Changes of the settings.py and in generell the Variable Proccessing to have a more secure deployment Process

.github/workflows/release-docker.yml

@@ -200,26 +200,35 @@ jobs:
 
       - name: Create release-only docker bundle
         run: |
-          mkdir -p release-bundle
-          cat > release-bundle/docker-compose.yml <<EOF
-          services:
-            app:
-              image: \${INVENTAR_APP_IMAGE:-${{ steps.meta.outputs.image }}}
-              container_name: inventarsystem-app
-              restart: unless-stopped
-              ports:
-                - "\${INVENTAR_HTTP_PORT:-10000}:8000"
-              depends_on:
-                - mongodb
-                - redis
-              environment:
-                INVENTAR_MONGODB_HOST: mongodb
-                INVENTAR_MONGODB_PORT: "27017"
-                INVENTAR_MONGODB_DB: Inventarsystem
-                INVENTAR_BACKUP_FOLDER: /data/backups
-                INVENTAR_LOGS_FOLDER: /data/logs
-              expose:
-                - "8000"
+            mkdir -p release-bundle
+            cat > release-bundle/docker-compose.yml <<EOF
+            services:
+              app:
+                image: \${INVENTAR_APP_IMAGE:-${{ steps.meta.outputs.image }}}
+                container_name: inventarsystem-app
+                restart: unless-stopped
+                ports:
+                  - "\${INVENTAR_HTTP_PORT:-10000}:8000"
+                depends_on:
+                  - mongodb
+                  - redis
+                environment:
+                  INVENTAR_MONGODB_HOST: mongodb
+                  INVENTAR_MONGODB_PORT: "27017"
+                  INVENTAR_MONGODB_DB: Inventarsystem
+                  INVENTAR_BACKUP_FOLDER: /data/backups
+                  INVENTAR_LOGS_FOLDER: /data/logs
+                  INVENTAR_SECRET_KEY: \${INVENTAR_SECRET_KEY}
+                  INVENTAR_DATA_ENCRYPTION_KEY: \${INVENTAR_DATA_ENCRYPTION_KEY}
+                  INVENTAR_MONGODB_PASSWORD: \${INVENTAR_MONGODB_PASSWORD}
+                  INVENTAR_SECRET_KEY: \${INVENTAR_SECRET_KEY}
+                  EMAIL_ENABLED: \${EMAIL_ENABLED}
+                  EMAIL_SMTP_HOST: \${EMAIL_SMTP_HOST}
+                  EMAIL_SMTP_PORT: \${EMAIL_SMTP_PORT}
+                  EMAIL_USERNAME: \${EMAIL_USERNAME}
+                  EMAIL_PASSWORD: \${EMAIL_PASSWORD}
+                expose:
+                  - "8000"
               volumes:
                 - ./config.json:/app/config.json:ro
                 - app_uploads:/app/Web/uploads

Web/modules/database/settings.py

@@ -220,15 +220,15 @@ SSL_CERT = _get(_conf, ['ssl', 'cert'], DEFAULTS['ssl']['cert'])
 SSL_KEY = _get(_conf, ['ssl', 'key'], DEFAULTS['ssl']['key'])
 
 # Email settings
-EMAIL_ENABLED = _get(_conf, ['email', 'enabled'], False)
-EMAIL_SMTP_HOST = _get(_conf, ['email', 'smtp_host'], 'smtp.gmail.com')
-EMAIL_SMTP_PORT = int(_get(_conf, ['email', 'smtp_port'], 587))
-EMAIL_USE_TLS = bool(_get(_conf, ['email', 'use_tls'], True))
-EMAIL_USERNAME = _get(_conf, ['email', 'username'], '')
-EMAIL_PASSWORD = _get(_conf, ['email', 'password'], '')
+EMAIL_ENABLED = bool(os.getenv('EMAIL_ENABLED', False))
+EMAIL_SMTP_HOST = str(os.getenv('EMAIL_SMTP_HOST', False))
+EMAIL_SMTP_PORT = int(os.getenv('EMAIL_SMTP_PORT', 587))
+EMAIL_USE_TLS = True
+EMAIL_USERNAME = str(os.getenv('EMAIL_USERNAME', False))
+EMAIL_PASSWORD = str(os.getenv('EMAIL_PASSWORD', False))
 EMAIL_FROM_ADDRESS = _get(_conf, ['email', 'from_address'], EMAIL_USERNAME)
-EMAIL_DEFAULT_SENDER_NAME = _get(_conf, ['email', 'default_sender_name'], 'Inventarsystem')
-EMAIL_TIMEOUT_SECONDS = int(_get(_conf, ['email', 'timeout_seconds'], 30))
+EMAIL_DEFAULT_SENDER_NAME = "Invario Inventarsystem Sender"
+EMAIL_TIMEOUT_SECONDS = 20
 
 # School periods
 SCHOOL_PERIODS = _get(_conf, ['schoolPeriods'], DEFAULTS['schoolPeriods'])

config.json

@@ -21,12 +21,12 @@
     },
     "email": {
         "enabled": true,
-        "smtp_host": "mail.invario-software.de",
+        "smtp_host": "",
         "smtp_port": 587,
         "use_tls": true,
-        "username": "no-reply@invario-software.de",
-        "password": "#,EATwIn,68",
-        "from_address": "no-reply@invario-software.de",
+        "username": "",
+        "password": "",
+        "from_address": "",
         "default_sender_name": "Invario Email Service",
         "timeout_seconds": 30
     },