name: damaratern

x-db-credentials: &db-credentials
  POSTGRES_USER: &db-user django
  POSTGRES_PASSWORD: placeholder
  POSTGRES_DB: data

services:
  frontend:
    container_name: damaratern-frontend
    image: camden.ornl.gov/damaratern/frontend:latest
    restart: unless-stopped
    ports:
      - "443:443"
      # Optional (HTTP -> HTTPS redirect example below expects this)
      - "80:80"
    volumes:
      # SSL materials (recommended)
      - ./path/to/ssl:/etc/nginx/ssl:ro
      # Your Nginx config
      - ./path/to/nginx.conf:/etc/nginx/nginx.conf:ro
      # Optional: mount media directory if using X-Accel-Redirect/internal media serving
      # - ./path/to/media:/data:ro
    cap_drop: [ALL]
    cap_add: [NET_BIND_SERVICE, SETUID, SETGID]
    security_opt: [no-new-privileges:true]
    depends_on:
      - backend

  backend:
    container_name: damaratern-backend
    image: camden.ornl.gov/damaratern/backend:latest
    restart: unless-stopped
    environment:
      # Running user/group IDs
      UID: 10001
      GID: 10001
      # Gunicorn settings
      SERVER_PORT: 8000
      SERVER_WORKER_COUNT: 4
      SERVER_TIMEOUT: 120
      # Default admin credentials
      ADMIN_USERNAME: "admin"
      ADMIN_PASSWORD: "admin"
      ADMIN_EMAIL: "admin@example.com"
    volumes:
      - ./path/to/settings.toml:/damaratern/settings.toml:ro
      # Optional: mount shared media/data paths used by the app
      # - ./path/to/media:/tmp/media
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy

  db:
    container_name: damaratern-db
    image: postgres:17
    restart: unless-stopped
    environment:
      <<: *db-credentials
    volumes:
      - db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "pg_isready", "-U", *db-user]
      interval: 5s
      retries: 5
      timeout: 5s

  redis:
    container_name: damaratern-redis
    image: redis:latest
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      retries: 5
      timeout: 5s

volumes:
  db: {}

• server_name
• the HTTP → HTTPS redirect target
• the proxy_pass upstream (it should point at the backend service)

pid /run/nginx.pid;
user nginx;
worker_processes auto;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    server_tokens       off;
    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 4096;

    # Adjust for your expected upload sizes
    client_max_body_size 100G;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    include /etc/nginx/conf.d/*.conf;

    # Redirect HTTP -> HTTPS
    server {
        listen 80 default_server;
        server_name example.com;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        server_name example.com;

        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-Content-Type-Options "nosniff";
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

        charset utf-8;

        ssl_certificate     /run/nginx/ssl/cert.crt;
        ssl_certificate_key /run/nginx/ssl/key.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;

        # You may want to tailor ciphers to your organization’s baseline requirements
        ssl_ciphers HIGH:EECDH+AESGCM:EECDH+AES256:EECDH+AES128:EDH+AES:RSA+AESGCM:RSA+AES:!MEDIUM:!ECDSA:!aNULL:!MD5:!SEED:!IDEA:!DES:!RC4:!DSS:!3DES;
        ssl_session_cache shared:SSL:15m;
        ssl_session_timeout 10m;

        # Serve static files
        location /static/ {
            alias /var/www/staticfiles/;
            autoindex off;
            expires 30d;
            access_log off;
        }

        # Internal-only media serving (optional)
        location /media/ {
            internal;
            alias /data/;
        }

        # Reverse proxy to Gunicorn/Django backend
        location / {
            proxy_pass http://backend:8000;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Host  $server_name;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Port  443;
            proxy_set_header Origin            "https://localhost";
        }
    }
}

[default]
# Settings module - static value
DJANGO_SETTINGS_MODULE = "dt.settings"

# Core application settings
[default.APP]
DEBUG = true
DEBUG_TOOLBAR = false
INSTANCE_NICKNAME = "dev"                     # If unset, defaults to HOSTNAME
REGISTRATION_URL = "https://localhost/login/" # If unset, no link will be shown
TIMEZONE = "America/New_York"

# Module settings
MIDDLEWARE = ["my_app.middleware.CustomMiddleware"]
OPTIONAL_MODULES = []
CUSTOM_MODULES = []

# Data folders and selection headers
DATA_PATH_NON_SENSITIVE = "non_sensitive"
DATA_PATH_SENSITIVE = "sensitive"
DATA_PATH_DEFAULT = "/data"
DATA_PATH_SECONDARY = "/mnt/data"
DATA_PATH_HEADERS = [
  ["DATA_PATH_DEFAULT", "Default Data"],
  ["DATA_PATH_SECONDARY", "Secondary Data"],
]

# Path overrides
STATIC_SERVE_MODE = "external"
STATIC_ROOT = "./staticfiles/"
MEDIA_ROOT = "/tmp/media/"

MAX_UPLOAD_SIZE = "100g"
MAX_UPLOAD_MEMORY_SIZE = "100m"

# Security settings
[default.SECURITY]
SECRET_KEY = ""
ALLOWED_HOSTS = ["localhost", "127.0.0.1"]
TRUSTED_ORIGINS = [
  "http://localhost",
  "https://localhost",
  "http://127.0.0.1",
  "https://127.0.0.1",
]

# Logging settings
[default.LOGGING]
LEVEL = "DEBUG"
PATH = "/var/log/django.log"

# Database settings
[default.POSTGRES]
HOST = "db"
PORT = 5432
NAME = "data"
PASSWORD = ""

# Redis settings
[default.REDIS]
ENABLED = false
HOST = "redis"

# SMTP/Email settings
[default.SMTP]
HOST = "localhost"
PORT = 25
USER = ""
PASSWORD = ""
TLS = false

FROM_EMAIL = ""
MAILTO_EMAIL = ""
MAILTO_DEV_EMAIL = ""
MAILTO_RECIPIENTS = ""

# Primary/main LDAP settings
[default.LDAP.PRIMARY]
ENABLED = true
URI = "ldap://localhost:389"
TEMPLATE = "uid=%(user)s,ou=Users,dc=example,dc=com"
ATTR_MAP = { first_name = "givenName", last_name = "sn", email = "mail" }

# Secondary LDAP settings for custom backends
[default.LDAP.SECONDARY]
ENABLED = false
URI = "ldap://localhost:389"
TEMPLATE = "uid=%(user)s,ou=Users,dc=example,dc=com"
ATTR_MAP = { first_name = "givenName", last_name = "sn", email = "mail" }

DEBUG (bool)

Enables Django debug mode and debug-level behavior.
Default: false (recommended in production).

DEBUG_TOOLBAR (bool)

Controls whether the Django Debug Toolbar is enabled.
Default: false (disabled).

INSTANCE_NICKNAME (string)

Display name for the instance (visible in the UI, e.g., navbar).
If unset, the application uses the container hostname.
Default: (hostname).

REGISTRATION_URL (string)

When set, the UI may present a link directing users to a registration page or onboarding flow.
If unset, no registration link is shown.
Default: unset.

TIMEZONE (string)

IANA timezone name (for example, America/New_York).
Default: America/New_York unless configured.

MIDDLEWARE (list of strings)

Additional middleware to load. Use this to inject or override behavior (logging, access checks, request transforms, etc.).
Default: [].

OPTIONAL_MODULES (list of strings)

A list of optional modules to enable when present.
No optional modules are provided by default in the public application.
Default: [].

OPTIONAL_MODULES_ROUTERS (map)

A mapping of modules to their database routers, if present.
Default: {}.

Example:

OPTIONAL_MODULES_ROUTERS = { mymodule = "mymodule.dbrouter.MyModuleRouter" }

CUSTOM_MODULES (list of strings)

Custom modules that override built-in behavior (for example, authentication backends).
Default: [].

DATA_PATH_NON_SENSITIVE (string)

Default directory name for non-sensitive data.
Default: non_sensitive unless configured.

DATA_PATH_SENSITIVE (string)

Default directory name for sensitive data.
Default: sensitive unless configured.

DATA_PATH_* (strings)

Any DATA_PATH_… values define named, mounted directories the application can access (besides ...NON_SENSITIVE and ...SENSITIVE).
These should be absolute paths that exist inside the containers (or on the host, if not using Docker).

Examples:

• DATA_PATH_DEFAULT = "/data"
• DATA_PATH_SECONDARY = "/mnt/data"

DATA_PATH_HEADERS (list of 2-item arrays)

A TOML list of ["VARIABLE_NAME", "Display Label"] pairs that maps each DATA_PATH_* variable to a label.

Example:

DATA_PATH_HEADERS = [
  ["DATA_PATH_DEFAULT", "Default Data"],
  ["DATA_PATH_SECONDARY", "Secondary Data"],
]

If you add a new DATA_PATH_* setting, you should also add a corresponding entry in DATA_PATH_HEADERS.

STATIC_SERVE_MODE (string)

When set to external, indicate to the backend that a web server (Nginx/Apache) is serving static assets.
Set this to external when the frontend container (or another web server) serves /static/.
Set this to django explicitly to serve static assets with the backend.

Default: external

STATIC_ROOT (string)

Path used by Django for static collection / static root.
Default: ./staticfiles/

MEDIA_ROOT (string)

Path for uploaded media storage.
Default: /tmp/media/

MAX_UPLOAD_SIZE (string)

Maximum allowed upload size. Supports human-friendly sizes such as 100g, 500m.
Default: 100g

MAX_UPLOAD_MEMORY_SIZE (string)

Maximum chunk size to buffer in memory per upload.
Default: 100m

SECRET_KEY (string)

Django secret key used for cryptographic signing (sessions/cookies).
Required. Default: empty (invalid for production).

Generate a new secret key:

With local Python

python -c 'from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())'

With Docker using backend image

docker run --rm camden.ornl.gov/damaratern/backend:latest python -c 'from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())'

ALLOWED_HOSTS (list of strings)

Hosts the application is allowed to serve from (Django ALLOWED_HOSTS).
Default: ["localhost", "127.0.0.1"]

TRUSTED_ORIGINS (list of strings)

Trusted origins used for CSRF/CORS-related behavior. This must match where your frontend is hosted.

Docker examples often include https://localhost when proxying between containers.
Default: ["http://localhost", "https://localhost", "http://127.0.0.1", "https://127.0.0.1"]

LEVEL (string)

Logging level. Supported values:

• DEBUG
• INFO
• WARNING
• ERROR
• CRITICAL

Default: INFO unless configured.

PATH (string)

Where logs are written:

• a file path (example: /var/log/django.log)
• stdout
• stderr

Default: stdout is commonly preferred in Docker, but this depends on your deployment.

HOST (string)

Database host to connect to.

• In Docker Compose bridge networking, use the service name (example: db).
• Outside Docker, use a hostname or IP.

Default: localhost

PORT (int)

Database port.
Default: 5432

NAME (string)

Database name.
Default: data

PASSWORD (string)

Password for the configured database user.
Default: empty (placeholder)

You will also typically need to configure a database user and password in your Postgres container (for example, POSTGRES_USER and POSTGRES_PASSWORD in Compose).

ENABLED (bool)

Enable Redis caching when true. When false, the application falls back to local in-memory caching.
Default: false

HOST (string)

Redis host to connect to (use the Docker service name, e.g., redis, when on a Compose bridge network).
Default: localhost

HOST (string)

SMTP host or relay.
Default: localhost

PORT (int)

SMTP port.
Default: 25

USER (string)

SMTP auth username.
Default: empty

PASSWORD (string)

SMTP auth password.
Default: empty

TLS (bool)

Enable TLS for SMTP.
Default: false

FROM_EMAIL (string)

Email address used in the “From” header for outbound email.
Default: empty

MAILTO_EMAIL (string)

Primary recipient for feedback/notifications.
Default: empty

MAILTO_DEV_EMAIL (string)

Optional developer/support recipient address.
Default: empty

MAILTO_RECIPIENTS (string)

Additional recipients to CC (format depends on your organization’s conventions).
Default: empty

The application can be configured with two LDAP profiles: PRIMARY and SECONDARY.

• The primary configuration takes precedence when both are enabled.
• The secondary configuration is intended for custom authentication backends or multi-directory setups.

If neither LDAP profile is enabled, the application falls back to basic authentication, managed via Django’s admin interface.

Primary LDAP settings: [default.LDAP.PRIMARY]

ENABLED (bool)

Enable primary or secondary authentication services.
Default: false

URI (string)

LDAP URI, for example:

• ldap://host:389
• ldaps://host:636

Default: placeholder value — update for your environment.

TEMPLATE (string)

Bind/search template used to locate a user entry.

Example:

TEMPLATE = "uid=%(user)s,ou=Users,dc=example,dc=com"

ATTR_MAP (map)

Maps application user fields to LDAP attributes. first_name, last_name, and email should be mapped based on available Active Directory attributes.

Default:

ATTR_MAP = { first_name = "givenName", last_name = "sn", email = "mail" }

Secondary LDAP settings: [default.LDAP.SECONDARY]:

Keys and default values are identical to PRIMARY:

• ENABLED
• URI
• TEMPLATE
• ATTR_MAP