DEBUG was on in production, so an error rendered a full traceback and the
DEBUG-only media route served /media/ixg-documents/... publicly, bypassing
the document permission checks. Set DJANGO_DEBUG=False in the env files
(untracked) and add friendly 500/404/403 templates.
With DEBUG off Django no longer serves /static/, so nginx does: the static
root moves to /var/www/ixg-platform-static (mounted into the app container)
because /root is not traversable by www-data.
HSTS (max-age 1y, includeSubDomains) is added to every HTTPS host, and a
pragmatic CSP to the app/ops/portal locations. 'unsafe-inline' is required
by the inline scripts/styles; self-hosting the CDN assets and nonces is a
follow-up.
- settings: trust nginx X-Forwarded-Proto, mark session and CSRF cookies secure,
and set the CSRF trusted origins for the ixgltd.com hosts
- docker-compose: bind the app port to 127.0.0.1 only; nginx fronts it, so there
is no reason for 0.0.0.0
- entrypoint: when the container is given a command, run that instead of always
starting gunicorn (needed for manage.py shell and the test suite)
- gitignore: keep Celery runtime state and stray local backups out of the tree
No functional change to the application itself.
