EMERGENCY: DJANGO_DEBUG=false for workbench + celery-worker (fixes #38, deploy side) - #39
Merged
Merged
Conversation
Companion to omnibioai-workbench#206, which wires settings.py's DEBUG off this env var (was hardcoded True, unconditional). The DEBUG: "1" that lived here before was vestigial -- settings.py never read that key -- so this also pins production intent explicitly rather than relying solely on settings.py's own default. Emergency/interim piece of #38. SECRET_KEY rotation and ALLOWED_HOSTS narrowing are separate, sequenced follow-up work (analysis posted on the issue) -- not touched here. Verified live against the real workbench + celery-worker containers (rebuilt + recreated) and against public https://workbench.omnibioai.org through the actual Cloudflare Tunnel + nginx-router path -- see #38 for the full verification transcript. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Urgent — production info-leak, interim scope only
Companion PR to
omnibioai-workbench#206, which wiressettings.py'sDEBUGoff a real env var (was hardcodedTrue, unconditional). This is the compose-side half — closes #38's active leak.What
Both
workbenchandcelery-workerhadDEBUG: "1"— vestigial,settings.pynever read that key. Replaced with the env var settings.py now actually reads:Mirrors the
DJANGO_DEBUGpattern already used forlimsin this same file (line 263).Deliberately out of scope
Same as the companion PR —
SECRET_KEYrotation andALLOWED_HOSTSnarrowing are separate, deliberate follow-up (see analysis comment on #38). Not touched here.Verification
Rebuilt + recreated both containers from this branch +
omnibioai-workbench#206together:404 against a nonexistent route on both
localhost:8000and the real publichttps://workbench.omnibioai.org(through the actual Cloudflare Tunnel + nginx-router path) returns the plain production 404 page — no stack trace, no settings dump:Requesting fast review
Needs to merge alongside
omnibioai-workbench#206— flagging directly given the urgency of the underlying leak, would appreciate review ahead of the normal queue.🤖 Generated with Claude Code
Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com