From 91c1d9b19b1c20b9582e90273b8287d0067b2b9c Mon Sep 17 00:00:00 2001 From: Manish Kumar Date: Tue, 11 Aug 2026 01:19:38 -0500 Subject: [PATCH] fix: wire DJANGO_SECRET_KEY / DJANGO_SECRET_KEY_FALLBACKS for workbench + celery-worker Companion to omnibioai-workbench#207, which wires settings.py's SECRET_KEY off these env vars (with a hard-fail guard if DJANGO_DEBUG=false and no real key is set). Real values live in this repo's .env (gitignored, confirmed via git check-ignore -- not committed here or anywhere). New .env vars (not part of this diff, .env is gitignored): WORKBENCH_DJANGO_SECRET_KEY= WORKBENCH_DJANGO_SECRET_KEY_FALLBACKS= 14-day bake period before WORKBENCH_DJANGO_SECRET_KEY_FALLBACKS (here) and the settings.py SECRET_KEY_FALLBACKS entry it feeds are dropped -- end date tracked on #38. Verified live: rebuilt + recreated both containers, confirmed the exact byte-for-byte key value landed in the container (caught and fixed a real Compose $-interpolation bug along the way -- see companion PR), and confirmed a pre-rotation session kept authenticating post-rotation via the fallback rather than being force-logged-out. Co-Authored-By: Claude Sonnet 5 --- docker-compose.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 9168885..a9449c6 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -391,6 +391,10 @@ services: # issue #38: was DEBUG: "1" -- vestigial, settings.py never read it. # Now wired to the real env var (omnibioai/settings.py:143), default off. DJANGO_DEBUG: "false" + # issue #38 follow-up: SECRET_KEY rotation. Old (potentially-exposed) + # key kept in FALLBACKS until the bake-period end date noted on #38. + DJANGO_SECRET_KEY: ${WORKBENCH_DJANGO_SECRET_KEY} + DJANGO_SECRET_KEY_FALLBACKS: ${WORKBENCH_DJANGO_SECRET_KEY_FALLBACKS:-} CSRF_EXTRA_ORIGINS: "http://localhost:5174,http://localhost:8000,http://${HOST_IP:-192.168.86.234}:5174,http://${HOST_IP:-192.168.86.234}:8000" DJANGO_SETTINGS_MODULE: omnibioai.settings DB_HOST: mysql @@ -489,6 +493,10 @@ services: # issue #38: was DEBUG: "1" -- vestigial, settings.py never read it. # Now wired to the real env var (omnibioai/settings.py:143), default off. DJANGO_DEBUG: "false" + # issue #38 follow-up: SECRET_KEY rotation. Old (potentially-exposed) + # key kept in FALLBACKS until the bake-period end date noted on #38. + DJANGO_SECRET_KEY: ${WORKBENCH_DJANGO_SECRET_KEY} + DJANGO_SECRET_KEY_FALLBACKS: ${WORKBENCH_DJANGO_SECRET_KEY_FALLBACKS:-} CSRF_EXTRA_ORIGINS: "http://localhost:5174,http://localhost:8000,http://${HOST_IP:-192.168.86.234}:5174,http://${HOST_IP:-192.168.86.234}:8000" DJANGO_SETTINGS_MODULE: omnibioai.settings DB_HOST: mysql