@django-stack/cli 0.8.1 → 0.10.0

package/templates/base/Caddyfile

@@ -27,6 +27,12 @@
 	header ?X-Frame-Options "DENY"
 	header -Server
 
+	# A request ID for every request: Django and the frontend add it to
+	# their log lines and return it in X-Request-ID, and Caddy's own log
+	# line carries it as request_id. One sent by the client is replaced.
+	request_header X-Request-ID {http.request.uuid}
+	log_append request_id {http.request.uuid}
+
 	# Uploads, when media is stored on the server instead of S3. No scripts
 	# run from uploaded files, whatever their type.
 	handle_path /media/* {
@@ -59,6 +65,6 @@
 
 	log {
 		output stdout
-		format console
+		format json
 	}
 }

package/templates/base/README.md

@@ -38,9 +38,9 @@ the frontend {{frontend_label}}'s, with the source mounted from `backend/` and
 |------|---------|
 | Run a manage.py command | `docker compose exec backend python manage.py <command>` |
 | Make migrations | `docker compose exec backend python manage.py makemigrations` |
-| Regenerate the API types | `npm run generate:types` |
-| Run the tests | `npm test` |
-| Check the setup | `npm run doctor` |
+| Regenerate the API types | `{{pm_run}} generate:types` |
+| Run the tests | `{{pm_run}} test` |
+| Check the setup | `{{pm_run}} doctor` |
 
 With the `dstack` command installed (`npm i -g @django-stack/cli`),
 `dstack dev`, `dstack check`, `dstack manage <command>` and `dstack types` do

package/templates/base/compose.yaml

@@ -26,6 +26,14 @@ x-hardened: &hardened
   cap_drop:
     - ALL
 
+# Every service: Docker keeps at most 5 log files of 10 MB, so logs never
+# fill the disk.
+x-logging: &logging
+  driver: json-file
+  options:
+    max-size: 10m
+    max-file: "5"
+
 x-frontend-env: &frontend-env
   SITE_URL: ${SITE_URL}
   API_URL: http://backend:8000/api
@@ -37,6 +45,13 @@ x-frontend-env: &frontend-env
   # Page analytics: the tracker loads from /_a/ on the site when set.
   UMAMI_WEBSITE_ID: ${UMAMI_WEBSITE_ID:-}
   UMAMI_URL: ${UMAMI_URL:-}
+  # The captcha widget of the contact form, unless CAPTCHA=off.
+  CAPTCHA: ${CAPTCHA:-on}
+  # Server errors to Sentry with ERRORS=sentry, as the backend's.
+  ERRORS: ${ERRORS:-email}
+  SENTRY_DSN: ${SENTRY_DSN:-}
+  SENTRY_ENVIRONMENT: ${SENTRY_ENVIRONMENT:-production}
+  SENTRY_RELEASE: ${SENTRY_RELEASE:-}
 
 x-backend-depends: &backend-depends
   db:
@@ -60,6 +75,14 @@ x-backend-health: &backend-health
   start_period: 60s
   retries: 30
 
+# The worker stamps a heartbeat every minute; unhealthy when it stopped.
+x-worker-health: &worker-health
+  test: ["CMD", "python", "manage.py", "worker_alive"]
+  interval: 30s
+  timeout: 20s
+  start_period: 120s
+  retries: 3
+
 services:
   # Development ------------------------------------------------------------
 
@@ -78,6 +101,7 @@ services:
       - "127.0.0.1:${BACKEND_PORT:-8000}:8000"
     depends_on: *backend-depends
     healthcheck: *backend-health
+    logging: *logging
     restart: unless-stopped
 
   worker:
@@ -96,6 +120,8 @@ services:
     depends_on:
       backend:
         condition: service_healthy
+    healthcheck: *worker-health
+    logging: *logging
     restart: unless-stopped
 
   frontend:
@@ -112,6 +138,7 @@ services:
     depends_on:
       backend:
         condition: service_healthy
+    logging: *logging
     restart: unless-stopped
 
   mailpit:
@@ -119,6 +146,7 @@ services:
     image: axllent/mailpit:v1.27
     ports:
       - "127.0.0.1:${MAIL_PORT:-8025}:8025"
+    logging: *logging
     restart: unless-stopped
 
   # A local S3 service, so development runs the same storage code as
@@ -132,6 +160,7 @@ services:
       - s3data:/data
     ports:
       - "127.0.0.1:${S3_PORT:-8333}:8333"
+    logging: *logging
     restart: unless-stopped
 
   # Production -------------------------------------------------------------
@@ -160,6 +189,7 @@ services:
       resources:
         limits:
           memory: 768M
+    logging: *logging
     restart: unless-stopped
 
   worker-prod:
@@ -185,13 +215,13 @@ services:
     depends_on:
       backend-prod:
         condition: service_healthy
-    healthcheck:
-      disable: true
+    healthcheck: *worker-health
     deploy:
       replicas: ${TASK_WORKERS:-1}
       resources:
         limits:
           memory: 512M
+    logging: *logging
     restart: unless-stopped
 
   frontend-prod:
@@ -212,6 +242,7 @@ services:
       resources:
         limits:
           memory: 512M
+    logging: *logging
     restart: unless-stopped
 
   # The only service with public ports: HTTPS for SITE_URL with a
@@ -244,6 +275,7 @@ services:
       resources:
         limits:
           memory: 256M
+    logging: *logging
     restart: unless-stopped
 
   # Shared -----------------------------------------------------------------
@@ -276,6 +308,7 @@ services:
       resources:
         limits:
           memory: 512M
+    logging: *logging
     restart: unless-stopped
 
   db:
@@ -298,6 +331,7 @@ services:
       resources:
         limits:
           memory: 1G
+    logging: *logging
     restart: unless-stopped
 
   # Valkey (the valkey profile), for CACHE_URL or TASKS_URL redis://cache.
@@ -318,6 +352,7 @@ services:
       resources:
         limits:
           memory: 256M
+    logging: *logging
     restart: unless-stopped
 
 volumes:

package/templates/base/env.example

@@ -114,3 +114,32 @@ BACKUP_TIME=03:00
 BACKUP_KEEP=14
 BACKUP_MEDIA=1
 BACKUP_S3_BUCKET=
+# Requested after each daily backup: the URL of a Healthchecks.io check or
+# an Uptime Kuma push monitor, which alerts you when the pings stop.
+BACKUP_PING_URL=
+
+# The captcha of the contact form: a proof of work the visitor's browser
+# solves, served by Django at /api/cap/, with no third party. CAPTCHA=off
+# turns it off for the backend and the frontend.
+CAPTCHA=on
+
+# Error reports (with DJANGO_DEBUG=0): each new error of the backend, the
+# worker or a backup is mailed to ERROR_EMAIL (comma separated) or, when it
+# is empty, to the superusers, and shows in the admin's notifications. The
+# same error is mailed once an hour at most. ERRORS=off turns it off.
+ERRORS=email
+ERROR_EMAIL=
+# ERRORS=sentry sends the errors of the backend, the worker and the
+# frontend's server to Sentry instead: create a Django project on sentry.io
+# and paste its DSN here. SENTRY_TRACES_SAMPLE_RATE (0 to 1) also sends that
+# share of the backend's requests as performance traces.
+SENTRY_DSN=
+SENTRY_ENVIRONMENT=production
+SENTRY_TRACES_SAMPLE_RATE=0
+
+# Logs: one JSON object per line in production, plain text in development
+# (LOG_FORMAT=json or plain). LOG_ACCESS=0 turns off Django's access log.
+# See the logs page of the DjangoStack docs.
+# LOG_FORMAT=json
+# LOG_LEVEL=INFO
+# LOG_ACCESS=1

package/templates/frontend-astro/AGENTS.md

@@ -12,7 +12,7 @@ src/layouts/Base.astro the page shell: head, menus, footer, preview banner
 src/components/        Blocks.astro maps block types to components in components/blocks/
 src/lib/api.ts         getContent(): content helpers with the read-only key, drafts in preview
 src/lib/cache.ts       the in-memory page cache that /revalidate empties
-src/lib/headless.ts    generated API types; do not edit, run `npm run generate:types`
+src/lib/headless.ts    generated API types; do not edit, run `{{pm_run}} generate:types`
 src/middleware.ts      page cache, editor-managed redirects, security headers
 astro.config.mjs       server output, Content-Security-Policy, the dev proxy to Django
 ```
@@ -39,5 +39,5 @@ Run them in the `frontend` container (`docker compose exec frontend <command>`):
 
 | Task | Command |
 |------|---------|
-| Type-check | `npm run check` |
-| Test | `npm test` |
+| Type-check | `{{pm_run}} check` |
+| Test | `{{pm_run}} test` |

package/templates/frontend-astro/Dockerfile

@@ -7,10 +7,13 @@ WORKDIR /app
 ENV ASTRO_TELEMETRY_DISABLED=1
 
 FROM base AS deps
-COPY package.json package-lock.json* ./
+{{pm_setup}}
+COPY {{pm_manifests}} ./
 COPY vendor/ vendor/
-RUN --mount=type=cache,target=/root/.npm \
-    if [ -f package-lock.json ]; then npm ci; else npm install; fi
+# No BuildKit cache mounts: Railway rejects them, and the layer is cached anyway.
+RUN {{pm_install}}
+# The package manager only installs: npm, which comes with Node.js, runs
+# the scripts of package.json below.
 
 FROM deps AS dev
 EXPOSE 3000
@@ -21,7 +24,7 @@ CMD ["sh", "-c", "rm -f .astro/dev.json && exec npm run dev"]
 
 FROM deps AS build
 COPY . .
-RUN npm run build && npm prune --omit=dev
+RUN npm run build && {{pm_prune}}
 
 FROM base AS prod
 ENV NODE_ENV=production HOST=0.0.0.0 PORT=3000

package/templates/frontend-astro/astro.config.mjs

@@ -1,5 +1,6 @@
 // @ts-check
 import node from "@astrojs/node";
+import { CAPTCHA_CSP, CAPTCHA_STYLE_HASH } from "@django-stack/utils";
 import { defineConfig } from "astro/config";
 
 // The Django backend: the frontend container reaches it on the Compose network.
@@ -15,14 +16,24 @@ export default defineConfig({
   server: { host: true, port: 3000 },
   // A Content-Security-Policy on every page: scripts and styles only from
   // this site, with hashes for the ones Astro inlines. src/middleware.ts adds
-  // the origin of the media files.
+  // the origin of the media files. CAPTCHA_CSP allows the captcha widget of
+  // the contact form: its solver, its style and its workers.
   security: {
     csp: {
-      directives: ["default-src 'self'", "base-uri 'self'", "form-action 'self'", "object-src 'none'"],
+      directives: [
+        "default-src 'self'",
+        "base-uri 'self'",
+        "form-action 'self'",
+        "object-src 'none'",
+        `worker-src ${CAPTCHA_CSP["worker-src"].join(" ")}`,
+      ],
       // Scripts from this site, such as the analytics tracker at /_a/script.js.
-      scriptDirective: { resources: ["'self'"] },
-      // Inline style attributes, such as the focal point of an image.
-      styleDirective: { resources: ["'self'", { resource: "'unsafe-inline'", kind: "attribute" }] },
+      scriptDirective: { resources: ["'self'", ...CAPTCHA_CSP["script-src"]] },
+      styleDirective: {
+        // Inline style attributes, such as the focal point of an image.
+        resources: ["'self'", { resource: "'unsafe-inline'", kind: "attribute" }],
+        hashes: [/** @type {`sha256-${string}`} */ (CAPTCHA_STYLE_HASH.replaceAll("'", ""))],
+      },
     },
   },
   vite: {

package/templates/frontend-astro/package.json

@@ -16,7 +16,7 @@
     "@astrojs/node": "^11.1.9",
     "@astrojs/rss": "^4.0.19",
     "@django-headless/client": "^1.1.1",
-    "@django-stack/utils": "^0.8.1",
+    "@django-stack/utils": "^0.10.0",
     "astro": "^7.4.5"
   },
   "devDependencies": {

package/templates/frontend-astro/pnpm-workspace.yaml

@@ -0,0 +1,17 @@
+# pnpm's settings for the frontend (pnpm 11 and later).
+
+# Resolve only versions published at least a day ago, so a compromised
+# release is usually caught before it reaches you. DjangoStack's own
+# packages are exempt, so a project made on a release day installs.
+minimumReleaseAge: 1440
+minimumReleaseAgeExclude:
+  - "@django-stack/*"
+
+# Which dependencies may run install scripts; pnpm refuses others.
+allowBuilds: {}
+
+# The peer ranges of @astrojs/check allow a 2.0 beta of @emnapi, which pnpm
+# picks and which crashes `astro check`. Keep @emnapi on 1.x, as npm does.
+overrides:
+  "@emnapi/core": ^1.11.3
+  "@emnapi/runtime": ^1.11.3

package/templates/frontend-astro/src/components/ContactForm.astro

@@ -1,20 +1,29 @@
 ---
 /**
  * The contact form. It posts to Django's public create route for form
- * submissions (PUBLIC_CREATE in backend/config/settings.py), which is
- * rate limited per IP address. Submissions appear in the admin.
+ * submissions (PUBLIC_CREATE in backend/config/settings.py), which is rate
+ * limited per IP address and, unless CAPTCHA=off, needs the token of the
+ * captcha widget. Submissions appear in the admin.
  */
+import { CAPTCHA_ATTRIBUTES, captchaEnabled } from "@django-stack/utils";
+
+const captcha = captchaEnabled(process.env.CAPTCHA);
 ---
 
 <form class="contact-form" data-endpoint="/api/content.formsubmission">
   <label>Name <input name="name" required maxlength="200" autocomplete="name" /></label>
   <label>Email <input name="email" type="email" required autocomplete="email" /></label>
   <label>Message <textarea name="message" required maxlength="5000" rows="6"></textarea></label>
+  {captcha && <cap-widget {...CAPTCHA_ATTRIBUTES}></cap-widget>}
   <button class="button" type="submit">Send</button>
   <p class="status" role="status" aria-live="polite"></p>
 </form>
 
 <script>
+  import { loadCaptcha, resetCaptcha } from "@django-stack/utils";
+
+  if (document.querySelector("form.contact-form cap-widget")) void loadCaptcha();
+
   for (const form of document.querySelectorAll<HTMLFormElement>("form.contact-form")) {
     form.addEventListener("submit", async (event) => {
       event.preventDefault();
@@ -29,8 +38,15 @@
           body: JSON.stringify(Object.fromEntries(new FormData(form))),
         });
         if (response.status === 429) throw new Error("Too many messages; try again in a minute.");
-        if (!response.ok) throw new Error("The message could not be sent. Check the fields and try again.");
+        if (!response.ok) {
+          const errors = await response.json().catch(() => ({}));
+          // A token is valid once, so the widget verifies again.
+          resetCaptcha(form);
+          if (errors.captcha) throw new Error("Verify that you are human, then send the message again.");
+          throw new Error("The message could not be sent. Check the fields and try again.");
+        }
         form.reset();
+        resetCaptcha(form);
         status.textContent = "Thank you, your message was sent.";
       } catch (error) {
         status.textContent = error instanceof Error ? error.message : String(error);

package/templates/frontend-astro/src/middleware.ts

@@ -1,4 +1,5 @@
 import { defineMiddleware } from "astro:middleware";
+import { reportError } from "@django-stack/utils";
 import { getContent, PREVIEW_COOKIE } from "./lib/api";
 import { getCached, store } from "./lib/cache";
 
@@ -38,7 +39,14 @@ export const onRequest = defineMiddleware(async (context, next) => {
     if (hit) return hit;
   }
 
-  let response = await next();
+  let response: Response;
+  try {
+    response = await next();
+  } catch (error) {
+    // Sent to Sentry with ERRORS=sentry; Astro logs it and renders the error page.
+    await reportError(error, { request });
+    throw error;
+  }
 
   // Redirects that editors manage in the admin, for paths that do not exist.
   if (response.status === 404 && request.method === "GET") {

package/templates/frontend-next/AGENTS.md

@@ -12,7 +12,7 @@ src/app/                 routes: /, /[...path], /blog, /blog/[slug], /category/[
 src/app/layout.tsx       the page shell: menus, footer, preview banner
 src/components/          the post list, the menu links and the contact form
 src/lib/api.ts           getContent(): content helpers with the read-only key, drafts in preview; pageMetadata()
-src/lib/headless.ts      generated API types; do not edit, run `npm run generate:types`
+src/lib/headless.ts      generated API types; do not edit, run `{{pm_run}} generate:types`
 src/proxy.ts             Content-Security-Policy with a nonce, security headers, the dev proxy to Django
 next.config.ts           standalone output, the in-memory data cache
 ```
@@ -55,5 +55,5 @@ Run them in the `frontend` container (`docker compose exec frontend <command>`):
 
 | Task | Command |
 |------|---------|
-| Type-check | `npm run check` |
-| Test | `npm test` |
+| Type-check | `{{pm_run}} check` |
+| Test | `{{pm_run}} test` |

package/templates/frontend-next/Dockerfile

@@ -7,10 +7,13 @@ WORKDIR /app
 ENV NEXT_TELEMETRY_DISABLED=1
 
 FROM base AS deps
-COPY package.json package-lock.json* ./
+{{pm_setup}}
+COPY {{pm_manifests}} ./
 COPY vendor/ vendor/
-RUN --mount=type=cache,target=/root/.npm \
-    if [ -f package-lock.json ]; then npm ci; else npm install; fi
+# No BuildKit cache mounts: Railway rejects them, and the layer is cached anyway.
+RUN {{pm_install}}
+# The package manager only installs: npm, which comes with Node.js, runs
+# the scripts of package.json below.
 
 FROM deps AS dev
 EXPOSE 3000

package/templates/frontend-next/package.json

@@ -13,9 +13,9 @@
   },
   "dependencies": {
     "@django-headless/client": "^1.1.1",
-    "@django-stack/next": "^0.8.1",
-    "@django-stack/react": "^0.8.1",
-    "@django-stack/utils": "^0.8.1",
+    "@django-stack/next": "^0.10.0",
+    "@django-stack/react": "^0.10.0",
+    "@django-stack/utils": "^0.10.0",
     "next": "^16.4.4",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",

package/templates/frontend-next/pnpm-workspace.yaml

@@ -0,0 +1,11 @@
+# pnpm's settings for the frontend (pnpm 11 and later).
+
+# Resolve only versions published at least a day ago, so a compromised
+# release is usually caught before it reaches you. DjangoStack's own
+# packages are exempt, so a project made on a release day installs.
+minimumReleaseAge: 1440
+minimumReleaseAgeExclude:
+  - "@django-stack/*"
+
+# Which dependencies may run install scripts; pnpm refuses others.
+allowBuilds: {}

package/templates/frontend-next/src/app/[...path]/page.tsx

@@ -1,4 +1,5 @@
 import { Blocks } from "@django-stack/react";
+import { captchaEnabled } from "@django-stack/utils";
 import type { Metadata } from "next";
 import { ContactForm } from "@/components/ContactForm";
 import { getContent, notFoundOrRedirect, pageMetadata } from "@/lib/api";
@@ -22,7 +23,7 @@ export default async function ContentPage({ params }: Props) {
     <article className="narrow">
       <h1>{page.title}</h1>
       <Blocks blocks={page.body} />
-      {page.path === "contact" ? <ContactForm /> : null}
+      {page.path === "contact" ? <ContactForm captcha={captchaEnabled(process.env.CAPTCHA)} /> : null}
     </article>
   );
 }

package/templates/frontend-next/src/components/ContactForm.tsx

@@ -3,11 +3,14 @@
 /**
  * The contact form. It posts to Django's public create route for form
  * submissions (PUBLIC_CREATE in backend/config/settings.py), which is rate
- * limited per IP address. Submissions appear in the admin.
+ * limited per IP address and, unless CAPTCHA=off, needs the token of the
+ * captcha widget. Submissions appear in the admin.
  */
+import { Captcha } from "@django-stack/react";
+import { resetCaptcha } from "@django-stack/utils";
 import { type FormEvent, useState } from "react";
 
-export function ContactForm() {
+export function ContactForm({ captcha = true }: { captcha?: boolean }) {
   const [status, setStatus] = useState("");
   const [sending, setSending] = useState(false);
 
@@ -23,8 +26,15 @@ export function ContactForm() {
         body: JSON.stringify(Object.fromEntries(new FormData(form))),
       });
       if (response.status === 429) throw new Error("Too many messages; try again in a minute.");
-      if (!response.ok) throw new Error("The message could not be sent. Check the fields and try again.");
+      if (!response.ok) {
+        const errors = await response.json().catch(() => ({}));
+        // A token is valid once, so the widget verifies again.
+        resetCaptcha(form);
+        if (errors.captcha) throw new Error("Verify that you are human, then send the message again.");
+        throw new Error("The message could not be sent. Check the fields and try again.");
+      }
       form.reset();
+      resetCaptcha(form);
       setStatus("Thank you, your message was sent.");
     } catch (error) {
       setStatus(error instanceof Error ? error.message : String(error));
@@ -44,6 +54,7 @@ export function ContactForm() {
       <label>
         Message <textarea name="message" required maxLength={5000} rows={6} />
       </label>
+      {captcha ? <Captcha /> : null}
       <button className="button" type="submit" disabled={sending}>
         Send
       </button>

package/templates/frontend-next/src/instrumentation.ts

@@ -0,0 +1,12 @@
+import { reportError } from "@django-stack/utils";
+import type { Instrumentation } from "next";
+
+/** Server errors go to Sentry with ERRORS=sentry; Next.js logs them as well. */
+export const onRequestError: Instrumentation.onRequestError = async (error, request) => {
+  const id = request.headers["x-request-id"];
+  await reportError(error, {
+    method: request.method,
+    path: request.path,
+    requestId: Array.isArray(id) ? id[0] : id,
+  });
+};

package/templates/frontend-next/src/proxy.ts

@@ -1,4 +1,5 @@
 import { contentSecurityPolicy, mediaOrigins, PREVIEW_COOKIE, SECURITY_HEADERS } from "@django-stack/next";
+import { captchaEnabled } from "@django-stack/utils";
 import { type NextRequest, NextResponse } from "next/server";
 
 const dev = process.env.NODE_ENV === "development";
@@ -11,6 +12,8 @@ const backend = process.env.BACKEND_INTERNAL_URL ?? "http://localhost:8000";
 const TRACKER_PATHS = /^\/_a\/(script\.js|api\/send)$/;
 const umami = process.env.UMAMI_URL || "http://umami:3000";
 const media = mediaOrigins();
+// The captcha widget of the contact form, unless CAPTCHA=off.
+const captcha = captchaEnabled(process.env.CAPTCHA);
 
 export function proxy(request: NextRequest) {
   const { pathname, search } = request.nextUrl;
@@ -23,7 +26,7 @@ export function proxy(request: NextRequest) {
 
   // A fresh nonce for every page: Next adds it to the scripts it renders.
   const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
-  const policy = contentSecurityPolicy({ nonce, mediaOrigins: media, dev });
+  const policy = contentSecurityPolicy({ nonce, mediaOrigins: media, dev, captcha });
   const headers = new Headers(request.headers);
   headers.set("Content-Security-Policy", policy);
 

package/templates/frontend-nuxt/AGENTS.md

@@ -13,7 +13,7 @@ src/pages/                   routes: /, /[...path], /blog, /blog/[slug], /catego
 src/layouts/default.vue      the page shell: menus, footer, preview banner
 src/components/              the post list and the contact form
 src/composables/             useContent() loads from server/routes/_content and follows redirects; usePageSeo() sets the SEO tags
-src/lib/headless.ts          generated API types; do not edit, run `npm run generate:types`
+src/lib/headless.ts          generated API types; do not edit, run `{{pm_run}} generate:types`
 server/routes/_content/      the content the pages load, cached in memory
 server/routes/               sitemap.xml, rss.xml, robots.txt, /preview, /revalidate
 server/utils/content.ts      getContent(): content helpers with the read-only key, drafts in preview
@@ -60,5 +60,5 @@ Run them in the `frontend` container (`docker compose exec frontend <command>`):
 
 | Task | Command |
 |------|---------|
-| Type-check | `npm run check` |
-| Test | `npm test` |
+| Type-check | `{{pm_run}} check` |
+| Test | `{{pm_run}} test` |

package/templates/frontend-nuxt/Dockerfile

@@ -7,10 +7,13 @@ WORKDIR /app
 ENV NUXT_TELEMETRY_DISABLED=1
 
 FROM base AS deps
-COPY package.json package-lock.json* ./
+{{pm_setup}}
+COPY {{pm_manifests}} ./
 COPY vendor/ vendor/
-RUN --mount=type=cache,target=/root/.npm \
-    if [ -f package-lock.json ]; then npm ci --ignore-scripts; else npm install --ignore-scripts; fi
+# No BuildKit cache mounts: Railway rejects them, and the layer is cached anyway.
+RUN {{pm_install_no_scripts}}
+# The package manager only installs: npm, which comes with Node.js, runs
+# the scripts of package.json below.
 
 FROM deps AS dev
 EXPOSE 3000

package/templates/frontend-nuxt/nuxt.config.ts

@@ -1,3 +1,5 @@
+import { CAPTCHA_CSP } from "@django-stack/utils";
+
 // The Django backend: the frontend container reaches it on the Compose network.
 const backend = process.env.BACKEND_INTERNAL_URL ?? "http://localhost:8000";
 // Umami, for page analytics: only its tracker and page views, under /_a/.
@@ -42,7 +44,8 @@ export default defineNuxtConfig({
   // Security headers, with a Content-Security-Policy on every page in
   // production: scripts and styles only from this site, with a nonce for
   // the ones Nuxt inlines. server/plugins/media-origins.ts adds the origin
-  // of the media files.
+  // of the media files. CAPTCHA_CSP allows the captcha widget of the contact
+  // form: its solver, its style and its workers.
   security: {
     nonce: true,
     rateLimiter: false,
@@ -52,8 +55,9 @@ export default defineNuxtConfig({
         process.env.NODE_ENV === "production"
           ? {
               "default-src": ["'self'"],
-              "script-src": ["'self'", "'nonce-{{nonce}}'", "'strict-dynamic'"],
-              "style-src": ["'self'", "'nonce-{{nonce}}'"],
+              "script-src": ["'self'", "'nonce-{{nonce}}'", "'strict-dynamic'", ...CAPTCHA_CSP["script-src"]],
+              "style-src": ["'self'", "'nonce-{{nonce}}'", ...CAPTCHA_CSP["style-src"]],
+              "worker-src": [...CAPTCHA_CSP["worker-src"]],
               // Inline style attributes, such as the focal point of an image.
               "style-src-attr": ["'unsafe-inline'"],
               "img-src": ["'self'", "data:"],

package/templates/frontend-nuxt/package.json

@@ -15,8 +15,8 @@
   },
   "dependencies": {
     "@django-headless/client": "^1.1.1",
-    "@django-stack/utils": "^0.8.1",
-    "@django-stack/vue": "^0.8.1",
+    "@django-stack/utils": "^0.10.0",
+    "@django-stack/vue": "^0.10.0",
     "nuxt": "^4.6.3",
     "nuxt-security": "^2.7.0",
     "vue": "^3.5.44",

package/templates/frontend-nuxt/pnpm-workspace.yaml

@@ -0,0 +1,13 @@
+# pnpm's settings for the frontend (pnpm 11 and later).
+
+# Resolve only versions published at least a day ago, so a compromised
+# release is usually caught before it reaches you. DjangoStack's own
+# packages are exempt, so a project made on a release day installs.
+minimumReleaseAge: 1440
+minimumReleaseAgeExclude:
+  - "@django-stack/*"
+
+# Which dependencies may run install scripts; pnpm refuses others.
+allowBuilds:
+  # Its install script checks its binary.
+  esbuild: true