feat: Armarium v1.1.0 — dashboard, auth, 2FA, SMTP, settings, deploy
Dashboard: - ApexCharts bar chart (income vs fixed costs vs expenses) and donut chart - KPI cards: income, fixed costs, savings rate with configurable goal - Greeting with time-of-day and locale-aware date/time display Authentication & security: - Email-based login (no username), case-insensitive lookup - JWT access/refresh tokens with rotation and blacklist - TOTP 2FA with QR code, backup codes (copy + PDF export) - 2FA recovery via email code - Cloudflare Turnstile CAPTCHA on login and register Email flows: - Email verification on registration (24h token) - Password reset flow (15min token, anti-enumeration) - Brevo SMTP integration with HTML + plaintext email templates - Notification emails: 2FA recovery, password changed, email changed Settings page: - 2FA management (enable/disable, QR, backup codes) - Active sessions list with per-device revoke - Data export: ZIP with 6 PDFs via fpdf2 - Notification preferences (3 toggles) - Danger zone: account deletion with mandatory export + confirmation phrase UI & layout: - Sidebar with collapsible/flyout mode, Angular signal-based dropdowns - Dark mode (class-based), language switcher (DE/FR/IT/EN) - Mobile-responsive layout with touch-friendly targets - Roboto font via @fontsource (GDPR-compliant, no Google CDN) - Pure Tailwind CSS v3 Infrastructure: - Forgejo Actions CI/CD pipeline (auto-deploy on push to main) - Gunicorn + Nginx + PostgreSQL production setup - Rate limiting, HSTS, secure cookies, CSRF protection
This commit is contained in:
Daniel Krähenbühl
@@ -0,0 +1,16 @@
|
||||
"""
|
||||
ASGI config for core project.
|
||||
|
||||
It exposes the ASGI callable as a module-level variable named ``application``.
|
||||
|
||||
For more information on this file, see
|
||||
https://docs.djangoproject.com/en/6.0/howto/deployment/asgi/
|
||||
"""
|
||||
|
||||
import os
|
||||
|
||||
from django.core.asgi import get_asgi_application
|
||||
|
||||
os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'core.settings')
|
||||
|
||||
application = get_asgi_application()
|
||||
@@ -0,0 +1,169 @@
|
||||
from pathlib import Path
|
||||
from datetime import timedelta
|
||||
import os
|
||||
from dotenv import load_dotenv
|
||||
|
||||
BASE_DIR = Path(__file__).resolve().parent.parent
|
||||
load_dotenv(BASE_DIR / '.env')
|
||||
|
||||
SECRET_KEY = os.environ['SECRET_KEY']
|
||||
|
||||
DEBUG = os.environ.get('DEBUG', 'False') == 'True'
|
||||
|
||||
TURNSTILE_SECRET_KEY = os.environ.get('TURNSTILE_SECRET_KEY', '')
|
||||
|
||||
ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', 'localhost,127.0.0.1').split(',')
|
||||
|
||||
INSTALLED_APPS = [
|
||||
'django.contrib.admin',
|
||||
'django.contrib.auth',
|
||||
'django.contrib.contenttypes',
|
||||
'django.contrib.sessions',
|
||||
'django.contrib.messages',
|
||||
'django.contrib.staticfiles',
|
||||
'rest_framework',
|
||||
'rest_framework_simplejwt',
|
||||
'rest_framework_simplejwt.token_blacklist',
|
||||
'corsheaders',
|
||||
'finance',
|
||||
]
|
||||
|
||||
MIDDLEWARE = [
|
||||
'corsheaders.middleware.CorsMiddleware',
|
||||
'django.middleware.security.SecurityMiddleware',
|
||||
'django.contrib.sessions.middleware.SessionMiddleware',
|
||||
'django.middleware.common.CommonMiddleware',
|
||||
'django.middleware.csrf.CsrfViewMiddleware',
|
||||
'django.contrib.auth.middleware.AuthenticationMiddleware',
|
||||
'django.contrib.messages.middleware.MessageMiddleware',
|
||||
'django.middleware.clickjacking.XFrameOptionsMiddleware',
|
||||
]
|
||||
|
||||
CORS_ALLOWED_ORIGINS = os.environ.get(
|
||||
'CORS_ALLOWED_ORIGINS', 'http://localhost:4200'
|
||||
).split(',')
|
||||
|
||||
ROOT_URLCONF = 'core.urls'
|
||||
|
||||
TEMPLATES = [
|
||||
{
|
||||
'BACKEND': 'django.template.backends.django.DjangoTemplates',
|
||||
'DIRS': [BASE_DIR / 'templates'],
|
||||
'APP_DIRS': True,
|
||||
'OPTIONS': {
|
||||
'context_processors': [
|
||||
'django.template.context_processors.request',
|
||||
'django.contrib.auth.context_processors.auth',
|
||||
'django.contrib.messages.context_processors.messages',
|
||||
],
|
||||
},
|
||||
},
|
||||
]
|
||||
|
||||
WSGI_APPLICATION = 'core.wsgi.application'
|
||||
|
||||
DATABASES = {
|
||||
'default': {
|
||||
'ENGINE': 'django.db.backends.postgresql',
|
||||
'NAME': os.environ.get('DB_NAME', 'budget_db'),
|
||||
'USER': os.environ.get('DB_USER', 'budget_user'),
|
||||
'PASSWORD': os.environ['DB_PASSWORD'],
|
||||
'HOST': os.environ.get('DB_HOST', 'localhost'),
|
||||
'PORT': os.environ.get('DB_PORT', '5432'),
|
||||
}
|
||||
}
|
||||
|
||||
AUTH_PASSWORD_VALIDATORS = [
|
||||
{'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'},
|
||||
{'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator'},
|
||||
{'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'},
|
||||
{'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'},
|
||||
]
|
||||
|
||||
LANGUAGE_CODE = 'en-us'
|
||||
TIME_ZONE = 'UTC'
|
||||
USE_I18N = True
|
||||
USE_TZ = True
|
||||
|
||||
STATIC_URL = 'static/'
|
||||
STATIC_ROOT = BASE_DIR / 'staticfiles'
|
||||
MEDIA_URL = '/media/'
|
||||
MEDIA_ROOT = BASE_DIR / 'media'
|
||||
|
||||
DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
|
||||
|
||||
# ── Email ─────────────────────────────────────────────────────────────────────
|
||||
_default_email_backend = (
|
||||
'django.core.mail.backends.console.EmailBackend' if DEBUG
|
||||
else 'django.core.mail.backends.smtp.EmailBackend'
|
||||
)
|
||||
EMAIL_BACKEND = os.environ.get('EMAIL_BACKEND', _default_email_backend)
|
||||
EMAIL_HOST = os.environ.get('EMAIL_HOST', 'localhost')
|
||||
EMAIL_PORT = int(os.environ.get('EMAIL_PORT', '587'))
|
||||
EMAIL_HOST_USER = os.environ.get('EMAIL_HOST_USER', '')
|
||||
EMAIL_HOST_PASSWORD = os.environ.get('EMAIL_HOST_PASSWORD', '')
|
||||
EMAIL_USE_TLS = os.environ.get('EMAIL_USE_TLS', 'True') == 'True'
|
||||
DEFAULT_FROM_EMAIL = os.environ.get('DEFAULT_FROM_EMAIL', 'noreply@armarium.ch')
|
||||
|
||||
LOGGING = {
|
||||
'version': 1,
|
||||
'disable_existing_loggers': False,
|
||||
'handlers': {
|
||||
'console': {'class': 'logging.StreamHandler'},
|
||||
},
|
||||
'loggers': {
|
||||
'django.mail': {'handlers': ['console'], 'level': 'ERROR'},
|
||||
'armarium': {'handlers': ['console'], 'level': 'INFO'},
|
||||
},
|
||||
}
|
||||
|
||||
REST_FRAMEWORK = {
|
||||
'DEFAULT_AUTHENTICATION_CLASSES': (
|
||||
'rest_framework_simplejwt.authentication.JWTAuthentication',
|
||||
),
|
||||
'DEFAULT_PERMISSION_CLASSES': (
|
||||
'rest_framework.permissions.IsAuthenticated',
|
||||
),
|
||||
'DEFAULT_THROTTLE_CLASSES': [
|
||||
'rest_framework.throttling.AnonRateThrottle',
|
||||
'rest_framework.throttling.UserRateThrottle',
|
||||
],
|
||||
'DEFAULT_THROTTLE_RATES': {
|
||||
'anon': '20/min',
|
||||
'user': '200/min',
|
||||
'auth': '5/min',
|
||||
},
|
||||
}
|
||||
|
||||
AUTHENTICATION_BACKENDS = [
|
||||
'finance.backends.EmailAuthBackend',
|
||||
]
|
||||
|
||||
SIMPLE_JWT = {
|
||||
'ACCESS_TOKEN_LIFETIME': timedelta(minutes=60),
|
||||
'REFRESH_TOKEN_LIFETIME': timedelta(days=7),
|
||||
'ROTATE_REFRESH_TOKENS': True,
|
||||
'BLACKLIST_AFTER_ROTATION': True,
|
||||
}
|
||||
|
||||
# ── Uploads ───────────────────────────────────────────────────────────────────
|
||||
DATA_UPLOAD_MAX_MEMORY_SIZE = 5 * 1024 * 1024 # 5 MB
|
||||
FILE_UPLOAD_MAX_MEMORY_SIZE = 5 * 1024 * 1024 # 5 MB
|
||||
|
||||
# ── CSRF ──────────────────────────────────────────────────────────────────────
|
||||
CSRF_TRUSTED_ORIGINS = os.environ.get(
|
||||
'CSRF_TRUSTED_ORIGINS', 'http://localhost:4200'
|
||||
).split(',')
|
||||
|
||||
# ── Production security (nur aktiv wenn DEBUG=False) ─────────────────────────
|
||||
if not DEBUG:
|
||||
SECURE_SSL_REDIRECT = True
|
||||
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
|
||||
SECURE_HSTS_SECONDS = 31_536_000 # 1 Jahr
|
||||
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
|
||||
SECURE_HSTS_PRELOAD = True
|
||||
SESSION_COOKIE_SECURE = True
|
||||
CSRF_COOKIE_SECURE = True
|
||||
SECURE_CONTENT_TYPE_NOSNIFF = True
|
||||
|
||||
FRONTEND_URL = os.environ.get('FRONTEND_URL', 'http://localhost:4200')
|
||||
@@ -0,0 +1,55 @@
|
||||
import os
|
||||
from django.contrib import admin
|
||||
from django.urls import path, include
|
||||
from django.conf import settings
|
||||
from django.conf.urls.static import static
|
||||
from rest_framework.routers import DefaultRouter
|
||||
from rest_framework_simplejwt.views import TokenRefreshView
|
||||
from finance.views import (
|
||||
AccountViewSet, TransactionViewSet, BudgetViewSet,
|
||||
ExpenseViewSet, DeadlineViewSet, ProfileView, RegisterView, LogoutView, ChangePasswordView,
|
||||
ICalUrlView, ICalFeedView, NotificationsView, SearchView,
|
||||
LoginView, TwoFactorLoginView, TwoFactorSetupView, TwoFactorEnableView, TwoFactorDisableView,
|
||||
TwoFactorRecoverRequestView, TwoFactorRecoverConfirmView,
|
||||
SessionListView, SessionRevokeView, SessionRevokeAllView,
|
||||
DataExportView, NotificationPrefsView,
|
||||
VerifyEmailView, PasswordResetRequestView, PasswordResetConfirmView,
|
||||
)
|
||||
|
||||
router = DefaultRouter()
|
||||
router.register(r'accounts', AccountViewSet, basename='account')
|
||||
router.register(r'transactions', TransactionViewSet, basename='transaction')
|
||||
router.register(r'budgets', BudgetViewSet, basename='budget')
|
||||
router.register(r'expenses', ExpenseViewSet, basename='expense')
|
||||
router.register(r'deadlines', DeadlineViewSet, basename='deadline')
|
||||
|
||||
_admin_url = os.environ.get('ADMIN_URL', 'manage/').strip('/')+ '/'
|
||||
|
||||
urlpatterns = [
|
||||
path(_admin_url, admin.site.urls),
|
||||
path('api/', include(router.urls)),
|
||||
path('api/profile/', ProfileView.as_view()),
|
||||
path('api/auth/register/', RegisterView.as_view()),
|
||||
path('api/auth/token/', LoginView.as_view()),
|
||||
path('api/auth/token/refresh/', TokenRefreshView.as_view()),
|
||||
path('api/auth/logout/', LogoutView.as_view()),
|
||||
path('api/auth/password/', ChangePasswordView.as_view()),
|
||||
path('api/auth/verify-email/', VerifyEmailView.as_view()),
|
||||
path('api/auth/password-reset/', PasswordResetRequestView.as_view()),
|
||||
path('api/auth/password-reset/confirm/', PasswordResetConfirmView.as_view()),
|
||||
path('api/auth/2fa/login/', TwoFactorLoginView.as_view()),
|
||||
path('api/auth/2fa/setup/', TwoFactorSetupView.as_view()),
|
||||
path('api/auth/2fa/enable/', TwoFactorEnableView.as_view()),
|
||||
path('api/auth/2fa/disable/', TwoFactorDisableView.as_view()),
|
||||
path('api/auth/2fa/recover/', TwoFactorRecoverRequestView.as_view()),
|
||||
path('api/auth/2fa/recover/confirm/', TwoFactorRecoverConfirmView.as_view()),
|
||||
path('api/auth/sessions/', SessionListView.as_view()),
|
||||
path('api/auth/sessions/revoke-all/', SessionRevokeAllView.as_view()),
|
||||
path('api/auth/sessions/<str:session_key>/', SessionRevokeView.as_view()),
|
||||
path('api/export/', DataExportView.as_view()),
|
||||
path('api/notifications/prefs/', NotificationPrefsView.as_view()),
|
||||
path('api/search/', SearchView.as_view()),
|
||||
path('api/notifications/', NotificationsView.as_view()),
|
||||
path('api/calendar/ical-url/', ICalUrlView.as_view()),
|
||||
path('api/calendar/ical/<int:user_id>/<str:token>/', ICalFeedView.as_view()),
|
||||
] + static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
|
||||
@@ -0,0 +1,16 @@
|
||||
"""
|
||||
WSGI config for core project.
|
||||
|
||||
It exposes the WSGI callable as a module-level variable named ``application``.
|
||||
|
||||
For more information on this file, see
|
||||
https://docs.djangoproject.com/en/6.0/howto/deployment/wsgi/
|
||||
"""
|
||||
|
||||
import os
|
||||
|
||||
from django.core.wsgi import get_wsgi_application
|
||||
|
||||
os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'core.settings')
|
||||
|
||||
application = get_wsgi_application()
|
||||
Reference in New Issue
Block a user