Make Settings consistent with scancodeio

Inspired by scancodeio, we now have a consistent ALLOWED_HOSTS
environment variable support. SECRET_KEY no longer defaults to insecure
values and is required to be generated. Static files are now served in
/var/vulnerablecode/static which is consistent to scancodeio.

Signed-off-by: Hritik Vijay <hritikxx8@gmail.com>

Author: Hritik14

requirements.txt

@@ -16,3 +16,4 @@ python-dateutil>=2.8.1
 toml>=0.10.2
 lxml>=4.6.3
 gunicorn>=20.1.0
+django-environ==0.4.5

vulnerablecode/settings.py

@@ -1,35 +1,21 @@
-"""
-Django settings for app project.
+from pathlib import Path
 
-Generated by 'django-admin startproject' using Django 1.11.
+import environ
 
-For more information on this file, see
-https://docs.djangoproject.com/en/1.11/topics/settings/
+PROJECT_DIR = Path(__file__).resolve().parent
+ROOT_DIR = PROJECT_DIR.parent
 
-For the full list of settings and their values, see
-https://docs.djangoproject.com/en/1.11/ref/settings/
-"""
+# Environment
 
-import os
+env_file = str(ROOT_DIR.joinpath(".env"))
+if Path(env_file).exists():
+    environ.Env.read_env(env_file)
 
+env = environ.Env(TRAVIS=(bool, False))
 
-# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
-BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+SECRET_KEY = env.str("SECRET_KEY")
 
-# Quick-start development settings - unsuitable for production
-# See https://docs.djangoproject.com/en/1.11/howto/deployment/checklist/
-
-# SECURITY WARNING: keep the secret key used in production secret!
-DEBUG = False
-SECRET_KEY = os.environ.get(
-    "SECRET_KEY", default="this-is-a-dummy-key-and-its-overridden-for-prod-servers"
-)
-
-# SECURITY WARNING: don't run with debug turned on in production!
-
-DEBUG_PROPAGATE_EXCEPTIONS = True
-
-ALLOWED_HOSTS = os.environ.get("VC_ALLOWED_HOSTS", "*").split(":")
+ALLOWED_HOSTS = env.list("ALLOWED_HOSTS", default=[".localhost", "127.0.0.1", "[::1]"])
 
 # Application definition
 
@@ -62,7 +48,7 @@
 TEMPLATES = [
     {
         "BACKEND": "django.template.backends.django.DjangoTemplates",
-        "DIRS": [os.path.join(BASE_DIR, "templates")],
+        "DIRS": [str(PROJECT_DIR.joinpath("templates"))],
         "APP_DIRS": True,
         "OPTIONS": {
             "debug": False,
@@ -81,20 +67,19 @@
 
 
 # Database
-# https://docs.djangoproject.com/en/1.11/ref/settings/#databases
 
 DATABASES = {
     "default": {
-        "ENGINE": "django.db.backends.postgresql",
-        "NAME": os.environ.get("VC_DB_NAME", "vulnerablecode"),
-        "USER": os.environ.get("VC_DB_USER", "vulnerablecode"),
-        "PASSWORD": os.environ.get("VC_DB_PASSWORD", "vulnerablecode"),
-        "HOST": os.environ.get("VC_DB_HOST", "localhost"),
-        "PORT": os.environ.get("VC_DB_PORT", "5432"),
+        "ENGINE": env.str("VULNERABLECODE_DB_ENGINE", "django.db.backends.postgresql"),
+        "NAME": env.str("VULNERABLECODE_DB_NAME", "vulnerablecode"),
+        "USER": env.str("VULNERABLECODE_DB_USER", "vulnerablecode"),
+        "PASSWORD": env.str("VULNERABLECODE_DB_PASSWORD", "vulnerablecode"),
+        "HOST": env.str("VULNERABLECODE_DB_HOST", "localhost"),
+        "PORT": env.str("VULNERABLECODE_DB_PORT", "5432"),
     }
 }
 
-if "TRAVIS" in os.environ:
+if env("TRAVIS"):
     DATABASES["default"]["USER"] = "postgres"
     DATABASES["default"]["PASSWORD"] = ""
 
@@ -122,7 +107,6 @@
 
 
 # Internationalization
-# https://docs.djangoproject.com/en/1.11/topics/i18n/
 
 LANGUAGE_CODE = "en-us"
 
@@ -136,11 +120,15 @@
 
 
 # Static files (CSS, JavaScript, Images)
-# https://docs.djangoproject.com/en/1.11/howto/static-files/
 
-STATIC_ROOT = os.path.join(BASE_DIR, "static")
 STATIC_URL = "/static/"
 
+STATIC_ROOT = "/var/vulnerablecode/static"
+
+STATICFILES_DIRS = [
+    str(PROJECT_DIR.joinpath("static")),
+]
+
 # REST API
 REST_FRAMEWORK = {
     "DEFAULT_FILTER_BACKENDS": ("django_filters.rest_framework.DjangoFilterBackend",),