From c29584eefab5ba9813ed4d09446160b5f236196a Mon Sep 17 00:00:00 2001 From: Cian Hughes Date: Tue, 11 Aug 2026 20:53:32 +0100 Subject: [PATCH] Fixed default configuration settings --- cli/data/env.template | 2 - cli/deploy.py | 49 +++++----- i-form-data-repository/docker-services.yml | 3 + i-form-data-repository/invenio.cfg | 103 ++++++++++++--------- 4 files changed, 90 insertions(+), 67 deletions(-) diff --git a/cli/data/env.template b/cli/data/env.template index 0204c9f..6d2165f 100644 --- a/cli/data/env.template +++ b/cli/data/env.template @@ -71,7 +71,5 @@ INVENIO_SEARCH_INDEX_PREFIX=invenio-rdm- INVENIO_LOGGING_CONSOLE_LEVEL=WARNING # Theme Configuration for I-Form -INVENIO_THEME_IFORM_PRODUCTION=false INVENIO_THEME_IFORM_CONTACT_FORM=true INVENIO_THEME_IFORM_SUPPORT_EMAIL=support@i-form.ie -COMPOSE_FILE=i-form-data-repository/docker-compose.full.yml diff --git a/cli/deploy.py b/cli/deploy.py index 9f04475..7bd6c12 100644 --- a/cli/deploy.py +++ b/cli/deploy.py @@ -3,6 +3,7 @@ from loguru import logger from plumbum import FG, local from plumbum.cmd import docker, git, uv +from cli.config import config from cli.utils import docker_compose, get_project_root, get_repo_dir app = typer.Typer(help="Deployment Management Tool") @@ -133,17 +134,18 @@ def prod_deploy(): git["switch", "prod"] & FG git["pull", "origin", "prod"] & FG - with local.cwd(REPO_DIR): - docker[ - "build", - "-t", - "i-form-data-repository:latest", - "--no-cache", - "--build-arg", - "INSTALL_LOCAL_WHEELS=false", - ".", - ] & FG - docker_compose("up", "-d", "--wait") + with local.env(INVENIO_THEME_IFORM_PRODUCTION="true"): + with local.cwd(REPO_DIR): + docker[ + "build", + "-t", + config.docker_image_name, + "--no-cache", + "--build-arg", + "INSTALL_LOCAL_WHEELS=false", + ".", + ] & FG + docker_compose("up", "-d", "--wait") setup_cmd = "invenio db init && invenio db create && invenio alembic upgrade head && invenio collect -v && invenio index init" docker_compose("exec", "worker", "bash", "-c", setup_cmd) @@ -174,18 +176,19 @@ def prod_update( git["switch", "prod"] & FG git["pull", "origin", "prod"] & FG - with local.cwd(REPO_DIR): - docker_compose("pull") - docker[ - "build", - "-t", - "i-form-data-repository:latest", - "--no-cache", - "--build-arg", - "INSTALL_LOCAL_WHEELS=false", - ".", - ] & FG - docker_compose("up", "-d", "--wait") + with local.env(INVENIO_THEME_IFORM_PRODUCTION="true"): + with local.cwd(REPO_DIR): + docker_compose("pull") + docker[ + "build", + "-t", + config.docker_image_name, + "--no-cache", + "--build-arg", + "INSTALL_LOCAL_WHEELS=false", + ".", + ] & FG + docker_compose("up", "-d", "--wait") update_cmd = "invenio alembic upgrade head && invenio collect -v" docker_compose("exec", "worker", "bash", "-c", update_cmd) diff --git a/i-form-data-repository/docker-services.yml b/i-form-data-repository/docker-services.yml index 038e53d..e4b9ea6 100644 --- a/i-form-data-repository/docker-services.yml +++ b/i-form-data-repository/docker-services.yml @@ -5,6 +5,7 @@ services: args: - ENVIRONMENT=DEV image: i-form-data-repository + env_file: ../.env restart: "unless-stopped" environment: - "INVENIO_ACCOUNTS_SESSION_REDIS_URL=redis://cache:6379/1" @@ -21,6 +22,7 @@ services: - "INVENIO_RATELIMIT_STORAGE_URL=redis://cache:6379/3" - "INVENIO_S3_ACCESS_KEY_ID=${INVENIO_S3_ACCESS_KEY_ID}" - "INVENIO_S3_SECRET_ACCESS_KEY=${INVENIO_S3_SECRET_ACCESS_KEY}" + - "INVENIO_THEME_IFORM_PRODUCTION=${INVENIO_THEME_IFORM_PRODUCTION:-false}" logging: driver: "json-file" options: @@ -31,6 +33,7 @@ services: context: ./docker/nginx/ dockerfile: Dockerfile image: i-form-data-repository-frontend + env_file: ../.env restart: "unless-stopped" ports: - "${DOCKER_SERVICES_IP_BIND:-127.0.0.1}:8080:80" diff --git a/i-form-data-repository/invenio.cfg b/i-form-data-repository/invenio.cfg index 70b2795..0cd382e 100644 --- a/i-form-data-repository/invenio.cfg +++ b/i-form-data-repository/invenio.cfg @@ -14,6 +14,7 @@ from invenio_i18n import lazy_gettext as _ def _(x): # needed to avoid start time failure with lazy strings return x + # Flask # ===== # See https://flask.palletsprojects.com/en/1.1.x/config/ @@ -30,13 +31,19 @@ WEBPACKEXT_PROJECT = "invenio_assets.webpack:rspack_project" # SECURITY WARNING: keep the secret key used in production secret! # Do not commit it to a source code repository. # TODO: Set -SECRET_KEY="CHANGE_ME" +SECRET_KEY = "CHANGE_ME" # Since HAProxy and Nginx route all requests no matter the host header # provided, the trusted hosts variable is set to localhost. In production it # should be set to the correct host and it is strongly recommended to only # route correct hosts to the application. -TRUSTED_HOSTS = ['0.0.0.0', 'localhost', '127.0.0.1'] +TRUSTED_HOSTS = [ + "0.0.0.0", + "localhost", + "127.0.0.1", + "invenio.dcueosc-team.src.surf-hosted.nl", + "invenio.i-form.ie", +] # Flask-SQLAlchemy @@ -44,7 +51,7 @@ TRUSTED_HOSTS = ['0.0.0.0', 'localhost', '127.0.0.1'] # See https://flask-sqlalchemy.palletsprojects.com/en/2.x/config/ # TODO: Set -SQLALCHEMY_DATABASE_URI="postgresql+psycopg2://i-form-data-repository:i-form-data-repository@localhost/i-form-data-repository" +SQLALCHEMY_DATABASE_URI = "postgresql+psycopg2://i-form-data-repository:i-form-data-repository@localhost/i-form-data-repository" # Invenio-App @@ -52,33 +59,35 @@ SQLALCHEMY_DATABASE_URI="postgresql+psycopg2://i-form-data-repository:i-form-dat # See https://invenio-app.readthedocs.io/en/latest/configuration.html APP_DEFAULT_SECURE_HEADERS = { - 'content_security_policy': { - 'default-src': [ + "content_security_policy": { + "default-src": [ "'self'", - 'data:', # for fonts + "data:", # for fonts "'unsafe-inline'", # for inline scripts and styles - "blob:", # for pdf preview + "blob:", # for pdf preview # Add your own policies here (e.g. analytics) ], - 'script-src': [ - "'self'", "blob:", "'wasm-unsafe-eval'" # for WASM-based workers + "script-src": [ + "'self'", + "blob:", + "'wasm-unsafe-eval'", # for WASM-based workers # Multipart file uploads use a Web Worker running `hash-wasm` to compute content checksums # (e.g., MD5) of uploaded parts. This requires both 'blob:' and 'wasm-unsafe-eval' enabled in `script-src`. ], }, - 'content_security_policy_report_only': False, - 'content_security_policy_report_uri': None, - 'force_file_save': False, - 'force_https': True, - 'force_https_permanent': False, - 'frame_options': 'sameorigin', - 'frame_options_allow_from': None, - 'session_cookie_http_only': True, - 'session_cookie_secure': True, - 'strict_transport_security': True, - 'strict_transport_security_include_subdomains': True, - 'strict_transport_security_max_age': 31556926, # One year in seconds - 'strict_transport_security_preload': False, + "content_security_policy_report_only": False, + "content_security_policy_report_uri": None, + "force_file_save": False, + "force_https": True, + "force_https_permanent": False, + "frame_options": "sameorigin", + "frame_options_allow_from": None, + "session_cookie_http_only": True, + "session_cookie_secure": True, + "strict_transport_security": True, + "strict_transport_security_include_subdomains": True, + "strict_transport_security_max_age": 31556926, # One year in seconds + "strict_transport_security_preload": False, } @@ -87,9 +96,9 @@ APP_DEFAULT_SECURE_HEADERS = { # See https://python-babel.github.io/flask-babel/#configuration # Default locale (language) -BABEL_DEFAULT_LOCALE = 'en' +BABEL_DEFAULT_LOCALE = "en" # Default time zone -BABEL_DEFAULT_TIMEZONE = 'Europe/Zurich' +BABEL_DEFAULT_TIMEZONE = "Europe/Zurich" # Invenio-I18N @@ -98,7 +107,7 @@ BABEL_DEFAULT_TIMEZONE = 'Europe/Zurich' # Other supported languages (do not include BABEL_DEFAULT_LOCALE in list). I18N_LANGUAGES = [ - ('ga', _('Irish')), + ("ga", _("Irish")), ] @@ -111,7 +120,7 @@ THEME_SITENAME = "I-Form Data Repository" # Frontpage title THEME_FRONTPAGE_TITLE = "I-Form Data Repository" # Header logo -THEME_LOGO = 'images/invenio-rdm.svg' +THEME_LOGO = "images/invenio-rdm.svg" # Invenio-App-RDM @@ -119,7 +128,7 @@ THEME_LOGO = 'images/invenio-rdm.svg' # See https://github.com/inveniosoftware/invenio-app-rdm/blob/master/invenio_app_rdm/config.py # Instance's theme entrypoint file. Path relative to the ``assets/`` folder. -INSTANCE_THEME_FILE = './less/theme.less' +INSTANCE_THEME_FILE = "./less/theme.less" # Email address for administrator emails (like file checksum alerts) APP_RDM_ADMIN_EMAIL_RECIPIENT = "info@repo.i-form.ie" @@ -131,33 +140,35 @@ APP_RDM_DEPOSIT_FORM_DEFAULTS = { { "id": "cc-by-4.0", "title": "Creative Commons Attribution 4.0 International", - "description": ("The Creative Commons Attribution license allows " - "re-distribution and re-use of a licensed work " - "on the condition that the creator is " - "appropriately credited."), + "description": ( + "The Creative Commons Attribution license allows " + "re-distribution and re-use of a licensed work " + "on the condition that the creator is " + "appropriately credited." + ), "link": "https://creativecommons.org/licenses/by/4.0/legalcode", } ], "publisher": "I-Form Data Repository", } -APP_RDM_DEPOSIT_FORM_AUTOCOMPLETE_NAMES = 'search' # "search_only" or "off" +APP_RDM_DEPOSIT_FORM_AUTOCOMPLETE_NAMES = "search" # "search_only" or "off" # Enable new Uppy-based UI for depositing large files (Invenio RDM v13+) APP_RDM_DEPOSIT_NG_FILES_UI_ENABLED = True # Invenio-Files-Rest # ================== -FILES_REST_STORAGE_FACTORY='invenio_s3.s3fs_storage_factory' +FILES_REST_STORAGE_FACTORY = "invenio_s3.s3fs_storage_factory" # Invenio-S3 # ========== -S3_ENDPOINT_URL='http://localhost:9000/' -S3_ACCESS_KEY_ID='CHANGE_ME' -S3_SECRET_ACCESS_KEY='CHANGE_ME' +S3_ENDPOINT_URL = "http://localhost:9000/" +S3_ACCESS_KEY_ID = "CHANGE_ME" +S3_SECRET_ACCESS_KEY = "CHANGE_ME" # Allow S3 endpoint in the CSP rules -APP_DEFAULT_SECURE_HEADERS['content_security_policy']['default-src'].append( +APP_DEFAULT_SECURE_HEADERS["content_security_policy"]["default-src"].append( S3_ENDPOINT_URL ) @@ -166,9 +177,9 @@ APP_DEFAULT_SECURE_HEADERS['content_security_policy']['default-src'].append( # See https://github.com/inveniosoftware/invenio-records-resources/blob/master/invenio_records_resources/config.py # TODO: Set with your own hostname when deploying to production -SITE_UI_URL = "https://127.0.0.1" +SITE_UI_URL = "https://invenio.i-form.ie" -SITE_API_URL = "https://127.0.0.1/api" +SITE_API_URL = "https://invenio.i-form.ie/api" # Invenio-RDM-Records # =================== @@ -192,7 +203,9 @@ SECURITY_REGISTERABLE = True # local login: allow users to register SECURITY_RECOVERABLE = True # local login: allow users to reset the password SECURITY_CHANGEABLE = True # local login: allow users to change psw SECURITY_CONFIRMABLE = True # local login: users can confirm e-mail address -SECURITY_LOGIN_WITHOUT_CONFIRMATION = False # require users to confirm email before being able to login +SECURITY_LOGIN_WITHOUT_CONFIRMATION = ( + False # require users to confirm email before being able to login +) # Invenio-OAuthclient # ------------------- @@ -201,12 +214,17 @@ SECURITY_LOGIN_WITHOUT_CONFIRMATION = False # require users to confirm email bef OAUTHCLIENT_REMOTE_APPS = {} # configure external login providers from invenio_oauthclient.views.client import auto_redirect_login -ACCOUNTS_LOGIN_VIEW_FUNCTION = auto_redirect_login # autoredirect to external login if enabled + +ACCOUNTS_LOGIN_VIEW_FUNCTION = ( + auto_redirect_login # autoredirect to external login if enabled +) OAUTHCLIENT_AUTO_REDIRECT_TO_EXTERNAL_LOGIN = False # autoredirect to external login # Invenio-UserProfiles # -------------------- -USERPROFILES_READ_ONLY = False # allow users to change profile info (name, email, etc...) +USERPROFILES_READ_ONLY = ( + False # allow users to change profile info (name, email, etc...) +) # OAI-PMH # ======= @@ -227,6 +245,7 @@ SEARCH_INDEX_PREFIX = "i-form-data-repository-" # ---------------------- from invenio_app_rdm import __version__ + ADMINISTRATION_DISPLAY_VERSIONS = [ ("invenio-app-rdm", f"v{__version__}"), ("i-form-data-repository", "v1.0.0"),