsgi-common/uwsgi-base.ini /etc/uwsgi/ \ + && uwsgi --build-plugin /usr/src/python-uwsgi-common \ + && rm -rf /usr/src/"${UWSGI_COMMON_REF}".tar.gz \ + && rm -rf /usr/src/python-uwsgi-common \ + && uwsgi --build-plugin https://github.com/City-of-Helsinki/uwsgi-sentry \ + && mkdir -p /usr/local/lib/uwsgi/plugins \ + && mv sentry_plugin.so /usr/local/lib/uwsgi/plugins + ENTRYPOINT ["/app/.docker/docker-entrypoint.sh"] -EXPOSE 8000/tcp # ============================== FROM appbase AS development # ============================== - -COPY --chown=default:root requirements-dev.txt . -RUN pip install --no-cache-dir -r requirements-dev.txt +COPY requirements-dev.txt . +RUN pip install --require-hashes --no-deps --no-cache-dir -r requirements-dev.txt ENV DEV_SERVER=True +ENV PIP_TOOLS_CACHE_DIR="/tmp/pip-tools-cache" -COPY --chown=default:root . . +RUN groupadd -g 1000 appuser \ + && useradd -u 1000 -g appuser -ms /bin/bash appuser \ + && chown -R appuser:root /app -USER root +COPY --chown=appuser:root . . + +USER appuser +EXPOSE 8000/tcp # ============================== FROM appbase AS staticbuilder # ============================== -ENV STATIC_ROOT=/app/static -COPY --chown=default:root . . -RUN SECRET_KEY="only-used-for-collectstatic" ENABLE_ADMIN_APP="True" \ +ENV STATIC_ROOT="/app/static" +COPY . . + +RUN mkdir -p tirehtoori/static \ + && SECRET_KEY="only-used-for-collectstatic" ENABLE_ADMIN_APP="True" \ python manage.py collectstatic --noinput # ============================== FROM appbase AS production # ============================== -COPY --from=staticbuilder --chown=default:root /app/static /app/static -COPY --chown=default:root . . +COPY --from=staticbuilder /app/static /app/static +COPY . . USER default +EXPOSE 8000/tcp diff --git a/.docker/uwsgi.ini b/.docker/uwsgi.ini index 1757096..f0e5958 100644 --- a/.docker/uwsgi.ini +++ b/.docker/uwsgi.ini @@ -1,5 +1,9 @@ [uwsgi] # https://uwsgi-docs.readthedocs.io/en/latest/Options.html +strict = true # Fail if any option is unknown + +# Use base ini file to configure common settings +include = /etc/uwsgi/uwsgi-base.ini http = :8000 http-timeout = 60 From 5c3c429b5185daebbe041405822fcaa95a1c6113 Mon Sep 17 00:00:00 2001 From: Daniel Prange Date: Thu, 30 Apr 2026 14:16:46 +0300 Subject: [PATCH 2/5] ci: pass only sonar token to common workflow Refs: RATYK-199 --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9bef5a1..deec7e2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,7 +10,8 @@ on: jobs: common: uses: City-of-Helsinki/.github/.github/workflows/ci-django-api.yml@main - secrets: inherit + secrets: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} with: python-version: 3.12 postgres-major-version: 17 From 49766435d2b48497da5c4a38ee24f20bcd9b0bfa Mon Sep 17 00:00:00 2001 From: Daniel Prange Date: Thu, 30 Apr 2026 14:17:54 +0300 Subject: [PATCH 3/5] chore: add uwsgi service in compose.yaml For running a production-like environment locally. Refs: RATYK-199 --- compose.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/compose.yaml b/compose.yaml index faf9d5a..534073a 100644 --- a/compose.yaml +++ b/compose.yaml @@ -26,6 +26,20 @@ services: - postgres container_name: tirehtoori-backend + uwsgi: + build: + context: . + dockerfile: .docker/Dockerfile + target: production + env_file: + - .docker/.env + ports: + - "8080:8000" + depends_on: + - postgres + container_name: tirehtoori-uwsgi + profiles: ["uwsgi"] + volumes: tirehtoori-postgres-data-volume: From e9d72153ad40a7a509bc6ab5933023ab4cd6bfca Mon Sep 17 00:00:00 2001 From: Daniel Prange Date: Thu, 30 Apr 2026 14:33:17 +0300 Subject: [PATCH 4/5] test: move test_settings under tests To make it even more explicit that yes, these are test settings. Refs: RATYK-199 --- pyproject.toml | 2 +- tirehtoori/{ => tests}/test_settings.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename tirehtoori/{ => tests}/test_settings.py (65%) diff --git a/pyproject.toml b/pyproject.toml index 870824c..908abf4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,5 +1,5 @@ [tool.pytest.ini_options] -DJANGO_SETTINGS_MODULE = "tirehtoori.test_settings" +DJANGO_SETTINGS_MODULE = "tirehtoori.tests.test_settings" [tool.ruff] target-version = "py312" diff --git a/tirehtoori/test_settings.py b/tirehtoori/tests/test_settings.py similarity index 65% rename from tirehtoori/test_settings.py rename to tirehtoori/tests/test_settings.py index 1121b08..cb1be87 100644 --- a/tirehtoori/test_settings.py +++ b/tirehtoori/tests/test_settings.py @@ -1,4 +1,4 @@ -from .settings import * # noqa: F403 +from ..settings import * # noqa: F403 ALLOWED_HOSTS = ["*"] ENABLE_REDIRECT_APP = True From 16bfc341862388add256f6e735165671b3c992de Mon Sep 17 00:00:00 2001 From: Daniel Prange Date: Thu, 30 Apr 2026 15:25:24 +0300 Subject: [PATCH 5/5] build: use binary only for pip/setuptools/wheel upgrade Refs: RATYK-199 --- .docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.docker/Dockerfile b/.docker/Dockerfile index d29e431..5c29013 100644 --- a/.docker/Dockerfile +++ b/.docker/Dockerfile @@ -18,7 +18,7 @@ RUN dnf update -y \ && dnf install -y \ nmap-ncat \ gettext \ - && pip install -U pip setuptools wheel \ + && pip install --only-binary :all: -U pip setuptools wheel \ && pip install --require-hashes --no-deps --no-cache-dir -r requirements.txt \ && pip install --require-hashes --no-deps --no-cache-dir -r requirements-prod.txt \ && dnf clean all