242 lines
7.3 KiB
Python
242 lines
7.3 KiB
Python
"""
|
|
Base settings for fraud_platform project.
|
|
"""
|
|
import os
|
|
from pathlib import Path
|
|
import environ
|
|
|
|
# Build paths inside the project like this: BASE_DIR / 'subdir'.
|
|
BASE_DIR = Path(__file__).resolve().parent.parent.parent
|
|
|
|
# Initialize environment variables
|
|
env = environ.Env(
|
|
DEBUG=(bool, False)
|
|
)
|
|
|
|
# Read .env file if it exists
|
|
environ.Env.read_env(os.path.join(BASE_DIR, '.env'))
|
|
|
|
# SECURITY WARNING: keep the secret key used in production secret!
|
|
SECRET_KEY = env('SECRET_KEY', default='django-insecure-change-this-in-production')
|
|
|
|
# SECURITY WARNING: don't run with debug turned on in production!
|
|
DEBUG = env('DEBUG', default=False)
|
|
|
|
ALLOWED_HOSTS = env.list('ALLOWED_HOSTS', default=[])
|
|
|
|
# Application definition
|
|
INSTALLED_APPS = [
|
|
'django.contrib.admin',
|
|
'django.contrib.auth',
|
|
'django.contrib.contenttypes',
|
|
'django.contrib.sessions',
|
|
'django.contrib.messages',
|
|
'django.contrib.staticfiles',
|
|
|
|
# MFA/OTP
|
|
'django_otp',
|
|
'django_otp.plugins.otp_totp',
|
|
'django_otp.plugins.otp_static',
|
|
|
|
# Local apps
|
|
'accounts',
|
|
'reports',
|
|
'osint',
|
|
'moderation',
|
|
'analytics',
|
|
'legal',
|
|
]
|
|
|
|
MIDDLEWARE = [
|
|
'django.middleware.security.SecurityMiddleware',
|
|
'accounts.middleware.SecurityHeadersMiddleware', # Security headers
|
|
'accounts.middleware.RateLimitMiddleware', # Rate limiting
|
|
'django.contrib.sessions.middleware.SessionMiddleware',
|
|
'django.middleware.common.CommonMiddleware',
|
|
'django.middleware.csrf.CsrfViewMiddleware',
|
|
'django.contrib.auth.middleware.AuthenticationMiddleware',
|
|
'django_otp.middleware.OTPMiddleware', # MFA middleware
|
|
'accounts.middleware.SessionSecurityMiddleware', # Session security (after auth)
|
|
'accounts.middleware.SecurityLoggingMiddleware', # Security logging
|
|
'accounts.middleware.IPWhitelistMiddleware', # IP filtering (admin)
|
|
'django.contrib.messages.middleware.MessageMiddleware',
|
|
'django.middleware.clickjacking.XFrameOptionsMiddleware',
|
|
]
|
|
|
|
ROOT_URLCONF = 'fraud_platform.urls'
|
|
|
|
TEMPLATES = [
|
|
{
|
|
'BACKEND': 'django.template.backends.django.DjangoTemplates',
|
|
'DIRS': [BASE_DIR / 'templates'],
|
|
'APP_DIRS': True,
|
|
'OPTIONS': {
|
|
'context_processors': [
|
|
'django.template.context_processors.debug',
|
|
'django.template.context_processors.request',
|
|
'django.contrib.auth.context_processors.auth',
|
|
'django.contrib.messages.context_processors.messages',
|
|
'fraud_platform.context_processors.seo_context',
|
|
],
|
|
},
|
|
},
|
|
]
|
|
|
|
WSGI_APPLICATION = 'fraud_platform.wsgi.application'
|
|
|
|
# Database
|
|
# https://docs.djangoproject.com/en/5.2/ref/settings/#databases
|
|
DATABASES = {
|
|
'default': {
|
|
'ENGINE': 'django.db.backends.postgresql',
|
|
'NAME': env('DB_NAME', default='fraud_platform_db'),
|
|
'USER': env('DB_USER', default='postgres'),
|
|
'PASSWORD': env('DB_PASSWORD', default=''),
|
|
'HOST': env('DB_HOST', default='localhost'),
|
|
'PORT': env('DB_PORT', default='5432'),
|
|
}
|
|
}
|
|
|
|
# Custom User Model
|
|
AUTH_USER_MODEL = 'accounts.User'
|
|
|
|
# Password validation - Enhanced security
|
|
AUTH_PASSWORD_VALIDATORS = [
|
|
{
|
|
'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
|
|
'OPTIONS': {
|
|
'user_attributes': ('username', 'email', 'first_name', 'last_name'),
|
|
'max_similarity': 0.7,
|
|
}
|
|
},
|
|
{
|
|
'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
|
|
'OPTIONS': {
|
|
'min_length': 12,
|
|
}
|
|
},
|
|
{
|
|
'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
|
|
},
|
|
{
|
|
'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
|
|
},
|
|
]
|
|
|
|
# Additional password requirements
|
|
PASSWORD_MIN_LENGTH = 12
|
|
PASSWORD_REQUIRE_UPPERCASE = True
|
|
PASSWORD_REQUIRE_LOWERCASE = True
|
|
PASSWORD_REQUIRE_DIGITS = True
|
|
PASSWORD_REQUIRE_SPECIAL = True
|
|
|
|
# Internationalization
|
|
LANGUAGE_CODE = 'bg' # Bulgarian
|
|
TIME_ZONE = 'Europe/Sofia'
|
|
USE_I18N = True
|
|
USE_TZ = True
|
|
|
|
# Static files (CSS, JavaScript, Images)
|
|
STATIC_URL = '/static/'
|
|
STATIC_ROOT = BASE_DIR / 'staticfiles'
|
|
STATICFILES_DIRS = [
|
|
BASE_DIR / 'static',
|
|
]
|
|
|
|
# Media files
|
|
MEDIA_URL = '/media/'
|
|
MEDIA_ROOT = BASE_DIR / 'media'
|
|
|
|
# Default primary key field type
|
|
DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
|
|
|
|
# Security Settings
|
|
SECURE_BROWSER_XSS_FILTER = True
|
|
SECURE_CONTENT_TYPE_NOSNIFF = True
|
|
X_FRAME_OPTIONS = 'DENY'
|
|
SECURE_HSTS_SECONDS = 31536000 if not DEBUG else 0
|
|
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
|
|
SECURE_HSTS_PRELOAD = True
|
|
SECURE_SSL_REDIRECT = not DEBUG
|
|
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
|
|
|
|
# Session Security
|
|
SESSION_COOKIE_SECURE = not DEBUG
|
|
SESSION_COOKIE_HTTPONLY = True
|
|
SESSION_COOKIE_SAMESITE = 'Lax'
|
|
SESSION_COOKIE_AGE = 86400 # 24 hours
|
|
SESSION_EXPIRE_AT_BROWSER_CLOSE = True
|
|
SESSION_SAVE_EVERY_REQUEST = True # Extend session on activity
|
|
|
|
# CSRF Security
|
|
CSRF_COOKIE_SECURE = not DEBUG
|
|
CSRF_COOKIE_HTTPONLY = True
|
|
CSRF_COOKIE_SAMESITE = 'Lax'
|
|
CSRF_USE_SESSIONS = True # Store CSRF token in session instead of cookie
|
|
CSRF_FAILURE_VIEW = 'accounts.views.csrf_failure'
|
|
|
|
# Password Security
|
|
PASSWORD_HASHERS = [
|
|
'django.contrib.auth.hashers.Argon2PasswordHasher',
|
|
'django.contrib.auth.hashers.PBKDF2PasswordHasher',
|
|
'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
|
|
'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
|
|
]
|
|
|
|
# Encryption Key (should be in environment in production)
|
|
ENCRYPTION_KEY = env('ENCRYPTION_KEY', default=None)
|
|
|
|
# Rate Limiting
|
|
RATELIMIT_ENABLE = True
|
|
RATELIMIT_USE_CACHE = 'default'
|
|
|
|
# Security Logging
|
|
SECURITY_LOG_FAILED_LOGINS = True
|
|
SECURITY_LOG_SUSPICIOUS_ACTIVITY = True
|
|
|
|
# Login URLs
|
|
LOGIN_URL = '/accounts/login/'
|
|
LOGIN_REDIRECT_URL = '/'
|
|
LOGOUT_REDIRECT_URL = '/'
|
|
|
|
# Email Configuration
|
|
# Uses custom backend that reads from SiteSettings model
|
|
# Falls back to environment variables if SiteSettings not configured
|
|
EMAIL_BACKEND = env('EMAIL_BACKEND', default='reports.email_backend.SiteSettingsEmailBackend')
|
|
EMAIL_HOST = env('EMAIL_HOST', default='')
|
|
EMAIL_PORT = env('EMAIL_PORT', default=587)
|
|
EMAIL_USE_TLS = env('EMAIL_USE_TLS', default=True)
|
|
EMAIL_USE_SSL = env('EMAIL_USE_SSL', default=False)
|
|
EMAIL_HOST_USER = env('EMAIL_HOST_USER', default='')
|
|
EMAIL_HOST_PASSWORD = env('EMAIL_HOST_PASSWORD', default='')
|
|
# DEFAULT_FROM_EMAIL is now managed via SiteSettings model
|
|
# Fallback to env variable if SiteSettings not configured
|
|
DEFAULT_FROM_EMAIL = env('DEFAULT_FROM_EMAIL', default='noreply@fraudplatform.bg')
|
|
EMAIL_TIMEOUT = env('EMAIL_TIMEOUT', default=10)
|
|
|
|
# File Upload Settings - Security
|
|
FILE_UPLOAD_MAX_MEMORY_SIZE = 10485760 # 10MB
|
|
DATA_UPLOAD_MAX_MEMORY_SIZE = 10485760 # 10MB
|
|
FILE_UPLOAD_PERMISSIONS = 0o644
|
|
DATA_UPLOAD_MAX_NUMBER_FIELDS = 1000 # Prevent DoS via form fields
|
|
|
|
# Allowed file types for uploads
|
|
ALLOWED_FILE_EXTENSIONS = ['.pdf', '.jpg', '.jpeg', '.png', '.txt', '.doc', '.docx']
|
|
ALLOWED_MIME_TYPES = [
|
|
'application/pdf',
|
|
'image/jpeg',
|
|
'image/png',
|
|
'text/plain',
|
|
'application/msword',
|
|
'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
|
|
]
|
|
|
|
# Database Security
|
|
if 'default' in DATABASES:
|
|
DATABASES['default']['CONN_MAX_AGE'] = 600 # Connection pooling
|
|
DATABASES['default']['OPTIONS'] = {
|
|
'connect_timeout': 10,
|
|
'options': '-c statement_timeout=30000' # 30 second query timeout
|
|
}
|
|
|