pulumi-django-azure 1.0.33__py3-none-any.whl → 1.0.35__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.


This version of pulumi-django-azure might be problematic. Click here for more details.

@@ -2,7 +2,9 @@ import base64
2
2
  import json
3
3
  import logging
4
4
  import os
5
+ import time
5
6
  from dataclasses import dataclass
7
+ from enum import Enum
6
8
  from subprocess import check_output
7
9
 
8
10
  from azure.identity import DefaultAzureCredential
@@ -15,6 +17,9 @@ logger = logging.getLogger("pulumi_django_azure.azure_helper")
15
17
  # Azure credentials
16
18
  AZURE_CREDENTIAL = DefaultAzureCredential()
17
19
 
20
+ # Buffer for token expiration (5 minutes)
21
+ TOKEN_EXPIRATION_BUFFER = 300
22
+
18
23
  # Get the local IP addresses of the machine (only when runnig on Azure)
19
24
  if os.environ.get("IS_AZURE_ENVIRONMENT"):
20
25
  LOCAL_IP_ADDRESSES = check_output(["hostname", "--all-ip-addresses"]).decode("utf-8").strip().split(" ")
@@ -22,17 +27,44 @@ else:
22
27
  LOCAL_IP_ADDRESSES = []
23
28
 
24
29
 
25
- def get_db_password() -> str:
30
+ class TokenType(Enum):
31
+ DATABASE = "https://ossrdbms-aad.database.windows.net/.default"
32
+ REDIS = "https://redis.azure.com/.default"
33
+
34
+
35
+ def _get_azure_token(type: TokenType) -> str:
26
36
  """
27
- Get a valid password for the database.
37
+ Get a valid token for the given scope.
28
38
  """
29
- token = AZURE_CREDENTIAL.get_token("https://ossrdbms-aad.database.windows.net/.default")
39
+ global AZURE_CREDENTIAL
40
+
41
+ token = AZURE_CREDENTIAL.get_token(type.value)
42
+
43
+ if token.expires_on < time.time() + TOKEN_EXPIRATION_BUFFER:
44
+ # We received an expired or nearly expired token from the API. Force a new token by creating a new instance of the credential.
45
+ logger.debug(
46
+ "Received an expired or nearly expired %s token (current time: %s, token expiration: %s)."
47
+ "Creating a new instance of the credential.",
48
+ type.name,
49
+ time.time(),
50
+ token.expires_on,
51
+ )
52
+
53
+ AZURE_CREDENTIAL = DefaultAzureCredential()
54
+ token = AZURE_CREDENTIAL.get_token(type.value)
30
55
 
31
- logger.debug("New database token: %s", token)
56
+ logger.debug("New %s token (try 2): %s", type.name, token)
32
57
 
33
58
  return token.token
34
59
 
35
60
 
61
+ def get_db_password() -> str:
62
+ """
63
+ Get a valid password for the database.
64
+ """
65
+ return _get_azure_token(TokenType.DATABASE)
66
+
67
+
36
68
  @dataclass
37
69
  class RedisCredentials:
38
70
  username: str
@@ -43,9 +75,7 @@ def get_redis_credentials() -> RedisCredentials:
43
75
  """
44
76
  Get valid credentials for the Redis cache.
45
77
  """
46
- token = AZURE_CREDENTIAL.get_token("https://redis.azure.com/.default")
47
-
48
- logger.debug("New Redis token: %s", token)
78
+ token = _get_azure_token(TokenType.REDIS)
49
79
 
50
80
  return RedisCredentials(_extract_username_from_token(token), token)
51
81
 
@@ -4,6 +4,8 @@ import pulumi
4
4
  import pulumi_azure_native as azure
5
5
  import pulumi_random
6
6
 
7
+ REDIS_IMAGE = "redis:8.2"
8
+
7
9
 
8
10
  class HostDefinition:
9
11
  """
@@ -71,8 +73,6 @@ class DjangoDeployment(pulumi.ComponentResource):
71
73
  pgsql_parameters: dict[str, str] | None = None,
72
74
  pgadmin_access_ip: Sequence[str] | None = None,
73
75
  pgadmin_dns_zone: azure.dns.Zone | None = None,
74
- cache_ip_prefix: str | None = None,
75
- cache_sku: azure.redis.SkuArgs | None = None,
76
76
  cdn_host: HostDefinition | None = None,
77
77
  opts=None,
78
78
  ):
@@ -92,8 +92,6 @@ class DjangoDeployment(pulumi.ComponentResource):
92
92
  :param pgsql_parameters: The parameters to set on the PostgreSQL server. (optional)
93
93
  :param pgadmin_access_ip: The IP addresses to allow access to pgAdmin. If empty, all IP addresses are allowed.
94
94
  :param pgadmin_dns_zone: The Azure DNS zone to a pgadmin DNS record in. (optional)
95
- :param cache_ip_prefix: The IP prefix for the cache subnet. (optional)
96
- :param cache_sku: The SKU for the cache. (optional)
97
95
  :param cdn_host: A custom CDN host name. (optional)
98
96
  :param opts: The resource options
99
97
  """
@@ -115,12 +113,6 @@ class DjangoDeployment(pulumi.ComponentResource):
115
113
  # PostgreSQL resources
116
114
  self._create_database(sku=pgsql_sku, ip_prefix=pgsql_ip_prefix, parameters=pgsql_parameters)
117
115
 
118
- # Cache resources
119
- if cache_ip_prefix and cache_sku:
120
- self._create_cache(sku=cache_sku, ip_prefix=cache_ip_prefix)
121
- else:
122
- self._cache = None
123
-
124
116
  # Subnet for the apps
125
117
  self._app_subnet = self._create_subnet(
126
118
  name="app-service",
@@ -325,91 +317,6 @@ class DjangoDeployment(pulumi.ComponentResource):
325
317
 
326
318
  pulumi.export("pgsql_host", self._pgsql.fully_qualified_domain_name)
327
319
 
328
- def _create_cache(self, sku: azure.redis.SkuArgs, ip_prefix: str):
329
- # Create a Redis cache
330
- self._cache = azure.redis.Redis(
331
- f"cache-{self._name}",
332
- resource_group_name=self._rg,
333
- sku=sku,
334
- enable_non_ssl_port=False,
335
- public_network_access=azure.redis.PublicNetworkAccess.DISABLED,
336
- # Disable access key authentication...
337
- disable_access_key_authentication=True,
338
- # ... and enable Entra ID authentication.
339
- redis_configuration=azure.redis.RedisCommonPropertiesRedisConfigurationArgs(
340
- aad_enabled="true",
341
- ),
342
- )
343
-
344
- # Create an access policy that gives us access to the cache
345
- self._cache_access_policy = azure.redis.AccessPolicy(
346
- f"cache-access-policy-{self._name}",
347
- resource_group_name=self._rg,
348
- cache_name=self._cache.name,
349
- # Same as the built in Data Contributor policy + flushdb permissions
350
- permissions="+@all -@dangerous +flushdb +cluster|info +cluster|nodes +cluster|slots allkeys",
351
- )
352
-
353
- # Allocate a subnet for the cache
354
- subnet = self._create_subnet(
355
- name="cache",
356
- prefix=ip_prefix,
357
- )
358
-
359
- # Create a private DNS zone for the cache
360
- dns = azure.privatedns.PrivateZone(
361
- f"dns-cache-{self._name}",
362
- resource_group_name=self._rg,
363
- location="global",
364
- private_zone_name="privatelink.redis.cache.windows.net",
365
- )
366
-
367
- # Link the private DNS zone to the VNet in order to make resolving work
368
- azure.privatedns.VirtualNetworkLink(
369
- f"vnet-link-cache-{self._name}",
370
- resource_group_name=self._rg,
371
- location="global",
372
- private_zone_name=dns.name,
373
- virtual_network=azure.network.SubResourceArgs(id=self._vnet.id),
374
- registration_enabled=True,
375
- )
376
-
377
- # Create a private endpoint for the cache
378
- endpoint = azure.network.PrivateEndpoint(
379
- f"private-endpoint-cache-{self._name}",
380
- resource_group_name=self._rg,
381
- subnet=azure.network.SubnetArgs(id=subnet.id),
382
- custom_network_interface_name=f"nic-cache-{self._name}",
383
- private_link_service_connections=[
384
- azure.network.PrivateLinkServiceConnectionArgs(
385
- name=f"pls-cache-{self._name}",
386
- private_link_service_id=self._cache.id,
387
- group_ids=["redisCache"],
388
- )
389
- ],
390
- )
391
-
392
- # Get the private IP address of the endpoint NIC
393
- ip = endpoint.network_interfaces.apply(
394
- lambda nics: azure.network.get_network_interface(
395
- network_interface_name=nics[0].id.split("/")[-1],
396
- resource_group_name=self._rg,
397
- )
398
- .ip_configurations[0]
399
- .private_ip_address
400
- )
401
-
402
- # Create a DNS record for the cache
403
- azure.privatedns.PrivateRecordSet(
404
- f"dns-a-cache-{self._name}",
405
- resource_group_name=self._rg,
406
- private_zone_name=dns.name,
407
- relative_record_set_name=self._cache.name,
408
- record_type="A",
409
- ttl=300,
410
- a_records=[azure.privatedns.ARecordArgs(ipv4_address=ip)],
411
- )
412
-
413
320
  def _create_subnet(
414
321
  self,
415
322
  name,
@@ -866,7 +773,7 @@ class DjangoDeployment(pulumi.ComponentResource):
866
773
  comms_domains: list[HostDefinition] | None = None,
867
774
  dedicated_app_service_sku: azure.web.SkuDescriptionArgs | None = None,
868
775
  vault_administrators: list[str] | None = None,
869
- cache_db: int | None = None,
776
+ redis_cache: bool = True,
870
777
  startup_timeout: int = 300,
871
778
  ) -> azure.web.WebApp:
872
779
  """
@@ -887,7 +794,7 @@ class DjangoDeployment(pulumi.ComponentResource):
887
794
  :param comms_domains: The list of custom domains for the E-mail Communication Services (optional).
888
795
  :param dedicated_app_service_sku: The SKU for the dedicated App Service Plan (optional).
889
796
  :param vault_administrators: The principal IDs of the vault administrators (optional).
890
- :param cache_db: The index of the cache database to use (optional).
797
+ :param redis_cache: Whether to create a Redis sidecar container.
891
798
  :param startup_timeout: The startup timeout for the App Service (default is 300 seconds).
892
799
  """
893
800
 
@@ -917,6 +824,10 @@ class DjangoDeployment(pulumi.ComponentResource):
917
824
  container_name=f"{name}-static",
918
825
  )
919
826
 
827
+ # Redis cache environment variable
828
+ if redis_cache:
829
+ environment_variables["REDIS_SIDECAR"] = "true"
830
+
920
831
  # Communication Services (optional)
921
832
  if comms_data_location:
922
833
  if not comms_domains:
@@ -937,12 +848,6 @@ class DjangoDeployment(pulumi.ComponentResource):
937
848
  s = self._add_webapp_secret(vault, env_name, config_name, f"{name}-{self._name}")
938
849
  environment_variables[f"{env_name}_SECRET_NAME"] = s.name
939
850
 
940
- # Cache (we need to check explicitly if it is not None because the db could also be 0)
941
- if self._cache and cache_db is not None:
942
- environment_variables["REDIS_CACHE_HOST"] = self._cache.host_name
943
- environment_variables["REDIS_CACHE_PORT"] = self._cache.ssl_port.apply(lambda port: str(port))
944
- environment_variables["REDIS_CACHE_DB"] = str(cache_db)
945
-
946
851
  # Create a Django Secret Key (random)
947
852
  secret_key = pulumi_random.RandomString(f"django-secret-{name}-{self._name}", length=50)
948
853
 
@@ -1023,6 +928,18 @@ class DjangoDeployment(pulumi.ComponentResource):
1023
928
  ),
1024
929
  )
1025
930
 
931
+ # Redis cache
932
+ if redis_cache:
933
+ azure.web.WebAppSiteContainer(
934
+ f"redis-cache-{name}-{self._name}",
935
+ resource_group_name=self._rg,
936
+ name=app.name,
937
+ is_main=False,
938
+ container_name="redis-cache",
939
+ image=REDIS_IMAGE,
940
+ target_port="6379",
941
+ )
942
+
1026
943
  # We need this to create the database role and grant permissions
1027
944
  principal_id = app.identity.apply(lambda identity: identity.principal_id)
1028
945
  pulumi.export(f"{name}_site_principal_id", principal_id)
@@ -1148,18 +1065,6 @@ class DjangoDeployment(pulumi.ComponentResource):
1148
1065
  scope=self._storage_account.id,
1149
1066
  )
1150
1067
 
1151
- # Grant the app access to the cache if needed.
1152
- # We need to check explicitly if it is not None because the db could also be 0.
1153
- if self._cache and cache_db is not None:
1154
- azure.redis.AccessPolicyAssignment(
1155
- f"ra-{name}-cache",
1156
- resource_group_name=self._rg,
1157
- cache_name=self._cache.name,
1158
- object_id=principal_id,
1159
- object_id_alias=f"app-{name}-managed-identity",
1160
- access_policy_name=self._cache_access_policy.name,
1161
- )
1162
-
1163
1068
  # Grant the app to send e-mails
1164
1069
  if comms:
1165
1070
  comms_role = comms.id.apply(
@@ -0,0 +1,248 @@
1
+ """
2
+ Management command to test Redis connectivity and functionality.
3
+ """
4
+
5
+ import time
6
+
7
+ from django.conf import settings
8
+ from django.core.cache import cache
9
+ from django.core.management.base import BaseCommand, CommandError
10
+
11
+
12
+ class Command(BaseCommand):
13
+ help = "Test Redis connectivity and basic functionality"
14
+
15
+ def add_arguments(self, parser):
16
+ parser.add_argument(
17
+ "--detailed",
18
+ action="store_true",
19
+ help="Show detailed Redis information and run comprehensive tests",
20
+ )
21
+ parser.add_argument(
22
+ "--quiet",
23
+ action="store_true",
24
+ help="Only show errors and final status",
25
+ )
26
+
27
+ def handle(self, *args, **options):
28
+ verbosity = 0 if options["quiet"] else (2 if options["detailed"] else 1)
29
+
30
+ if verbosity >= 1:
31
+ self.stdout.write("Testing Redis connectivity...")
32
+ self.stdout.write("-" * 50)
33
+
34
+ try:
35
+ # Test basic connectivity
36
+ self._test_basic_connectivity(verbosity)
37
+
38
+ # Test basic cache operations
39
+ self._test_cache_operations(verbosity)
40
+
41
+ # If detailed mode, run additional tests
42
+ if options["detailed"]:
43
+ self._test_detailed_operations(verbosity)
44
+ self._show_cache_info(verbosity)
45
+
46
+ if verbosity >= 1:
47
+ self.stdout.write(self.style.SUCCESS("✓ All Redis tests passed successfully!"))
48
+
49
+ except Exception as e:
50
+ if verbosity >= 1:
51
+ self.stdout.write(self.style.ERROR(f"✗ Redis test failed: {str(e)}"))
52
+ raise CommandError(f"Redis connectivity test failed: {str(e)}") from e
53
+
54
+ def _test_basic_connectivity(self, verbosity):
55
+ """Test basic Redis connectivity."""
56
+ if verbosity >= 2:
57
+ self.stdout.write("Testing basic connectivity...")
58
+
59
+ try:
60
+ # Try to set and get a simple value
61
+ cache.set("redis_test_key", "test_value", 30)
62
+ value = cache.get("redis_test_key")
63
+
64
+ if value != "test_value":
65
+ raise Exception("Failed to retrieve test value from cache")
66
+
67
+ # Clean up
68
+ cache.delete("redis_test_key")
69
+
70
+ if verbosity >= 2:
71
+ self.stdout.write(self.style.SUCCESS(" ✓ Basic connectivity test passed"))
72
+
73
+ except Exception as e:
74
+ raise Exception(f"Basic connectivity test failed: {str(e)}") from e
75
+
76
+ def _test_cache_operations(self, verbosity):
77
+ """Test various cache operations."""
78
+ if verbosity >= 2:
79
+ self.stdout.write("Testing cache operations...")
80
+
81
+ test_data = {
82
+ "string_test": "Hello Redis!",
83
+ "number_test": 42,
84
+ "dict_test": {"key": "value", "nested": {"data": True}},
85
+ "list_test": [1, 2, 3, "four", 5.0],
86
+ }
87
+
88
+ try:
89
+ # Test different data types
90
+ for key, value in test_data.items():
91
+ cache.set(f"test_{key}", value, 60)
92
+ retrieved_value = cache.get(f"test_{key}")
93
+
94
+ if retrieved_value != value:
95
+ raise Exception(f"Data mismatch for {key}: expected {value}, got {retrieved_value}")
96
+
97
+ if verbosity >= 2:
98
+ self.stdout.write(f" ✓ {key}: {type(value).__name__} data test passed")
99
+
100
+ # Test cache.get_or_set
101
+ default_value = "default_from_function"
102
+ result = cache.get_or_set("test_get_or_set", default_value, 60)
103
+ if result != default_value:
104
+ raise Exception("get_or_set test failed")
105
+
106
+ if verbosity >= 2:
107
+ self.stdout.write(" ✓ get_or_set operation test passed")
108
+
109
+ # Test cache.add (should fail on existing key)
110
+ if cache.add("test_string_test", "should_not_override"):
111
+ raise Exception("add() should have failed on existing key")
112
+
113
+ if verbosity >= 2:
114
+ self.stdout.write(" ✓ add operation test passed")
115
+
116
+ # Test cache expiration
117
+ cache.set("test_expiration", "will_expire", 1)
118
+ time.sleep(1.1) # Wait for expiration
119
+ expired_value = cache.get("test_expiration")
120
+ if expired_value is not None:
121
+ raise Exception("Cache expiration test failed - value should have expired")
122
+
123
+ if verbosity >= 2:
124
+ self.stdout.write(" ✓ Cache expiration test passed")
125
+
126
+ # Clean up test keys
127
+ for key in test_data:
128
+ cache.delete(f"test_{key}")
129
+ cache.delete("test_get_or_set")
130
+
131
+ if verbosity >= 2:
132
+ self.stdout.write(self.style.SUCCESS(" ✓ All cache operations tests passed"))
133
+
134
+ except Exception as e:
135
+ raise Exception(f"Cache operations test failed: {str(e)}") from e
136
+
137
+ def _test_detailed_operations(self, verbosity):
138
+ """Run detailed Redis operations tests."""
139
+ if verbosity >= 2:
140
+ self.stdout.write("Running detailed operations...")
141
+
142
+ try:
143
+ # Test cache.get_many and set_many
144
+ test_data = {
145
+ "bulk_key_1": "value_1",
146
+ "bulk_key_2": "value_2",
147
+ "bulk_key_3": "value_3",
148
+ }
149
+
150
+ cache.set_many(test_data, 60)
151
+ retrieved_data = cache.get_many(test_data.keys())
152
+
153
+ for key, expected_value in test_data.items():
154
+ if retrieved_data.get(key) != expected_value:
155
+ raise Exception(f"Bulk operation failed for key {key}")
156
+
157
+ if verbosity >= 2:
158
+ self.stdout.write(" ✓ Bulk operations (set_many/get_many) test passed")
159
+
160
+ # Test cache.delete_many
161
+ cache.delete_many(test_data.keys())
162
+ remaining_data = cache.get_many(test_data.keys())
163
+ if any(remaining_data.values()):
164
+ raise Exception("delete_many operation failed")
165
+
166
+ if verbosity >= 2:
167
+ self.stdout.write(" ✓ Bulk delete (delete_many) test passed")
168
+
169
+ # Test cache versioning if supported
170
+ try:
171
+ cache.set("version_test", "version_1", 60, version=1)
172
+ cache.set("version_test", "version_2", 60, version=2)
173
+
174
+ v1_value = cache.get("version_test", version=1)
175
+ v2_value = cache.get("version_test", version=2)
176
+
177
+ if v1_value == "version_1" and v2_value == "version_2":
178
+ if verbosity >= 2:
179
+ self.stdout.write(" ✓ Cache versioning test passed")
180
+ else:
181
+ if verbosity >= 2:
182
+ self.stdout.write(" ! Cache versioning not supported or failed")
183
+
184
+ cache.delete("version_test", version=1)
185
+ cache.delete("version_test", version=2)
186
+
187
+ except Exception:
188
+ if verbosity >= 2:
189
+ self.stdout.write(" ! Cache versioning not supported")
190
+
191
+ except Exception as e:
192
+ raise Exception(f"Detailed operations test failed: {str(e)}") from e
193
+
194
+ def _show_cache_info(self, verbosity):
195
+ """Show information about the cache configuration."""
196
+ if verbosity >= 2:
197
+ self.stdout.write("\nCache Configuration Information:")
198
+ self.stdout.write("-" * 35)
199
+
200
+ # Show cache backend information
201
+ cache_config = getattr(settings, "CACHES", {}).get("default", {})
202
+ backend = cache_config.get("BACKEND", "Unknown")
203
+ location = cache_config.get("LOCATION", "Not specified")
204
+
205
+ self.stdout.write(f"Backend: {backend}")
206
+ self.stdout.write(f"Location: {location}")
207
+
208
+ # Show cache options if any
209
+ options = cache_config.get("OPTIONS", {})
210
+ if options:
211
+ self.stdout.write("Options:")
212
+ for key, value in options.items():
213
+ # Don't show sensitive information like passwords
214
+ if "password" in key.lower() or "secret" in key.lower():
215
+ value = "***hidden***"
216
+ self.stdout.write(f" {key}: {value}")
217
+
218
+ # Try to get cache stats if available
219
+ try:
220
+ if hasattr(cache, "_cache") and hasattr(cache._cache, "get_stats"):
221
+ stats = cache._cache.get_stats()
222
+ if stats:
223
+ self.stdout.write("\nCache Statistics:")
224
+ for stat_key, stat_value in stats.items():
225
+ self.stdout.write(f" {stat_key}: {stat_value}")
226
+ except Exception:
227
+ pass # Stats not available
228
+
229
+ # Test if we can determine Redis info
230
+ try:
231
+ # Try to access Redis client directly if using django-redis
232
+ if hasattr(cache, "_cache") and hasattr(cache._cache, "_client"):
233
+ client = cache._cache._client
234
+ if hasattr(client, "connection_pool"):
235
+ pool = client.connection_pool
236
+ self.stdout.write("\nConnection Pool Info:")
237
+ self.stdout.write(f" Max connections: {getattr(pool, 'max_connections', 'Unknown')}")
238
+ self.stdout.write(f" Connection class: {getattr(pool, 'connection_class', 'Unknown')}")
239
+
240
+ connection_kwargs = getattr(pool, "connection_kwargs", {})
241
+ if connection_kwargs:
242
+ self.stdout.write(" Connection parameters:")
243
+ for key, value in connection_kwargs.items():
244
+ if "password" in key.lower():
245
+ value = "***hidden***"
246
+ self.stdout.write(f" {key}: {value}")
247
+ except Exception:
248
+ pass # Redis-specific info not available
@@ -1,14 +1,12 @@
1
1
  import logging
2
2
  import os
3
+ import signal
3
4
 
4
5
  from django.conf import settings
5
- from django.core.cache import cache
6
6
  from django.db import connection
7
- from django.db.utils import OperationalError
8
7
  from django.http import HttpResponse
9
- from django_redis import get_redis_connection
10
8
 
11
- from .azure_helper import get_db_password, get_redis_credentials
9
+ from .azure_helper import get_db_password
12
10
 
13
11
  logger = logging.getLogger("pulumi_django_azure.health_check")
14
12
 
@@ -18,9 +16,20 @@ class HealthCheckMiddleware:
18
16
  self.get_response = get_response
19
17
 
20
18
  def _self_heal(self):
21
- # Send HUP signal to gunicorn main thread,
22
- # which will trigger new workers to start.
23
- os.kill(os.getppid(), 1)
19
+ logger.warning("Self-healing by gracefully restarting Gunicorn.")
20
+
21
+ master_pid = os.getppid()
22
+
23
+ logger.debug("Master PID: %d", master_pid)
24
+
25
+ # https://docs.gunicorn.org/en/latest/signals.html
26
+
27
+ # Reload a new master with new workers,
28
+ # since the application is preloaded this is the only safe way for now.
29
+ os.kill(master_pid, signal.SIGUSR2)
30
+
31
+ # Gracefully shutdown the current workers
32
+ os.kill(master_pid, signal.SIGTERM)
24
33
 
25
34
  def __call__(self, request):
26
35
  if request.path == settings.HEALTH_CHECK_PATH:
@@ -43,41 +52,15 @@ class HealthCheckMiddleware:
43
52
  self._self_heal()
44
53
  return HttpResponse(status=503)
45
54
 
46
- # Update the Redis credentials if needed
47
- if settings.AZURE_REDIS_CREDENTIALS:
48
- try:
49
- current_redis_password = settings.CACHES["default"]["OPTIONS"]["PASSWORD"]
50
- redis_credentials = get_redis_credentials()
51
-
52
- if redis_credentials.password != current_redis_password:
53
- logger.debug("Redis password has changed, updating credentials")
54
-
55
- # Re-authenticate the Redis connection
56
- redis_connection = get_redis_connection("default")
57
- redis_connection.execute_command("AUTH", redis_credentials.username, redis_credentials.password)
58
-
59
- settings.CACHES["default"]["OPTIONS"]["PASSWORD"] = redis_credentials.password
60
- else:
61
- logger.debug("Redis password unchanged, keeping existing credentials")
62
- except Exception as e:
63
- logger.error("Failed to update Redis credentials: %s", str(e))
64
- self._self_heal()
65
- return HttpResponse(status=503)
66
-
67
55
  try:
68
56
  # Test the database connection
69
57
  connection.ensure_connection()
70
58
  logger.debug("Database connection check passed")
71
59
 
72
- # Test the Redis connection
73
- cache.set("health_check", "test")
74
- logger.debug("Redis connection check passed")
75
-
76
60
  return HttpResponse("OK")
77
61
 
78
62
  except Exception as e:
79
63
  logger.error("Health check failed with unexpected error: %s", str(e))
80
- logger.warning("Self-healing by gracefully restarting workers.")
81
64
  self._self_heal()
82
65
  return HttpResponse(status=503)
83
66
 
@@ -1,7 +1,7 @@
1
1
  import environ
2
2
  from azure.keyvault.secrets import SecretClient
3
3
 
4
- from .azure_helper import AZURE_CREDENTIAL, LOCAL_IP_ADDRESSES, get_db_password, get_redis_credentials, get_subscription
4
+ from .azure_helper import AZURE_CREDENTIAL, LOCAL_IP_ADDRESSES, get_db_password, get_subscription
5
5
 
6
6
  env = environ.Env()
7
7
 
@@ -104,7 +104,7 @@ if IS_AZURE_ENVIRONMENT:
104
104
  "disable_existing_loggers": False,
105
105
  "formatters": {
106
106
  "timestamped": {
107
- "format": "{asctime} {levelname} {message}",
107
+ "format": "{asctime} {levelname} [p:{process:d}] [t:{thread:d}] {message}",
108
108
  "style": "{",
109
109
  },
110
110
  },
@@ -127,42 +127,27 @@ if IS_AZURE_ENVIRONMENT:
127
127
  },
128
128
  "pulumi_django_azure": {
129
129
  "handlers": ["file"],
130
- "level": "INFO",
130
+ "level": "DEBUG",
131
131
  "propagate": True,
132
132
  },
133
133
  },
134
134
  }
135
135
 
136
136
  # Redis, if enabled
137
- redis_cache_host = env("REDIS_CACHE_HOST", default=None)
138
- redis_cache_port = env("REDIS_CACHE_PORT", default=None)
139
- redis_cache_db = env("REDIS_CACHE_DB", default=None)
140
-
141
- if redis_cache_host and redis_cache_port and redis_cache_db:
142
- # This will enable the health check to update the Redis credentials
143
- AZURE_REDIS_CREDENTIALS = True
137
+ REDIS_SIDECAR = env("REDIS_SIDECAR", default=False)
144
138
 
145
- # This will prevent the website from failing if Redis is not available
139
+ if REDIS_SIDECAR:
140
+ # This will prevent the website from failing if Redis is not available.
146
141
  DJANGO_REDIS_IGNORE_EXCEPTIONS = True
147
142
  DJANGO_REDIS_LOG_IGNORED_EXCEPTIONS = True
148
143
 
149
- REDIS_CACHE_HOST = redis_cache_host
150
- REDIS_CACHE_PORT = redis_cache_port
151
- REDIS_CACHE_DB = redis_cache_db
152
- redis_credentials = get_redis_credentials()
153
- REDIS_USERNAME = redis_credentials.username
154
- REDIS_PASSWORD = redis_credentials.password
155
-
156
144
  CACHES = {
157
145
  "default": {
158
146
  "BACKEND": "django_redis.cache.RedisCache",
159
- "LOCATION": f"rediss://{REDIS_USERNAME}@{REDIS_CACHE_HOST}:{REDIS_CACHE_PORT}/{REDIS_CACHE_DB}",
147
+ "LOCATION": "redis://localhost:6379/0",
160
148
  "OPTIONS": {
161
149
  "CLIENT_CLASS": "django_redis.client.DefaultClient",
162
150
  "PARSER_CLASS": "redis.connection._HiredisParser",
163
- "PASSWORD": REDIS_PASSWORD,
164
151
  },
165
152
  },
166
153
  }
167
- else:
168
- AZURE_REDIS_CREDENTIALS = False
@@ -1,243 +1,246 @@
1
- Metadata-Version: 2.4
2
- Name: pulumi-django-azure
3
- Version: 1.0.33
4
- Summary: Simply deployment of Django on Azure with Pulumi
5
- Author-email: Maarten Ureel <maarten@youreal.eu>
6
- License-Expression: MIT
7
- Project-URL: Homepage, https://gitlab.com/MaartenUreel/pulumi-django-azure
8
- Keywords: django,pulumi,azure
9
- Classifier: Programming Language :: Python
10
- Classifier: Programming Language :: Python :: 3
11
- Requires-Python: <3.14,>=3.11
12
- Description-Content-Type: text/markdown
13
- Requires-Dist: azure-identity<2.0.0,>=1.21.0
14
- Requires-Dist: azure-keyvault-secrets<5.0.0,>=4.9.0
15
- Requires-Dist: azure-mgmt-cdn<14.0.0,>=13.1.1
16
- Requires-Dist: azure-mgmt-resource<24.0.0,>=23.3.0
17
- Requires-Dist: django<6.0,>=5.2
18
- Requires-Dist: django-azure-communication-email<2.0.0,>=1.3.2
19
- Requires-Dist: django-environ<0.13.0,>=0.12.0
20
- Requires-Dist: django-redis<6.0.0,>=5.4.0
21
- Requires-Dist: django-storages[azure]<2.0.0,>=1.14.6
22
- Requires-Dist: pulumi>=3.166.0
23
- Requires-Dist: pulumi-azure-native>=3.2.0
24
- Requires-Dist: pulumi-random>=4.18.2
25
- Requires-Dist: redis[hiredis]<7.0.0,>=6.0.0
26
-
27
- # Pulumi Django Deployment
28
-
29
- This project aims to make a simple Django deployment on Azure easier.
30
-
31
- To have a proper and secure environment, we need these components:
32
- * Storage account for media and static files
33
- * CDN endpoint in front with a domain name of our choosing
34
- * PostgreSQL server
35
- * Azure Communication Services to send e-mails
36
- * Webapp with multiple custom host names and managed SSL for the website itself
37
- * Azure Key Vault per application
38
- * Webapp running pgAdmin
39
-
40
- ## Project requirements
41
-
42
- ## Installation
43
- This package is published on PyPi, so you can just add pulumi-django-azure to your requirements file.
44
-
45
- To use a specific branch in your project, add to pyproject.toml dependencies:
46
- ```
47
- pulumi-django-azure = { git = "git@gitlab.com:MaartenUreel/pulumi-django-azure.git", branch = "dev" }
48
- ```
49
-
50
- A simple project could look like this:
51
- ```python
52
- import pulumi
53
- import pulumi_azure_native as azure
54
- from pulumi_django_azure import DjangoDeployment
55
-
56
- stack = pulumi.get_stack()
57
- config = pulumi.Config()
58
-
59
-
60
- # Create resource group
61
- rg = azure.resources.ResourceGroup(f"rg-{stack}")
62
-
63
- # Create VNet
64
- vnet = azure.network.VirtualNetwork(
65
- f"vnet-{stack}",
66
- resource_group_name=rg.name,
67
- address_space=azure.network.AddressSpaceArgs(
68
- address_prefixes=["10.0.0.0/16"],
69
- ),
70
- )
71
-
72
- # Deploy the website and all its components
73
- django = DjangoDeployment(
74
- stack,
75
- tenant_id="abc123...",
76
- resource_group_name=rg.name,
77
- vnet=vnet,
78
- pgsql_ip_prefix="10.0.10.0/24",
79
- appservice_ip_prefix="10.0.20.0/24",
80
- app_service_sku=azure.web.SkuDescriptionArgs(
81
- name="B2",
82
- tier="Basic",
83
- ),
84
- storage_account_name="mystorageaccount",
85
- cdn_host="cdn.example.com",
86
- )
87
-
88
- django.add_django_website(
89
- name="web",
90
- db_name="mywebsite",
91
- repository_url="git@gitlab.com:project/website.git",
92
- repository_branch="main",
93
- website_hosts=["example.com", "www.example.com"],
94
- django_settings_module="mywebsite.settings.production",
95
- comms_data_location="europe",
96
- comms_domains=["mydomain.com"],
97
- )
98
-
99
- django.add_database_administrator(
100
- object_id="a1b2c3....",
101
- user_name="user@example.com",
102
- tenant_id="a1b2c3....",
103
- )
104
- ```
105
-
106
- ## Changes to your Django project
107
- 1. Add `pulumi_django_azure` to your `INSTALLED_APPS`
108
- 2. Add to your settings file:
109
- ```python
110
- from pulumi_django_azure.settings import * # noqa: F403
111
-
112
- # This will provide the management command to purge the CDN and cache
113
- INSTALLED_APPS += ["pulumi_django_azure"]
114
-
115
- # This will provide the health check middleware that will also take care of credential rotation.
116
- MIDDLEWARE += ["pulumi_django_azure.middleware.HealthCheckMiddleware"]
117
- ```
118
- This will pre-configure most settings to make your app work on Azure. You can check the source for details,
119
- and ofcourse override any value after importing them.
120
-
121
-
122
- ## Deployment steps
123
- 1. Deploy without custom hosts (for CDN and websites)
124
- 2. Configure the PostgreSQL server (create and grant permissions to role for your websites)
125
- 3. Retrieve the deployment SSH key and configure your remote GIT repository with it
126
- 4. Configure your CDN host (add the CNAME record)
127
- 5. Configure your custom website domains (add CNAME/A record and TXT validation records)
128
- 6. Re-deploy with custom hosts
129
- 7. Re-deploy once more to enable HTTPS on website domains
130
- 8. Manually activate HTTPS on the CDN host
131
- 9. Go to the e-mail communications service on Azure and configure DKIM, SPF,... for your custom domains.
132
-
133
- ## Custom domain name for CDN
134
- When deploying the first time, you will get a `cdn_cname` output. You need to create a CNAME to this domain before the deployment of the custom domain will succeed.
135
-
136
- You can safely deploy with the failing CustomDomain to get the CNAME, create the record and then deploy again.
137
-
138
- To enable HTTPS, you need to do this manually in the console. This is because of a limitation in the Azure API:
139
- https://github.com/Azure/azure-rest-api-specs/issues/17498
140
-
141
- ## Custom domain names for web application
142
- Because of a circular dependency in custom domain name bindings and certificates that is out of our control, you need to deploy the stack twice.
143
-
144
- The first time will create the bindings without a certificate.
145
- The second deployment will then create the certificate for the domain (which is only possible if the binding exists), but also set the fingerprint of that certificate on the binding.
146
-
147
- To make the certificate work, you need to create a TXT record named `asuid` point to the output of `{your_app}_site_domain_verification_id`. For example:
148
-
149
- ```
150
- asuid.mywebsite.com. TXT "A1B2C3D4E5..."
151
- asuid.www.mywebsite.com. TXT "A1B2C3D4E5..."
152
- ```
153
-
154
- ## Database authentication
155
- The PostgreSQL uses Entra ID authentication only, no passwords.
156
-
157
- ### Administrator login
158
- If you want to log in to the database yourself, you can add yourself as an administrator with the `add_database_administrator` function.
159
- Your username is your e-mailaddress, a temporary password can be obtained using `az account get-access-token`.
160
-
161
- You can use this method to log in to pgAdmin.
162
-
163
- ### Application
164
- Refer to this documentation:
165
- https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-manage-azure-ad-users#create-a-role-using-microsoft-entra-object-identifier
166
-
167
- In short, run something like this in the `postgres` database:
168
- ```
169
- SELECT * FROM pgaadauth_create_principal_with_oid('web_managed_identity', 'c8b25b85-d060-4cfc-bad4-b8581cfdf946', 'service', false, false);
170
- ```
171
- Replace the GUID of course with the managed identity our web app gets.
172
-
173
- The name of the role is outputted by `{your_app}_site_db_user`
174
-
175
- Be sure to grant this role the correct permissions too.
176
-
177
- ## pgAdmin specifics
178
- pgAdmin will be created with a default login:
179
- * Login: dbadmin@dbadmin.net
180
- * Password: dbadmin
181
-
182
- Best practice is to log in right away, create a user for yourself and delete this default user.
183
-
184
- ## Azure OAuth2 / Django Social Auth
185
- If you want to set up login with Azure, which would make sense since you are in the ecosystem, you need to create an App Registration in Entra ID, create a secret and then register these settings in your stack:
186
- ```
187
- pulumi config set --secret --path 'mywebsite_social_auth_azure.key' secret_ID
188
- pulumi config set --secret --path 'mywebsite_social_auth_azure.secret' secret_value
189
- pulumi config set --secret --path 'mywebsite_social_auth_azure.tenant_id' directory_tenant_id
190
- pulumi config set --secret --path 'mywebsite_social_auth_azure.client_id' application_id
191
- ```
192
-
193
- Then in your Django deployment, pass to the `add_django_website` command:
194
- ```
195
- secrets={
196
- "mywebsite_social_auth_azure": "AZURE_OAUTH",
197
- },
198
- ```
199
-
200
- The value will be automatically stored in the vault where the application has access to.
201
- The environment variable will be suffixed with `_SECRET_NAME`.
202
-
203
- Then, in your application, retrieve this data from the vault, e.g.:
204
- ```python
205
- # Social Auth settings
206
- oauth_secret = AZURE_KEY_VAULT_CLIENT.get_secret(env("AZURE_OAUTH_SECRET_NAME"))
207
- oauth_secret = json.loads(oauth_secret.value)
208
- SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY = oauth_secret["client_id"]
209
- SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET = oauth_secret["secret"]
210
- SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID = oauth_secret["tenant_id"]
211
- SOCIAL_AUTH_ADMIN_USER_SEARCH_FIELDS = ["username", "first_name", "last_name", "email"]
212
- SOCIAL_AUTH_POSTGRES_JSONFIELD = True
213
-
214
- AUTHENTICATION_BACKENDS = (
215
- "social_core.backends.azuread_tenant.AzureADTenantOAuth2",
216
- "django.contrib.auth.backends.ModelBackend",
217
- )
218
- ```
219
-
220
- And of course add the login button somewhere, following Django Social Auth instructions.
221
-
222
- ## Automate deployments
223
- When using a service like GitLab, you can configure a Webhook to fire upon a push to your branch.
224
-
225
- You need to download the deployment profile to obtain the deployment username and password, and then you can construct a URL like this:
226
-
227
- ```
228
- https://{user}:{pass}@{appname}.scm.azurewebsites.net/deploy
229
-
230
- ```
231
-
232
- ```
233
- https://{appname}.scm.azurewebsites.net/api/sshkey?ensurePublicKey=1
234
- ```
235
-
236
- Be sure to configure the SSH key that Azure will use on GitLab side. You can obtain it using:
237
-
238
- This would then trigger a redeploy everytime you make a commit to your live branch.
239
-
240
-
241
- ## Change requests
242
- I created this for internal use but since it took me a while to puzzle all the things together I decided to share it.
243
- Therefore this project is not super generic, but tailored to my needs. I am however open to pull or change requests to improve this project or to make it more usable for others.
1
+ Metadata-Version: 2.3
2
+ Name: pulumi-django-azure
3
+ Version: 1.0.35
4
+ Summary: Simply deployment of Django on Azure with Pulumi
5
+ License: MIT
6
+ Keywords: django,pulumi,azure
7
+ Author: Maarten Ureel
8
+ Author-email: maarten@youreal.eu
9
+ Requires-Python: >=3.11,<3.14
10
+ Classifier: Programming Language :: Python
11
+ Classifier: Programming Language :: Python :: 3
12
+ Requires-Dist: azure-identity (>=1.24.0,<2.0.0)
13
+ Requires-Dist: azure-keyvault-secrets (>=4.10.0,<5.0.0)
14
+ Requires-Dist: azure-mgmt-cdn (>=13.1.1,<14.0.0)
15
+ Requires-Dist: azure-mgmt-resource (>=24.0.0,<25.0.0)
16
+ Requires-Dist: django (>=5.2.5,<6.0.0)
17
+ Requires-Dist: django-azure-communication-email (>=1.3.2,<2.0.0)
18
+ Requires-Dist: django-environ (>=0.12.0,<0.13.0)
19
+ Requires-Dist: django-redis (>=6.0.0,<7.0.0)
20
+ Requires-Dist: django-storages[azure] (>=1.14.6,<2.0.0)
21
+ Requires-Dist: pulumi (>=3.189.0)
22
+ Requires-Dist: pulumi-azure-native (>=3.7.1)
23
+ Requires-Dist: pulumi-random (>=4.18.3)
24
+ Requires-Dist: redis[hiredis] (>=6.4.0,<7.0.0)
25
+ Requires-Dist: tenacity (>=9.1.2,<10.0.0)
26
+ Project-URL: Homepage, https://gitlab.com/MaartenUreel/pulumi-django-azure
27
+ Description-Content-Type: text/markdown
28
+
29
+ # Pulumi Django Deployment
30
+
31
+ This project aims to make a simple Django deployment on Azure easier.
32
+
33
+ To have a proper and secure environment, we need these components:
34
+ * Storage account for media and static files
35
+ * CDN endpoint in front with a domain name of our choosing
36
+ * PostgreSQL server
37
+ * Azure Communication Services to send e-mails
38
+ * Webapp with multiple custom host names and managed SSL for the website itself
39
+ * Azure Key Vault per application
40
+ * Webapp running pgAdmin
41
+
42
+ ## Project requirements
43
+
44
+ ## Installation
45
+ This package is published on PyPi, so you can just add pulumi-django-azure to your requirements file.
46
+
47
+ To use a specific branch in your project, add to pyproject.toml dependencies:
48
+ ```
49
+ pulumi-django-azure = { git = "git@gitlab.com:MaartenUreel/pulumi-django-azure.git", branch = "dev" }
50
+ ```
51
+
52
+ A simple project could look like this:
53
+ ```python
54
+ import pulumi
55
+ import pulumi_azure_native as azure
56
+ from pulumi_django_azure import DjangoDeployment
57
+
58
+ stack = pulumi.get_stack()
59
+ config = pulumi.Config()
60
+
61
+
62
+ # Create resource group
63
+ rg = azure.resources.ResourceGroup(f"rg-{stack}")
64
+
65
+ # Create VNet
66
+ vnet = azure.network.VirtualNetwork(
67
+ f"vnet-{stack}",
68
+ resource_group_name=rg.name,
69
+ address_space=azure.network.AddressSpaceArgs(
70
+ address_prefixes=["10.0.0.0/16"],
71
+ ),
72
+ )
73
+
74
+ # Deploy the website and all its components
75
+ django = DjangoDeployment(
76
+ stack,
77
+ tenant_id="abc123...",
78
+ resource_group_name=rg.name,
79
+ vnet=vnet,
80
+ pgsql_ip_prefix="10.0.10.0/24",
81
+ appservice_ip_prefix="10.0.20.0/24",
82
+ app_service_sku=azure.web.SkuDescriptionArgs(
83
+ name="B2",
84
+ tier="Basic",
85
+ ),
86
+ storage_account_name="mystorageaccount",
87
+ cdn_host="cdn.example.com",
88
+ )
89
+
90
+ django.add_django_website(
91
+ name="web",
92
+ db_name="mywebsite",
93
+ repository_url="git@gitlab.com:project/website.git",
94
+ repository_branch="main",
95
+ website_hosts=["example.com", "www.example.com"],
96
+ django_settings_module="mywebsite.settings.production",
97
+ comms_data_location="europe",
98
+ comms_domains=["mydomain.com"],
99
+ )
100
+
101
+ django.add_database_administrator(
102
+ object_id="a1b2c3....",
103
+ user_name="user@example.com",
104
+ tenant_id="a1b2c3....",
105
+ )
106
+ ```
107
+
108
+ ## Changes to your Django project
109
+ 1. Add `pulumi_django_azure` to your `INSTALLED_APPS`
110
+ 2. Add to your settings file:
111
+ ```python
112
+ from pulumi_django_azure.settings import * # noqa: F403
113
+
114
+ # This will provide the management command to purge the CDN and cache
115
+ INSTALLED_APPS += ["pulumi_django_azure"]
116
+
117
+ # This will provide the health check middleware that will also take care of credential rotation.
118
+ MIDDLEWARE += ["pulumi_django_azure.middleware.HealthCheckMiddleware"]
119
+ ```
120
+ This will pre-configure most settings to make your app work on Azure. You can check the source for details,
121
+ and ofcourse override any value after importing them.
122
+
123
+
124
+ ## Deployment steps
125
+ 1. Deploy without custom hosts (for CDN and websites)
126
+ 2. Configure the PostgreSQL server (create and grant permissions to role for your websites)
127
+ 3. Retrieve the deployment SSH key and configure your remote GIT repository with it
128
+ 4. Configure your CDN host (add the CNAME record)
129
+ 5. Configure your custom website domains (add CNAME/A record and TXT validation records)
130
+ 6. Re-deploy with custom hosts
131
+ 7. Re-deploy once more to enable HTTPS on website domains
132
+ 8. Manually activate HTTPS on the CDN host
133
+ 9. Go to the e-mail communications service on Azure and configure DKIM, SPF,... for your custom domains.
134
+
135
+ ## Custom domain name for CDN
136
+ When deploying the first time, you will get a `cdn_cname` output. You need to create a CNAME to this domain before the deployment of the custom domain will succeed.
137
+
138
+ You can safely deploy with the failing CustomDomain to get the CNAME, create the record and then deploy again.
139
+
140
+ To enable HTTPS, you need to do this manually in the console. This is because of a limitation in the Azure API:
141
+ https://github.com/Azure/azure-rest-api-specs/issues/17498
142
+
143
+ ## Custom domain names for web application
144
+ Because of a circular dependency in custom domain name bindings and certificates that is out of our control, you need to deploy the stack twice.
145
+
146
+ The first time will create the bindings without a certificate.
147
+ The second deployment will then create the certificate for the domain (which is only possible if the binding exists), but also set the fingerprint of that certificate on the binding.
148
+
149
+ To make the certificate work, you need to create a TXT record named `asuid` point to the output of `{your_app}_site_domain_verification_id`. For example:
150
+
151
+ ```
152
+ asuid.mywebsite.com. TXT "A1B2C3D4E5..."
153
+ asuid.www.mywebsite.com. TXT "A1B2C3D4E5..."
154
+ ```
155
+
156
+ ## Database authentication
157
+ The PostgreSQL uses Entra ID authentication only, no passwords.
158
+
159
+ ### Administrator login
160
+ If you want to log in to the database yourself, you can add yourself as an administrator with the `add_database_administrator` function.
161
+ Your username is your e-mailaddress, a temporary password can be obtained using `az account get-access-token`.
162
+
163
+ You can use this method to log in to pgAdmin.
164
+
165
+ ### Application
166
+ Refer to this documentation:
167
+ https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-manage-azure-ad-users#create-a-role-using-microsoft-entra-object-identifier
168
+
169
+ In short, run something like this in the `postgres` database:
170
+ ```
171
+ SELECT * FROM pgaadauth_create_principal_with_oid('web_managed_identity', 'c8b25b85-d060-4cfc-bad4-b8581cfdf946', 'service', false, false);
172
+ ```
173
+ Replace the GUID of course with the managed identity our web app gets.
174
+
175
+ The name of the role is outputted by `{your_app}_site_db_user`
176
+
177
+ Be sure to grant this role the correct permissions too.
178
+
179
+ ## pgAdmin specifics
180
+ pgAdmin will be created with a default login:
181
+ * Login: dbadmin@dbadmin.net
182
+ * Password: dbadmin
183
+
184
+ Best practice is to log in right away, create a user for yourself and delete this default user.
185
+
186
+ ## Azure OAuth2 / Django Social Auth
187
+ If you want to set up login with Azure, which would make sense since you are in the ecosystem, you need to create an App Registration in Entra ID, create a secret and then register these settings in your stack:
188
+ ```
189
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.key' secret_ID
190
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.secret' secret_value
191
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.tenant_id' directory_tenant_id
192
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.client_id' application_id
193
+ ```
194
+
195
+ Then in your Django deployment, pass to the `add_django_website` command:
196
+ ```
197
+ secrets={
198
+ "mywebsite_social_auth_azure": "AZURE_OAUTH",
199
+ },
200
+ ```
201
+
202
+ The value will be automatically stored in the vault where the application has access to.
203
+ The environment variable will be suffixed with `_SECRET_NAME`.
204
+
205
+ Then, in your application, retrieve this data from the vault, e.g.:
206
+ ```python
207
+ # Social Auth settings
208
+ oauth_secret = AZURE_KEY_VAULT_CLIENT.get_secret(env("AZURE_OAUTH_SECRET_NAME"))
209
+ oauth_secret = json.loads(oauth_secret.value)
210
+ SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY = oauth_secret["client_id"]
211
+ SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET = oauth_secret["secret"]
212
+ SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID = oauth_secret["tenant_id"]
213
+ SOCIAL_AUTH_ADMIN_USER_SEARCH_FIELDS = ["username", "first_name", "last_name", "email"]
214
+ SOCIAL_AUTH_POSTGRES_JSONFIELD = True
215
+
216
+ AUTHENTICATION_BACKENDS = (
217
+ "social_core.backends.azuread_tenant.AzureADTenantOAuth2",
218
+ "django.contrib.auth.backends.ModelBackend",
219
+ )
220
+ ```
221
+
222
+ And of course add the login button somewhere, following Django Social Auth instructions.
223
+
224
+ ## Automate deployments
225
+ When using a service like GitLab, you can configure a Webhook to fire upon a push to your branch.
226
+
227
+ You need to download the deployment profile to obtain the deployment username and password, and then you can construct a URL like this:
228
+
229
+ ```
230
+ https://{user}:{pass}@{appname}.scm.azurewebsites.net/deploy
231
+
232
+ ```
233
+
234
+ ```
235
+ https://{appname}.scm.azurewebsites.net/api/sshkey?ensurePublicKey=1
236
+ ```
237
+
238
+ Be sure to configure the SSH key that Azure will use on GitLab side. You can obtain it using:
239
+
240
+ This would then trigger a redeploy everytime you make a commit to your live branch.
241
+
242
+
243
+ ## Change requests
244
+ I created this for internal use but since it took me a while to puzzle all the things together I decided to share it.
245
+ Therefore this project is not super generic, but tailored to my needs. I am however open to pull or change requests to improve this project or to make it more usable for others.
246
+
@@ -0,0 +1,13 @@
1
+ pulumi_django_azure/__init__.py,sha256=WoTHLNGnqc3dQoJtzrAJY8OVA7ReP6XFkDb9BXZGfJ8,117
2
+ pulumi_django_azure/azure_helper.py,sha256=vZLIVZo44EP1-GGeq0XLJ10c42wJDDpKSL5-_sVgUzA,3053
3
+ pulumi_django_azure/context_processors.py,sha256=Qm2e_WBipJYMDH3clYAAaHvEDkG8au2czSQqRkS5928,1136
4
+ pulumi_django_azure/django_deployment.py,sha256=bVDEHrd7KeT6CAuLj0gozn_qSnfSBmm7iRk_6Yy2A34,46655
5
+ pulumi_django_azure/management/commands/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
6
+ pulumi_django_azure/management/commands/purge_cache.py,sha256=yjMoNvEPFmtuZctOKXMUacfKJLlTC9xfF-0W-IH3kF0,488
7
+ pulumi_django_azure/management/commands/purge_cdn.py,sha256=8iLuqjndvreTHXRp37sjpvcNltdGTpwhY9YiQokS_P0,2095
8
+ pulumi_django_azure/management/commands/test_redis.py,sha256=_jQXmv48NSPVGrgGZTmASWm0WAWYhqt9HaE3XdJ22U4,10225
9
+ pulumi_django_azure/middleware.py,sha256=XykZAmilyCaZR_5mM950h2WI4053HRqr95LGV1p8uR0,2472
10
+ pulumi_django_azure/settings.py,sha256=hneKnLgm-gzxgX724wEs1rJxK6oq7W5EgT2sJyx7bxY,5231
11
+ pulumi_django_azure-1.0.35.dist-info/METADATA,sha256=QmwtgaTBvlO8sL3AhD-DOGxFcu4iMzWyiOhVhTWuXgU,9598
12
+ pulumi_django_azure-1.0.35.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
13
+ pulumi_django_azure-1.0.35.dist-info/RECORD,,
@@ -1,5 +1,4 @@
1
1
  Wheel-Version: 1.0
2
- Generator: setuptools (80.1.0)
2
+ Generator: poetry-core 2.1.3
3
3
  Root-Is-Purelib: true
4
4
  Tag: py3-none-any
5
-
@@ -1,13 +0,0 @@
1
- pulumi_django_azure/__init__.py,sha256=WoTHLNGnqc3dQoJtzrAJY8OVA7ReP6XFkDb9BXZGfJ8,117
2
- pulumi_django_azure/azure_helper.py,sha256=iCIHNLZJ-nBrXq7bjVn92eUYz7q6-mPFckWFcxpUjMY,2114
3
- pulumi_django_azure/context_processors.py,sha256=Qm2e_WBipJYMDH3clYAAaHvEDkG8au2czSQqRkS5928,1136
4
- pulumi_django_azure/django_deployment.py,sha256=l3hXP8Eo5ZUjojQtDsWeBGCFoSKN76NSz7tW9d-s9FA,50964
5
- pulumi_django_azure/middleware.py,sha256=7egut5QhBCleB-D3LHWMhZPh6bdrgWQqSShaXuV2tAM,3656
6
- pulumi_django_azure/settings.py,sha256=BTP5y6KE3oP9pY01TR1ML6GArpLhnzx-mFflrhTQ4SE,5906
7
- pulumi_django_azure/management/commands/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
8
- pulumi_django_azure/management/commands/purge_cache.py,sha256=yjMoNvEPFmtuZctOKXMUacfKJLlTC9xfF-0W-IH3kF0,488
9
- pulumi_django_azure/management/commands/purge_cdn.py,sha256=8iLuqjndvreTHXRp37sjpvcNltdGTpwhY9YiQokS_P0,2095
10
- pulumi_django_azure-1.0.33.dist-info/METADATA,sha256=y22q3oQlVYjNLPynCAuEObPflOUM_2bjprpMBTJIZ7k,9759
11
- pulumi_django_azure-1.0.33.dist-info/WHEEL,sha256=wXxTzcEDnjrTwFYjLPcsW_7_XihufBwmpiBeiXNBGEA,91
12
- pulumi_django_azure-1.0.33.dist-info/top_level.txt,sha256=MNPRJhq-_G8EMCHRkjdcb_xrqzOkmKogXUGV7Ysz3g0,20
13
- pulumi_django_azure-1.0.33.dist-info/RECORD,,
@@ -1 +0,0 @@
1
- pulumi_django_azure