pulumi-django-azure 1.0.7__tar.gz → 1.0.55__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (23) hide show
  1. {pulumi-django-azure-1.0.7 → pulumi_django_azure-1.0.55}/PKG-INFO +251 -199
  2. pulumi-django-azure-1.0.7/src/pulumi_django_azure.egg-info/PKG-INFO → pulumi_django_azure-1.0.55/README.md +58 -40
  3. pulumi_django_azure-1.0.55/pyproject.toml +68 -0
  4. pulumi_django_azure-1.0.55/src/pulumi_django_azure/__init__.py +0 -0
  5. pulumi_django_azure-1.0.55/src/pulumi_django_azure/azure_helper.py +108 -0
  6. pulumi_django_azure-1.0.55/src/pulumi_django_azure/context_processors.py +42 -0
  7. pulumi_django_azure-1.0.55/src/pulumi_django_azure/django_deployment.py +1113 -0
  8. pulumi_django_azure-1.0.55/src/pulumi_django_azure/management/commands/__init__.py +0 -0
  9. pulumi_django_azure-1.0.55/src/pulumi_django_azure/management/commands/purge_cache.py +23 -0
  10. pulumi_django_azure-1.0.55/src/pulumi_django_azure/management/commands/purge_cdn.py +59 -0
  11. pulumi_django_azure-1.0.55/src/pulumi_django_azure/management/commands/test_redis.py +248 -0
  12. pulumi_django_azure-1.0.55/src/pulumi_django_azure/middleware.py +67 -0
  13. pulumi_django_azure-1.0.55/src/pulumi_django_azure/settings.py +193 -0
  14. pulumi-django-azure-1.0.7/LICENSE +0 -21
  15. pulumi-django-azure-1.0.7/README.md +0 -160
  16. pulumi-django-azure-1.0.7/pyproject.toml +0 -45
  17. pulumi-django-azure-1.0.7/setup.cfg +0 -8
  18. pulumi-django-azure-1.0.7/src/pulumi_django_azure/__init__.py +0 -1
  19. pulumi-django-azure-1.0.7/src/pulumi_django_azure/django_deployment.py +0 -634
  20. pulumi-django-azure-1.0.7/src/pulumi_django_azure.egg-info/SOURCES.txt +0 -11
  21. pulumi-django-azure-1.0.7/src/pulumi_django_azure.egg-info/dependency_links.txt +0 -1
  22. pulumi-django-azure-1.0.7/src/pulumi_django_azure.egg-info/requires.txt +0 -3
  23. pulumi-django-azure-1.0.7/src/pulumi_django_azure.egg-info/top_level.txt +0 -1
@@ -1,199 +1,251 @@
1
- Metadata-Version: 2.1
2
- Name: pulumi-django-azure
3
- Version: 1.0.7
4
- Summary: Simply deployment of Django on Azure with Pulumi
5
- Author-email: Maarten Ureel <maarten@youreal.eu>
6
- License: MIT License
7
-
8
- Copyright (c) 2023 YouReal BV
9
-
10
- Permission is hereby granted, free of charge, to any person obtaining a copy
11
- of this software and associated documentation files (the "Software"), to deal
12
- in the Software without restriction, including without limitation the rights
13
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14
- copies of the Software, and to permit persons to whom the Software is
15
- furnished to do so, subject to the following conditions:
16
-
17
- The above copyright notice and this permission notice shall be included in all
18
- copies or substantial portions of the Software.
19
-
20
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
23
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
26
- SOFTWARE.
27
-
28
- Project-URL: Homepage, https://gitlab.com/MaartenUreel/pulumi-django-azure
29
- Keywords: django,pulumi,azure
30
- Classifier: License :: OSI Approved :: MIT License
31
- Classifier: Programming Language :: Python
32
- Classifier: Programming Language :: Python :: 3
33
- Requires-Python: >=3.9
34
- Description-Content-Type: text/markdown
35
- License-File: LICENSE
36
- Requires-Dist: pulumi>=3.99.0
37
- Requires-Dist: pulumi-azure-native>=2.24.0
38
- Requires-Dist: pulumi-random>=4.14.0
39
-
40
- # Pulumi Django Deployment
41
-
42
- This project aims to make a simple Django deployment on Azure easier.
43
-
44
- To have a proper and secure environment, we need these components:
45
- * Storage account for media and static files
46
- * CDN endpoint in front with a domain name of our choosing
47
- * PostgreSQL server
48
- * Azure Communication Services to send e-mails
49
- * Webapp with multiple custom host names and managed SSL for the website itself
50
- * Webapp running pgAdmin
51
-
52
- ## Installation
53
- This package is published on PyPi, so you can just add pulumi-django-azure to your requirements file.
54
-
55
- To use a specific branch in your project, add to pyproject.toml dependencies:
56
- ```
57
- pulumi-django-azure = { git = "git@gitlab.com:MaartenUreel/pulumi-django-azure.git", branch = "dev" }
58
- ```
59
-
60
- A simple project could look like this:
61
- ```python
62
- import pulumi
63
- import pulumi_azure_native as azure
64
- from pulumi_django_azure import DjangoDeployment
65
-
66
- stack = pulumi.get_stack()
67
- config = pulumi.Config()
68
-
69
-
70
- # Create resource group
71
- rg = azure.resources.ResourceGroup(f"rg-{stack}")
72
-
73
- # Create VNet
74
- vnet = azure.network.VirtualNetwork(
75
- f"vnet-{stack}",
76
- resource_group_name=rg.name,
77
- address_space=azure.network.AddressSpaceArgs(
78
- address_prefixes=["10.0.0.0/16"],
79
- ),
80
- )
81
-
82
- # Deploy the website and all its components
83
- django = DjangoDeployment(
84
- stack,
85
- tenant_id="abc123...",
86
- resource_group_name=rg.name,
87
- vnet=vnet,
88
- pgsql_ip_prefix="10.0.10.0/24",
89
- appservice_ip_prefix="10.0.20.0/24",
90
- app_service_sku=azure.web.SkuDescriptionArgs(
91
- name="B2",
92
- tier="Basic",
93
- ),
94
- storage_account_name="mystorageaccount",
95
- cdn_host="cdn.example.com",
96
- )
97
-
98
- django.add_django_website(
99
- name="web",
100
- db_name="mywebsite",
101
- repository_url="git@gitlab.com:project/website.git",
102
- repository_branch="main",
103
- website_hosts=["example.com", "www.example.com"],
104
- django_settings_module="mywebsite.settings.production",
105
- comms_data_location="europe",
106
- comms_domains=["mydomain.com"],
107
- )
108
-
109
- django.add_database_administrator(
110
- object_id="a1b2c3....",
111
- user_name="user@example.com",
112
- tenant_id="a1b2c3....",
113
- )
114
- ```
115
-
116
- ## Deployment steps
117
-
118
- 1. Deploy without custom hosts (for CDN and websites)
119
- 2. Configure the PostgreSQL server (create and grant permissions to role for your websites)
120
- 3. Retrieve the deployment SSH key and configure your remote GIT repository with it
121
- 4. Configure your CDN host (add the CNAME record)
122
- 5. Configure your custom website domains (add CNAME/A record and TXT validation records)
123
- 6. Re-deploy with custom hosts
124
- 7. Re-deploy once more to enable HTTPS on website domains
125
- 8. Manually activate HTTPS on the CDN host
126
- 9. Go to the e-mail communications service on Azure and configure DKIM, SPF,... for your custom domains.
127
-
128
- ## Custom domain name for CDN
129
- When deploying the first time, you will get a `cdn_cname` output. You need to create a CNAME to this domain before the deployment of the custom domain will succeed.
130
-
131
- You can safely deploy with the failing CustomDomain to get the CNAME, create the record and then deploy again.
132
-
133
- To enable HTTPS, you need to do this manually in the console. This is because of a limitation in the Azure API:
134
- https://github.com/Azure/azure-rest-api-specs/issues/17498
135
-
136
- ## Custom domain names for web application
137
- Because of a circular dependency in custom domain name bindings and certificates that is out of our control, you need to deploy the stack twice.
138
-
139
- The first time will create the bindings without a certificate.
140
- The second deployment will then create the certificate for the domain (which is only possible if the binding exists), but also set the fingerprint of that certificate on the binding.
141
-
142
- To make the certificate work, you need to create a TXT record named `asuid` point to the output of `{your_app}_site_domain_verification_id`. For example:
143
-
144
- ```
145
- asuid.mywebsite.com. TXT "A1B2C3D4E5..."
146
- asuid.www.mywebsite.com. TXT "A1B2C3D4E5..."
147
- ```
148
-
149
- ## Database authentication
150
- The PostgreSQL uses Entra ID authentication only, no passwords.
151
-
152
- ### Administrator login
153
- If you want to log in to the database yourself, you can add yourself as an administrator with the `add_database_administrator` function.
154
- Your username is your e-mailaddress, a temporary password can be obtained using `az account get-access-token`.
155
-
156
- You can use this method to log in to pgAdmin.
157
-
158
- ### Application
159
- Refer to this documentation:
160
- https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-manage-azure-ad-users#create-a-role-using-microsoft-entra-object-identifier
161
-
162
- In short, run something like this in the `postgres` database:
163
- ```
164
- SELECT * FROM pgaadauth_create_principal_with_oid('web_managed_identity', 'c8b25b85-d060-4cfc-bad4-b8581cfdf946', 'service', false, false);
165
- ```
166
- Replace the GUID of course with the managed identity our web app gets.
167
-
168
- The name of the role is outputted by `{your_app}_site_db_user`
169
-
170
- Be sure to grant this role the correct permissions too.
171
-
172
- ## pgAdmin specifics
173
- pgAdmin will be created with a default login:
174
- * Login: dbadmin@dbadmin.net
175
- * Password: dbadmin
176
-
177
- Best practice is to log in right away, create a user for yourself and delete this default user.
178
-
179
- ## Automate deployments
180
- When using a service like GitLab, you can configure a Webhook to fire upon a push to your branch.
181
-
182
- You need to download the deployment profile to obtain the deployment username and password, and then you can construct a URL like this:
183
-
184
- ```
185
- https://{user}:{pass}@{appname}.scm.azurewebsites.net/deploy
186
-
187
- ```
188
-
189
- ```
190
- https://{appname}.scm.azurewebsites.net/api/sshkey?ensurePublicKey=1
191
- ```
192
-
193
- Be sure to configure the SSH key that Azure will use on GitLab side. You can obtain it using:
194
-
195
- This would then trigger a redeploy everytime you make a commit to your live branch.
196
-
197
- ## Change requests
198
- I created this for internal use but since it took me a while to puzzle all the things together I decided to share it.
199
- Therefore this project is not super generic, but tailored to my needs. I am however open to pull or change requests to improve this project or to make it more usable for others.
1
+ Metadata-Version: 2.4
2
+ Name: pulumi-django-azure
3
+ Version: 1.0.55
4
+ Summary: Simply deployment of Django on Azure with Pulumi
5
+ License-Expression: MIT
6
+ Keywords: django,pulumi,azure
7
+ Author: Maarten Ureel
8
+ Author-email: maarten@youreal.eu
9
+ Requires-Python: >=3.11,<3.15
10
+ Classifier: Programming Language :: Python
11
+ Classifier: Programming Language :: Python :: 3
12
+ Requires-Dist: azure-identity (>=1.25.1,<2.0.0)
13
+ Requires-Dist: azure-keyvault-secrets (>=4.10.0,<5.0.0)
14
+ Requires-Dist: azure-mgmt-cdn (>=13.1.1,<14.0.0)
15
+ Requires-Dist: azure-mgmt-resource (>=24.0.0,<25.0.0)
16
+ Requires-Dist: collectfasta (>=3.3.1,<4.0.0)
17
+ Requires-Dist: django (>=5.2.8,<6.0.0)
18
+ Requires-Dist: django-azure-communication-email (>=1.5.0,<2.0.0)
19
+ Requires-Dist: django-environ (>=0.12.0,<0.13.0)
20
+ Requires-Dist: django-redis (>=6.0.0,<7.0.0)
21
+ Requires-Dist: django-storages[azure] (>=1.14.6,<2.0.0)
22
+ Requires-Dist: django-tasks[rq] (>=0.9.0,<0.10.0)
23
+ Requires-Dist: psycopg-binary (>=3.3.0,<4.0.0) ; sys_platform == "win32"
24
+ Requires-Dist: psycopg[c] (>=3.3.0,<4.0.0) ; sys_platform == "linux"
25
+ Requires-Dist: pulumi (>=3.209.0)
26
+ Requires-Dist: pulumi-azure (>=6.30.0,<7.0.0)
27
+ Requires-Dist: pulumi-azure-native (>=3.10.2)
28
+ Requires-Dist: pulumi-random (>=4.18.4)
29
+ Requires-Dist: redis[hiredis] (>=7.1.0,<8.0.0)
30
+ Requires-Dist: tenacity (>=9.1.2,<10.0.0)
31
+ Project-URL: Homepage, https://gitlab.com/MaartenUreel/pulumi-django-azure
32
+ Description-Content-Type: text/markdown
33
+
34
+ # Pulumi Django Deployment
35
+
36
+ This project aims to make a simple Django deployment on Azure easier.
37
+
38
+ To have a proper and secure environment, we need these components:
39
+ * Storage account for media and static files
40
+ * CDN endpoint in front with a domain name of our choosing
41
+ * PostgreSQL server
42
+ * Azure Communication Services to send e-mails
43
+ * Webapp with multiple custom host names and managed SSL for the website itself
44
+ * Azure Key Vault per application
45
+ * Webapp running pgAdmin
46
+
47
+ ## Project requirements
48
+
49
+ ## Installation
50
+ This package is published on PyPi, so you can just add pulumi-django-azure to your requirements file.
51
+
52
+ To use a specific branch in your project, add to pyproject.toml dependencies:
53
+ ```
54
+ pulumi-django-azure = { git = "git@gitlab.com:MaartenUreel/pulumi-django-azure.git", branch = "dev" }
55
+ ```
56
+
57
+ A simple project could look like this:
58
+ ```python
59
+ import pulumi
60
+ import pulumi_azure_native as azure
61
+ from pulumi_django_azure import DjangoDeployment
62
+
63
+ stack = pulumi.get_stack()
64
+ config = pulumi.Config()
65
+
66
+
67
+ # Create resource group
68
+ rg = azure.resources.ResourceGroup(f"rg-{stack}")
69
+
70
+ # Create VNet
71
+ vnet = azure.network.VirtualNetwork(
72
+ f"vnet-{stack}",
73
+ resource_group_name=rg.name,
74
+ address_space=azure.network.AddressSpaceArgs(
75
+ address_prefixes=["10.0.0.0/16"],
76
+ ),
77
+ )
78
+
79
+ # Deploy the website and all its components
80
+ django = DjangoDeployment(
81
+ stack,
82
+ tenant_id="abc123...",
83
+ resource_group_name=rg.name,
84
+ vnet=vnet,
85
+ pgsql_ip_prefix="10.0.10.0/24",
86
+ appservice_ip_prefix="10.0.20.0/24",
87
+ app_service_sku=azure.web.SkuDescriptionArgs(
88
+ name="B2",
89
+ tier="Basic",
90
+ ),
91
+ storage_account_name="mystorageaccount",
92
+ cdn_host="cdn.example.com",
93
+ )
94
+
95
+ django.add_django_website(
96
+ name="web",
97
+ db_name="mywebsite",
98
+ repository_url="git@gitlab.com:project/website.git",
99
+ repository_branch="main",
100
+ website_hosts=["example.com", "www.example.com"],
101
+ django_settings_module="mywebsite.settings.production",
102
+ comms_data_location="europe",
103
+ comms_domains=["mydomain.com"],
104
+ )
105
+
106
+ django.add_database_administrator(
107
+ object_id="a1b2c3....",
108
+ user_name="user@example.com",
109
+ tenant_id="a1b2c3....",
110
+ )
111
+ ```
112
+
113
+ ## Changes to your Django project
114
+ 1. Add `pulumi_django_azure` to your `INSTALLED_APPS`
115
+ 2. Add to your settings file:
116
+ ```python
117
+ from pulumi_django_azure.settings import * # noqa: F403
118
+
119
+ # This will provide the management command to purge the CDN and cache
120
+ INSTALLED_APPS += ["pulumi_django_azure"]
121
+
122
+ # This will provide the health check middleware that will also take care of credential rotation.
123
+ MIDDLEWARE += ["pulumi_django_azure.middleware.HealthCheckMiddleware"]
124
+ ```
125
+ This will pre-configure most settings to make your app work on Azure. You can check the source for details,
126
+ and ofcourse override any value after importing them.
127
+
128
+
129
+ ## Deployment steps
130
+ 1. Deploy without custom hosts (for CDN and websites)
131
+ 2. Configure the PostgreSQL server (create and grant permissions to role for your websites)
132
+ 3. Retrieve the deployment SSH key and configure your remote GIT repository with it
133
+ 4. Configure your CDN host (add the CNAME record)
134
+ 5. Configure your custom website domains (add CNAME/A record and TXT validation records)
135
+ 6. Re-deploy with custom hosts
136
+ 7. Re-deploy once more to enable HTTPS on website domains
137
+ 8. Manually activate HTTPS on the CDN host
138
+ 9. Go to the e-mail communications service on Azure and configure DKIM, SPF,... for your custom domains.
139
+
140
+ ## Custom domain name for CDN
141
+ When deploying the first time, you will get a `cdn_cname` output. You need to create a CNAME to this domain before the deployment of the custom domain will succeed.
142
+
143
+ You can safely deploy with the failing CustomDomain to get the CNAME, create the record and then deploy again.
144
+
145
+ To enable HTTPS, you need to do this manually in the console. This is because of a limitation in the Azure API:
146
+ https://github.com/Azure/azure-rest-api-specs/issues/17498
147
+
148
+ ## Custom domain names for web application
149
+ Because of a circular dependency in custom domain name bindings and certificates that is out of our control, you need to deploy the stack twice.
150
+
151
+ The first time will create the bindings without a certificate.
152
+ The second deployment will then create the certificate for the domain (which is only possible if the binding exists), but also set the fingerprint of that certificate on the binding.
153
+
154
+ To make the certificate work, you need to create a TXT record named `asuid` point to the output of `{your_app}_site_domain_verification_id`. For example:
155
+
156
+ ```
157
+ asuid.mywebsite.com. TXT "A1B2C3D4E5..."
158
+ asuid.www.mywebsite.com. TXT "A1B2C3D4E5..."
159
+ ```
160
+
161
+ ## Database authentication
162
+ The PostgreSQL uses Entra ID authentication only, no passwords.
163
+
164
+ ### Administrator login
165
+ If you want to log in to the database yourself, you can add yourself as an administrator with the `add_database_administrator` function.
166
+ Your username is your e-mailaddress, a temporary password can be obtained using `az account get-access-token`.
167
+
168
+ You can use this method to log in to pgAdmin.
169
+
170
+ ### Application
171
+ Refer to this documentation:
172
+ https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-manage-azure-ad-users#create-a-role-using-microsoft-entra-object-identifier
173
+
174
+ In short, run something like this in the `postgres` database:
175
+ ```
176
+ SELECT * FROM pgaadauth_create_principal_with_oid('web_managed_identity', 'c8b25b85-d060-4cfc-bad4-b8581cfdf946', 'service', false, false);
177
+ ```
178
+ Replace the GUID of course with the managed identity our web app gets.
179
+
180
+ The name of the role is outputted by `{your_app}_site_db_user`
181
+
182
+ Be sure to grant this role the correct permissions too.
183
+
184
+ ## pgAdmin specifics
185
+ pgAdmin will be created with a default login:
186
+ * Login: dbadmin@dbadmin.net
187
+ * Password: dbadmin
188
+
189
+ Best practice is to log in right away, create a user for yourself and delete this default user.
190
+
191
+ ## Azure OAuth2 / Django Social Auth
192
+ If you want to set up login with Azure, which would make sense since you are in the ecosystem, you need to create an App Registration in Entra ID, create a secret and then register these settings in your stack:
193
+ ```
194
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.key' secret_ID
195
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.secret' secret_value
196
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.tenant_id' directory_tenant_id
197
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.client_id' application_id
198
+ ```
199
+
200
+ Then in your Django deployment, pass to the `add_django_website` command:
201
+ ```
202
+ secrets={
203
+ "mywebsite_social_auth_azure": "AZURE_OAUTH",
204
+ },
205
+ ```
206
+
207
+ The value will be automatically stored in the vault where the application has access to.
208
+ The environment variable will be suffixed with `_SECRET_NAME`.
209
+
210
+ Then, in your application, retrieve this data from the vault, e.g.:
211
+ ```python
212
+ # Social Auth settings
213
+ oauth_secret = AZURE_KEY_VAULT_CLIENT.get_secret(env("AZURE_OAUTH_SECRET_NAME"))
214
+ oauth_secret = json.loads(oauth_secret.value)
215
+ SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY = oauth_secret["client_id"]
216
+ SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET = oauth_secret["secret"]
217
+ SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID = oauth_secret["tenant_id"]
218
+ SOCIAL_AUTH_ADMIN_USER_SEARCH_FIELDS = ["username", "first_name", "last_name", "email"]
219
+ SOCIAL_AUTH_POSTGRES_JSONFIELD = True
220
+
221
+ AUTHENTICATION_BACKENDS = (
222
+ "social_core.backends.azuread_tenant.AzureADTenantOAuth2",
223
+ "django.contrib.auth.backends.ModelBackend",
224
+ )
225
+ ```
226
+
227
+ And of course add the login button somewhere, following Django Social Auth instructions.
228
+
229
+ ## Automate deployments
230
+ When using a service like GitLab, you can configure a Webhook to fire upon a push to your branch.
231
+
232
+ You need to download the deployment profile to obtain the deployment username and password, and then you can construct a URL like this:
233
+
234
+ ```
235
+ https://{user}:{pass}@{appname}.scm.azurewebsites.net/deploy
236
+
237
+ ```
238
+
239
+ ```
240
+ https://{appname}.scm.azurewebsites.net/api/sshkey?ensurePublicKey=1
241
+ ```
242
+
243
+ Be sure to configure the SSH key that Azure will use on GitLab side. You can obtain it using:
244
+
245
+ This would then trigger a redeploy everytime you make a commit to your live branch.
246
+
247
+
248
+ ## Change requests
249
+ I created this for internal use but since it took me a while to puzzle all the things together I decided to share it.
250
+ Therefore this project is not super generic, but tailored to my needs. I am however open to pull or change requests to improve this project or to make it more usable for others.
251
+
@@ -1,42 +1,3 @@
1
- Metadata-Version: 2.1
2
- Name: pulumi-django-azure
3
- Version: 1.0.7
4
- Summary: Simply deployment of Django on Azure with Pulumi
5
- Author-email: Maarten Ureel <maarten@youreal.eu>
6
- License: MIT License
7
-
8
- Copyright (c) 2023 YouReal BV
9
-
10
- Permission is hereby granted, free of charge, to any person obtaining a copy
11
- of this software and associated documentation files (the "Software"), to deal
12
- in the Software without restriction, including without limitation the rights
13
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14
- copies of the Software, and to permit persons to whom the Software is
15
- furnished to do so, subject to the following conditions:
16
-
17
- The above copyright notice and this permission notice shall be included in all
18
- copies or substantial portions of the Software.
19
-
20
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
23
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
26
- SOFTWARE.
27
-
28
- Project-URL: Homepage, https://gitlab.com/MaartenUreel/pulumi-django-azure
29
- Keywords: django,pulumi,azure
30
- Classifier: License :: OSI Approved :: MIT License
31
- Classifier: Programming Language :: Python
32
- Classifier: Programming Language :: Python :: 3
33
- Requires-Python: >=3.9
34
- Description-Content-Type: text/markdown
35
- License-File: LICENSE
36
- Requires-Dist: pulumi>=3.99.0
37
- Requires-Dist: pulumi-azure-native>=2.24.0
38
- Requires-Dist: pulumi-random>=4.14.0
39
-
40
1
  # Pulumi Django Deployment
41
2
 
42
3
  This project aims to make a simple Django deployment on Azure easier.
@@ -47,8 +8,11 @@ To have a proper and secure environment, we need these components:
47
8
  * PostgreSQL server
48
9
  * Azure Communication Services to send e-mails
49
10
  * Webapp with multiple custom host names and managed SSL for the website itself
11
+ * Azure Key Vault per application
50
12
  * Webapp running pgAdmin
51
13
 
14
+ ## Project requirements
15
+
52
16
  ## Installation
53
17
  This package is published on PyPi, so you can just add pulumi-django-azure to your requirements file.
54
18
 
@@ -113,8 +77,23 @@ django.add_database_administrator(
113
77
  )
114
78
  ```
115
79
 
116
- ## Deployment steps
80
+ ## Changes to your Django project
81
+ 1. Add `pulumi_django_azure` to your `INSTALLED_APPS`
82
+ 2. Add to your settings file:
83
+ ```python
84
+ from pulumi_django_azure.settings import * # noqa: F403
85
+
86
+ # This will provide the management command to purge the CDN and cache
87
+ INSTALLED_APPS += ["pulumi_django_azure"]
88
+
89
+ # This will provide the health check middleware that will also take care of credential rotation.
90
+ MIDDLEWARE += ["pulumi_django_azure.middleware.HealthCheckMiddleware"]
91
+ ```
92
+ This will pre-configure most settings to make your app work on Azure. You can check the source for details,
93
+ and ofcourse override any value after importing them.
117
94
 
95
+
96
+ ## Deployment steps
118
97
  1. Deploy without custom hosts (for CDN and websites)
119
98
  2. Configure the PostgreSQL server (create and grant permissions to role for your websites)
120
99
  3. Retrieve the deployment SSH key and configure your remote GIT repository with it
@@ -176,6 +155,44 @@ pgAdmin will be created with a default login:
176
155
 
177
156
  Best practice is to log in right away, create a user for yourself and delete this default user.
178
157
 
158
+ ## Azure OAuth2 / Django Social Auth
159
+ If you want to set up login with Azure, which would make sense since you are in the ecosystem, you need to create an App Registration in Entra ID, create a secret and then register these settings in your stack:
160
+ ```
161
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.key' secret_ID
162
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.secret' secret_value
163
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.tenant_id' directory_tenant_id
164
+ pulumi config set --secret --path 'mywebsite_social_auth_azure.client_id' application_id
165
+ ```
166
+
167
+ Then in your Django deployment, pass to the `add_django_website` command:
168
+ ```
169
+ secrets={
170
+ "mywebsite_social_auth_azure": "AZURE_OAUTH",
171
+ },
172
+ ```
173
+
174
+ The value will be automatically stored in the vault where the application has access to.
175
+ The environment variable will be suffixed with `_SECRET_NAME`.
176
+
177
+ Then, in your application, retrieve this data from the vault, e.g.:
178
+ ```python
179
+ # Social Auth settings
180
+ oauth_secret = AZURE_KEY_VAULT_CLIENT.get_secret(env("AZURE_OAUTH_SECRET_NAME"))
181
+ oauth_secret = json.loads(oauth_secret.value)
182
+ SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY = oauth_secret["client_id"]
183
+ SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET = oauth_secret["secret"]
184
+ SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID = oauth_secret["tenant_id"]
185
+ SOCIAL_AUTH_ADMIN_USER_SEARCH_FIELDS = ["username", "first_name", "last_name", "email"]
186
+ SOCIAL_AUTH_POSTGRES_JSONFIELD = True
187
+
188
+ AUTHENTICATION_BACKENDS = (
189
+ "social_core.backends.azuread_tenant.AzureADTenantOAuth2",
190
+ "django.contrib.auth.backends.ModelBackend",
191
+ )
192
+ ```
193
+
194
+ And of course add the login button somewhere, following Django Social Auth instructions.
195
+
179
196
  ## Automate deployments
180
197
  When using a service like GitLab, you can configure a Webhook to fire upon a push to your branch.
181
198
 
@@ -194,6 +211,7 @@ Be sure to configure the SSH key that Azure will use on GitLab side. You can obt
194
211
 
195
212
  This would then trigger a redeploy everytime you make a commit to your live branch.
196
213
 
214
+
197
215
  ## Change requests
198
216
  I created this for internal use but since it took me a while to puzzle all the things together I decided to share it.
199
217
  Therefore this project is not super generic, but tailored to my needs. I am however open to pull or change requests to improve this project or to make it more usable for others.
@@ -0,0 +1,68 @@
1
+ [build-system]
2
+ requires = ["poetry-core"]
3
+ build-backend = "poetry.core.masonry.api"
4
+
5
+ [project]
6
+ name = "pulumi-django-azure"
7
+ version = "1.0.55"
8
+ description = "Simply deployment of Django on Azure with Pulumi"
9
+ readme = "README.md"
10
+ authors = [{ name = "Maarten Ureel", email = "maarten@youreal.eu" }]
11
+ license = "MIT"
12
+ classifiers = [
13
+ "Programming Language :: Python",
14
+ "Programming Language :: Python :: 3",
15
+ ]
16
+ keywords = ["django", "pulumi", "azure"]
17
+ dependencies = [
18
+ "azure-identity (>=1.25.1,<2.0.0)",
19
+ "azure-keyvault-secrets (>=4.10.0,<5.0.0)",
20
+ "azure-mgmt-cdn (>=13.1.1,<14.0.0)",
21
+ "azure-mgmt-resource (>=24.0.0,<25.0.0)",
22
+ "collectfasta (>=3.3.1,<4.0.0)",
23
+ "django (>=5.2.8,<6.0.0)",
24
+ "django-azure-communication-email (>=1.5.0,<2.0.0)",
25
+ "django-environ (>=0.12.0,<0.13.0)",
26
+ "django-redis (>=6.0.0,<7.0.0)",
27
+ "django-storages[azure] (>=1.14.6,<2.0.0)",
28
+ "django-tasks[rq] (>=0.9.0,<0.10.0)",
29
+ "psycopg-binary (>=3.3.0,<4.0.0) ; sys_platform == \"win32\"",
30
+ "psycopg[c] (>=3.3.0,<4.0.0) ; sys_platform == \"linux\"",
31
+ "pulumi (>=3.209.0)",
32
+ "pulumi-azure (>=6.30.0,<7.0.0)",
33
+ "pulumi-azure-native (>=3.10.2)",
34
+ "pulumi-random (>=4.18.4)",
35
+ "redis[hiredis] (>=7.1.0,<8.0.0)",
36
+ "tenacity (>=9.1.2,<10.0.0)"
37
+ ]
38
+ requires-python = ">=3.11,<3.15"
39
+
40
+ [project.urls]
41
+ Homepage = "https://gitlab.com/MaartenUreel/pulumi-django-azure"
42
+
43
+
44
+ [tool.poetry.group.dev.dependencies]
45
+ build = "^1.3.0"
46
+ mkdocs-material = "^9.7.0"
47
+ pre-commit = "^4.5.0"
48
+ ruff = "^0.14.7"
49
+ twine = "^6.2.0"
50
+
51
+ [tool.ruff]
52
+ line-length = 140
53
+
54
+ [tool.ruff.lint]
55
+ select = [
56
+ # pycodestyle
57
+ "E",
58
+ # Pyflakes
59
+ "F",
60
+ # pyupgrade
61
+ "UP",
62
+ # flake8-bugbear
63
+ "B",
64
+ # flake8-simplify
65
+ "SIM",
66
+ # isort
67
+ "I",
68
+ ]