Build a Django app on floo

FROM python:3.13-slim

ENV PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

RUN apt-get update -qq && \
    apt-get install -y --no-install-recommends build-essential libpq-dev && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY requirements.txt ./
RUN pip install -r requirements.txt

COPY . .

RUN DJANGO_SECRET_KEY=collectstatic-only DATABASE_URL=sqlite:///:memory: python manage.py collectstatic --noinput

CMD ["sh", "-c", "gunicorn mysite.wsgi:application --bind 0.0.0.0:$PORT --workers 3"]

import os
from pathlib import Path
import dj_database_url

BASE_DIR = Path(__file__).resolve().parent.parent

DEBUG = os.environ.get("DJANGO_DEBUG", "false").lower() == "true"

# Fail the boot rather than serve production with a guessable key.
SECRET_KEY = os.environ.get("DJANGO_SECRET_KEY") or (
    "dev-only-do-not-use-in-prod" if DEBUG else ""
)
if not SECRET_KEY:
    raise RuntimeError("DJANGO_SECRET_KEY is not set for a production boot.")

# floo's edge sets X-Forwarded-Host. Trust it for ALLOWED_HOSTS.
ALLOWED_HOSTS = ["*"] if DEBUG else [
    ".getfloo.app",
    *[h for h in os.environ.get("DJANGO_ALLOWED_HOSTS", "").split(",") if h],
]

# Trust X-Forwarded-Proto so Django knows the request is HTTPS behind floo's edge.
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
USE_X_FORWARDED_HOST = True

# Cookies
SESSION_COOKIE_SECURE = not DEBUG
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = "Lax"
CSRF_COOKIE_SECURE = not DEBUG

# WhiteNoise serves collectstatic output
MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "whitenoise.middleware.WhiteNoiseMiddleware",
    # ... rest of your middleware
]

STATIC_ROOT = BASE_DIR / "staticfiles"
STORAGES = {
    "default": {"BACKEND": "django.core.files.storage.FileSystemStorage"},
    "staticfiles": {"BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage"},
}

# Database: read DATABASE_URL from floo
DATABASES = {
    "default": dj_database_url.parse(os.environ["DATABASE_URL"], conn_max_age=600),
}

[app]
name = "my-django-app"

[services.web]
type = "web"
path = "."
port = 8000
ingress = "public"
dev_command = "python manage.py runserver 0.0.0.0:8000"
migrate_command = "python manage.py migrate --noinput"

[managed.default]
type = "postgres"

[app]
name = "my-django-app"
access_mode = "accounts"

from dataclasses import dataclass

@dataclass
class FlooUser:
    id: str
    email: str
    name: str | None

class FlooUserMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        email = request.META.get("HTTP_X_FLOO_USER_EMAIL")
        user_id = request.META.get("HTTP_X_FLOO_USER_ID")
        name = request.META.get("HTTP_X_FLOO_USER_NAME")
        request.floo_user = FlooUser(id=user_id, email=email, name=name) if email else None
        return self.get_response(request)

MIDDLEWARE = [
    # ... existing entries
    "mysite.middleware.FlooUserMiddleware",
]

from django.http import HttpResponse, JsonResponse

def dashboard(request):
    if not request.floo_user:
        return HttpResponse(status=401)
    return JsonResponse({"hello": request.floo_user.email})