hackclub · Heliodex · Sep 8, 2026 · Aug 3, 2026 · Aug 4, 2026 · Aug 4, 2026
diff --git a/.gitignore b/.gitignore
@@ -13,4 +13,3 @@ twisted/*.sqlite3
 
 .env
 twisted/.env
-static/
diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -10,5 +10,7 @@
         ".venv": true,
         "**/__pycache__": true
     },
-    "djangoCotton.templatePaths": ["templates/cotton", "twisted/*/templates/cotton"]
+    "djangoCotton.templatePaths": [
+        "twisted/templates/cotton", "twisted/*/templates/cotton", ".venv/lib/*/site-packages/django_cotton_ui/templates/cotton"
+    ]
 }
diff --git a/TODO.md b/TODO.md
diff --git a/pyproject.toml b/pyproject.toml
@@ -15,8 +15,16 @@ dependencies = [
     "psycopg[binary]>=3.3.4",
     "python-dotenv>=1.2.2",
     "requests>=2.34.2",
-    "slack-sdk>=3.43.0",
+    "slack-bolt>=1.30.0",
     "tzdata>=2026.3",
     "urllib3>=2.7.0",
     "whitenoise>=6.12.0",
+    "boto3>=1.43.66",
+    "django-cotton-ui>=0.3.2",
+    "django-google-charts>=0.1.1",
+    "django-qsstats-magic>=1.1.0",
+    "django-htmx>=1.29.0",
+    "django-extensions>=4.1",
+    "django-mathfilters>=1.0.0",
+    "django-humanize>=0.1.2",
 ]
diff --git a/slack_bot/slack.py b/slack_bot/slack.py
diff --git a/twisted/.env.example b/twisted/.env.example
@@ -1,3 +1,8 @@
+SECRET_KEY=<insert-super-secure-secret-here>
+LOGIN_ENABLED=true # possible options: 'true,false,maybe'
+
+DEBUG=true
+
 POSTGRES_DB = django
 POSTGRES_USER = django
 POSTGRES_PASSWORD = django
@@ -13,10 +18,21 @@ HACKATIME_CLIENT_SECRET =
 HACKATIME_REDIRECT_URI = https://localhost:8000/auth/hackatime_callback
 
 SLACK_TOKEN = xoxb-***
+SLACK_SIGNING_SECRET =
+SLACK_APP_TOKEN = xapp-***
+SLACK_MODE = https
 
 ALLOWED_HOSTS = 127.0.0.1, localhost
 CSRF_TRUSTED_ORIGINS = http://127.0.0.1:8000, http://localhost:8000
 
-HACKCLUB_CDN_API_KEY = sk_cdn_***
+R2_ENDPOINT = https://<your-account-id>.r2.cloudflarestorage.com
+R2_ACCESS_KEY = <your-access-key>
+R2_SECRET_KEY = <your-secret-key>
+R2_BUCKET = <your-bucket>
+R2_PUBLIC_URL = <your-public-url>
+R2_TOKEN = 
 
-LOGIN_ENABLED=true
+DEBUG_REVIEW=true
+ARI_INGEST_ENDPOINT=
+ARI_SIGNING_SECRET=
+ARI_WEBHOOK_SECRET=
diff --git a/twisted/Dockerfile b/twisted/Dockerfile
@@ -1,5 +1,5 @@
 ### Build ###
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim AS development
+FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim AS build
 
 ENV DEBIAN_FRONTEND=noninteractive
 

diff --git a/twisted/common/templates/base.html b/twisted/common/templates/base.html
@@ -1,12 +1,19 @@
-{% load static tailwind_tags static %}
+{% load tailwind_tags static %}
 <html>
 <head>
    {% tailwind_css %}
    {% block head %}{% endblock head %}
+    <link rel="icon" href="{% static 'favicon.png' %}" />
+    <title>Twisted</title>
 </head>
-<body class="font-vintage">
+<body class="font-vintage os">
     {% block body %}
     meow :3
     {% endblock body %}
 </body>
+<script>
+    // Timezone settings
+    const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone; // e.g. "America/New_York"
+    document.cookie = "django_timezone=" + timezone;
+</script>
 </html>
diff --git a/twisted/docker-compose.yml b/twisted/docker-compose.yml
@@ -11,6 +11,10 @@ services:
   db:
     image: postgres:16
     restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
       interval: 5s

diff --git a/twisted/entrypoint.sh b/twisted/entrypoint.sh
@@ -1,4 +1,9 @@
 #!/bin/bash
 
 uv run manage.py migrate --noinput
-uv run gunicorn -w 3 mysite.wsgi:application --bind 0.0.0.0:8000
+uv run gunicorn -w 3 mysite.wsgi:application \
+    --bind 0.0.0.0:8000 \
+    --threads=4 \
+    --worker-class=gthread \
+    --log-level info \
+    --capture-output
diff --git a/twisted/mysite/middleware.py b/twisted/mysite/middleware.py
@@ -0,0 +1,19 @@
+import zoneinfo
+from django.utils import timezone
+
+class TimezoneMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        try:
+            # get django_timezone from cookie
+            tzname = request.COOKIES.get("django_timezone")
+            if tzname:
+                timezone.activate(zoneinfo.ZoneInfo(tzname))
+            else:
+                timezone.deactivate()
+        except Exception as e:
+            timezone.deactivate()
+
+        return self.get_response(request)
diff --git a/twisted/mysite/settings.py b/twisted/mysite/settings.py
@@ -24,14 +24,24 @@
 # See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-&3p#whs%8@!e1=fl$!wk^y6^e@z+714@714xd$=0ghmfyk43bn'
+SECRET_KEY = os.environ['SECRET_KEY']
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
+DEBUG = os.environ.get('DEBUG', 'false').lower() in ['true', 'on', '1']
+DEBUG_REVIEW = os.environ.get('DEBUG_REVIEW', str(DEBUG)).lower() in ['true', 'on', '1']
 
 USE_X_FORWARDED_HOST = True
 SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
 
+# Behind the TLS-terminating proxy above, cookies should never travel over plain
+# HTTP once we're not in local dev.
+SESSION_COOKIE_SECURE = not DEBUG
+CSRF_COOKIE_SECURE = not DEBUG
+SECURE_SSL_REDIRECT = not DEBUG
+SECURE_HSTS_SECONDS = 0 if DEBUG else 60 * 60 * 24 * 365
+SECURE_HSTS_INCLUDE_SUBDOMAINS = not DEBUG
+SECURE_HSTS_PRELOAD = not DEBUG
+
 X_FRAME_OPTIONS = 'SAMEORIGIN'
 
 allowed_hosts_raw = os.getenv("ALLOWED_HOSTS", "127.0.0.1,localhost")
@@ -45,22 +55,27 @@
 TAILWIND_APP_NAME = 'tailwindcsstheme'
 
 INSTALLED_APPS = [
-    'jazzmin',
-    'django.contrib.admin',
+    # 'django.contrib.admin',
     'django.contrib.auth',
     'django.contrib.contenttypes',
     'django.contrib.sessions',
     'django.contrib.messages',
     'django.contrib.staticfiles',
+    'django.contrib.humanize',
 
     # Your apps
     'common',
     'twisted_site',
 
     # 3rd party apps
     'django_cotton',
+    'django_cotton_ui',
     'tailwind',
     TAILWIND_APP_NAME,
+    'django_htmx',
+    'django_extensions',
+    'mathfilters',
+    'django_humanize'
 ]
 
 if DEBUG:
@@ -76,6 +91,8 @@
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
+    'mysite.middleware.TimezoneMiddleware',
+    "django_htmx.middleware.HtmxMiddleware",
 ]
 
 if DEBUG:
@@ -146,6 +163,7 @@
 TIME_ZONE = 'UTC'
 
 USE_I18N = True
+USE_L10N = True
 
 USE_TZ = True
 
@@ -156,4 +174,31 @@
 STATIC_URL = 'static/'
 STATIC_ROOT = BASE_DIR / 'static'
 CSRF_COOKIE_HTTPONLY = False
-NPM_BIN_PATH = os.environ.get("NPM_BIN_PATH", "npm")
+NPM_BIN_PATH = os.environ.get("NPM_BIN_PATH", "npm")
+
+# Django Messages Framework
+MESSAGE_STORAGE = "django.contrib.messages.storage.cookie.CookieStorage"
+
+
+# Logging
+LOGGING = {
+    'version': 1,
+    'disable_existing_loggers': False,  # Keeps Gunicorn's loggers active
+    'handlers': {
+        'console': {
+            'class': 'logging.StreamHandler',
+        },
+    },
+    'root': {
+        'handlers': ['console'],
+        'level': 'INFO',
+    },
+}
+
+# Ari (Review)
+# https://ari.hackclub.com/docs/webhooks
+ARI_INGEST_ENDPOINT = os.environ.get('ARI_INGEST_ENDPOINT')
+ARI_SIGNING_SECRET = os.environ.get('ARI_SIGNING_SECRET')
+# Separate from ARI_SIGNING_SECRET: signs deliveries Ari sends to us (Settings -> Webhooks),
+# not requests we send to Ari.
+ARI_WEBHOOK_SECRET = os.environ.get('ARI_WEBHOOK_SECRET')
diff --git a/twisted/mysite/urls.py b/twisted/mysite/urls.py
@@ -15,18 +15,15 @@
     2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
 """
 
-from django.contrib import admin
 from django.urls import include, path
 from django.conf import settings
 from django.conf.urls.static import static
 
 urlpatterns = [
-    path("admin/", admin.site.urls),
     path("", include("twisted_site.urls")),
 ] + static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)
 
 if settings.DEBUG:
-    # Include django_browser_reload URLs only in DEBUG mode
     urlpatterns += [
         path("__reload__/", include("django_browser_reload.urls")),
     ]
diff --git a/twisted/tailwindcsstheme/static_src/package-lock.json b/twisted/tailwindcsstheme/static_src/package-lock.json
diff --git a/twisted/tailwindcsstheme/static_src/package.json b/twisted/tailwindcsstheme/static_src/package.json
@@ -6,14 +6,15 @@
     "start": "npm run dev",
     "build": "npm run build:clean && npm run build:tailwind",
     "build:clean": "rimraf ../static/css/dist",
-    "build:tailwind": "cross-env NODE_ENV=production postcss ./src/styles.css -o ../static/css/dist/styles.css --minify && postcss ./src/win98.css -o ../static/css/dist/win98.css --minify",
-    "dev": "concurrently \"cross-env NODE_ENV=development postcss ./src/styles.css -o ../static/css/dist/styles.css --watch\" \"cross-env NODE_ENV=development postcss ./src/win98.css -o ../static/css/dist/win98.css --watch\""
+    "build:tailwind": "cross-env NODE_ENV=production postcss ./src/styles.css -o ../static/css/dist/styles.css --minify",
+    "dev": "cross-env NODE_ENV=development postcss ./src/styles.css -o ../static/css/dist/styles.css --watch"
   },
   "keywords": [],
   "author": "",
   "license": "MIT",
   "devDependencies": {
     "@tailwindcss/postcss": "^4.3.0",
+    "@tailwindcss/typography": "^0.5.20",
     "98.css": "^0.1.21",
     "concurrently": "^10.0.4",
     "cross-env": "^10.1.0",
@@ -24,4 +25,4 @@
     "rimraf": "^6.1.3",
     "tailwindcss": "^4.3.0"
   }
-}
+}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -13,4 +13,3 @@ twisted/*.sqlite3

		.env
		twisted/.env
		static/