claypot

A simple cooking recipe manager.

Sample database

Use this command to load some sample data to your database.

$ ./manage.py loaddata ingredients_de.yaml units_de.yaml units_de_de.yaml test_recipes_de.yaml

Running tests

$ pytest --cov=claypot

Frontend

The frontend lives in frontend/ (Vue 2, built with Vite; node 24 or newer). It is not a site of its own: the build writes index.html, which Django renders as a template, and the bundles under js/ and css/ to claypot/templates/claypot/.

$ cd frontend
$ npm ci
$ npm run serve      # development build, rebuilds on every change
$ npm run build      # production build
$ npm run test:unit
$ npm run lint

With DJANGO_DEBUG=true Django serves /js/ and /css/ itself. In production the web server in front of it has to.

Logging in

claypot keeps no passwords. People log in at an OpenID Connect provider, which is configured through the environment:

Variable
OIDC_RP_CLIENT_ID, OIDC_RP_CLIENT_SECRET	the client registered at the provider
OIDC_OP_AUTHORIZATION_ENDPOINT, OIDC_OP_TOKEN_ENDPOINT, OIDC_OP_USER_ENDPOINT, OIDC_OP_JWKS_ENDPOINT	the provider's endpoints, as its discovery document names them
OIDC_RP_SIGN_ALGO	how the provider signs ID tokens, default ES256
OIDC_RP_SCOPES	default openid profile email

The redirect URL to register is https://<host>/oidc/callback/. The flow uses PKCE.

An account is linked to the provider's subject identifier at the first login. An account that existed before is found by its email address; anybody else gets a new one. Staff and superuser rights are given in the admin.

Without OIDC_RP_CLIENT_ID (development) there is no login in the frontend: create an account with ./manage.py createsuperuser, log in at /admin/ and open /accounts/login?done=1.

Deployment

The Dockerfile builds one image with the frontend inside. It runs gunicorn on port 8000 as an unprivileged user (uid 1000); the worker is the same image with python manage.py rqworker default.

Variable
DJANGO_SECRET_KEY	required
DATABASE_URL	required, PostgreSQL (postgresql://user:password@host/name)
DJANGO_ALLOWED_HOSTS	the host name(s) the site is served under
REDIS_HOST	the Redis instance of the job queue
MEDIA_ROOT	thumbnails and resized images, to be served as /media/
IMAGE_ROOT	the uploaded originals, not served
LANGUAGE_CODE, TIME_ZONE	default en-us, UTC

Before the first start and after every update:

$ python manage.py migrate
$ python manage.py collectstatic    # the admin's files, into /code/static

The web server in front serves /js/ and /css/ from /code/claypot/templates/claypot/ in the image, /static/ from what collectstatic wrote and /media/ from MEDIA_ROOT, passes everything else on, and sets X-Forwarded-Proto.