So, I have an application written with Django and it has a contact page, from where users can send mail using gmail's smtp. For this functionality in settings.py file I wrote EMAIL_HOST_PASSWORD = 'my-own-password', and I'm gonna deploy my site on github.io. So, I must hide or encrypt password. What can I do with that ?
Two things about your question:
You cannot deploy Django app on github pages because they serve only static files. Check e.g. Heroku, it's quite easy to deploy Django there.
The most common practice to hide passwords and secret keys is to use environmental variables. Generally, you have to set a variable in bash e.g. export EMAIL_HOST_PASSWORD=my-own-password and then you can use os python module to retrieve it:
import os
EMAIL_HOST_PASSWORD = os.environ.get("EMAIL_HOST_PASSWORD")
Useful video tutorials:
Python Django Tutorial: Deploying Your Application (Option #2) - Deploy using Heroku
Python Quick Tip: Hiding Passwords and Secret Keys in Environment Variables (Mac & Linux)
You can't deploy a django application on github pages as described here : https://help.github.com/en/articles/what-is-github-pages.
If you want to upload you code on github and you don't want to share your password you can put it in another file and add this file to your .gitignore
Related
This is a bit embarassing, but I'm a Django noob and I couldn't find a simple solution to this:
I have written a Django app in a local VM that I now want to deploy to a "production" server. App works like a charm locally.
Now my IT colleague has set up the server with Django and that also works fine. I can open it via the Web and I get the usual "Congratulations on your first Django-powered page". I can also log into the admin interface. The project has been created.
This is a very low-key mini project and I'm not too familiar with git, so we've decided to just push files via FTP. (And I want to stick with that if at all possible.) So I uploaded the app folder into the project folder and also adjusted the project's settings.py and urls.py.
However, nothing seems to be happening on the server's end. The welcome page is the same, the app does not show up in the admin interface and the URLs won't be resolved as hoped.
Any suggestions what I should have done / done differently?
You need to restart apache or whatever is running your django project. Your changes to py files are cached when you first load your server config (settings).
Any suggestions what I should have done / done differently?
You should be using git/jenkins/deployment techniques, I know you said you've decided not to use it but you're going to be missing out on important things like being able to keep track of changes and unit testing
I am starting to develop an app using Django as a framework. I will be using Python Social Auth https://github.com/omab/python-social-auth to login using Facebook.
The app will use Postgres as a database, therefore I am looking for guidance in the sequence to use to install the initial setup. The application will be deployed in Heroku and I found a references https://devcenter.heroku.com/articles/heroku-postgresql in how to install Postgres in my machine and in the hosting.
I need to find the right sequence of installation to be able to have a fully operational setup, before start to add my application.
Does anybody has experience in such configuration?
Your question is borderline close as off topic, asking for tutorial, but, the main answer to your question is the tutorial from heroku on heroku on django This covers getting a simple hello world app up and running and using postgres (including being able to run it locally via heroku local). The one thing I would add is that I prefer to modify my settings.py to look like this:
import dj_database_url
DATABASE = { } # standard postgres for local configuration
if dj_database_url.config(): #override local for heroku set value
DATABASES['default'] = dj_database_url.config()
At the conclusion of this tutorial, you'll have a working app that can use postgres. After that, installing Facebook social auth mainly consists of registering your app to get some secret values and putting those in settings.py as described in the documentation. (Truth in lending, haven't used Facebook auth but have done Google and Twitter Auth. The main thing with Heroku is that I would strongly recommend adding 127.0.0.1:5000 as well as https://.herokuapps.com so you can debug stuff from your local instance first (and also make sure you leave the default django auth so you can still log in via username/password while you're troubleshooting)
(One last tip: you should be able to do heroku run python manage.py shell and then from there do something like:
from django.contrib.auth.models import User
u = User.objects.get(username="Your Facebook username")
u.is_staff = True
u.is_superuser = True
u.save()
To promote your facebook account to be admin, as I forget if social auth sets it up so first user account is admin automatically or not)
I'm writing a web application in Python (on Apache server on a Linux system) that needs to connect to a Postgres database. It therefore needs a valid password for the database server. It seems rather unsatisfactory to hard code the password in my Python files.
I did wonder about using a .pgpass file, but it would need to belong to the www-data user, right? By default, there is no /home/www-data directory, which is where I would have expected to store the .pgpass file. Can I just create such a directory and store the .pgpass file there? And if not, then what is the "correct" way to enable my Python scripts to connect to the database?
No matter what approach you use, other apps running as www-data will be able to read your password and log in as you to the database. Using peer auth won't help you out, it'll still trust all apps running under www-data.
If you want your application to be able to isolate its data from other databases you'll need to run it as a separate user ID. The main approaches with this are:
Use the apache suexec module to run scripts as a separate user;
Use fast-cgi (fcgi) or scgi to run the cgi as a different user; or
Have the app run its own minimal HTTP server and have Apache reverse proxy for it
Of these, by far the best option is usually to use scgi/fcgi. It lets you easily run your app as a different unix user but avoids the complexity and overhead of reverse proxying.
Install the application and its config files in its own directory different from the static files directory and only readable by the application user.
Set another user to run the application and use the WSGIDaemonProcess directive.
All of that and much more is clearly described in the mod_wsgi site, in the Quick Configuration Guide, Configuration Guidelines and Configuration Directives
I have the myapp.py and app.yaml in my windows C:\myap directory. The docs say to use:
appcfg.py update myapp/
to upload the app.
I've downloaded/installed Python and the Google python kit.
Sorry, for these noobish questions, but:
Is the myapp/ listed above refer to c:\myapp on my windows machine? Or is it the name of my app on the google side?
How/where do I type the appcfg.py to upload my directory?
Are there any security issues associated with using my gmail account and email address?
I'd like anybody from Second Life to be able to call this from in-world. There will be about a dozen calls a week. Are they going to have to authenticate with my email/password to use it?
Thanks for any help you can provide!
Since you have app in C:\myap you need to run appcfg.py update C:\myap. It's just a path to you app on your machine.
In windows command line. For example, "C:\Program Files (x86)\Google\google_appengine\appcfg.py" update C:\myap
No, appcfg uses SSL while uploading. It's safe.
If you mean to call application uploading - it's not really safe. I don't know why you need this. You can add app developers in App Engine admin console, so they will be able to deploy application from their accounts.
I'm working on a python based server product where a user can install WSGI-based python apps on their server. I can enforce any restriction on the application structure or format to make this easy.
The user workflow would be:
browse an app market, showing a list of WSGIpython apps
select an app and choose "install"
the app would be downloaded from a remote server to the user's server
the http server would then have to be configured to start serving that application from the app's id, ex. a blog app with an id of "blog" at "/blog/", so all requests below /blog/ would be seen as root by the blog application.
Any suggestions on how to set something like this up?
Holler if my flow of consciousness lost you ;)
Python Paste URLMap does this via a config file, that might give you a good start.