Feat/deployment script

.containerignore

@@ -0,0 +1,20 @@
+config.yaml
+run.py
+.git
+.venv
+.env
+.ruff_cache
+frontend
+.github
+docs
+Makefile
+.pre-commit-config.yaml
+LICENSE
+.gitignore
+.containerignore
+.gitmodules
+podman-compose.yaml
+__pycache__
+*.py[codz]
+**/__pycache__
+**/*.py[codz]

.env.example

@@ -14,8 +14,8 @@ SECRET_KEY=django-insecure-my-local-dev-secret-key
 # --- Infrastructure (REQUIRED) ---
 # Use a single URL for database and Redis connections.
 # Format: driver://user:password@host:port/dbname
-DATABASE__URL=postgres://admin:test@127.0.0.1:5432/coursereview
-REDIS__URL=redis://localhost:6379/0
+DATABASE__URL=postgres://admin:test@db:5432/coursereview
+REDIS__URL=redis://cache:6379/0
 
 # --- External Services Secrets (REQUIRED) ---
 TURNSTILE_SECRET_KEY=dummy0

.pre-commit-config.yaml

@@ -1,15 +1,28 @@
-repos:
+default_language_version:
+  python: 3.14
 
+repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
-      - id: check-yaml
       - id: check-added-large-files
+      - id: check-ast
+      - id: check-builtin-literals
+      - id: check-case-conflict
+      - id: check-illegal-windows-names
+      - id: check-json
+      - id: check-merge-conflict
+      - id: check-toml
+      - id: check-yaml
+      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: no-commit-to-branch
+      - id: pretty-format-json
+      - id: requirements-txt-fixer
+      - id: trailing-whitespace
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.5
+    rev: v0.15.2
     hooks:
       - id: ruff-check
         types_or: [python, pyi]

Containerfile

@@ -0,0 +1,20 @@
+FROM ghcr.io/astral-sh/uv:python3.14-trixie-slim AS builder
+
+WORKDIR /app
+
+COPY . /app
+
+RUN UV_PROJECT_ENVIRONMENT=/usr/local \
+    uv sync --project=/app --frozen --compile-bytecode --no-dev --no-editable --no-managed-python
+
+FROM gcr.io/distroless/base-debian13:nonroot
+
+COPY --from=builder /usr/local /usr/local
+
+COPY --from=builder /app /app
+
+WORKDIR /app
+
+USER nonroot
+
+ENTRYPOINT ["python", "scripts/entrypoint.py"]

apps/auth/utils.py

@@ -46,7 +46,7 @@ def get_survey_details(action: str) -> dict[str, Any] | None:
 
     try:
         question_id = int(action_details.get("QUESTIONID"))
-    except (ValueError, TypeError):
+    except ValueError, TypeError:
         logger.error(
             "Could not parse 'QUESTIONID' for action '%s'. Check your settings.", action
         )

apps/auth/views.py

@@ -240,7 +240,7 @@ def verify_callback_api(request):
         otp_data = json.loads(otp_data_raw.decode("utf-8"))
         expected_temp_token = otp_data.get("temp_token")
         initiated_at = otp_data.get("initiated_at")
-    except (json.JSONDecodeError, AttributeError):
+    except json.JSONDecodeError, AttributeError:
         logger.error("Invalid OTP data format in verify_callback_api")
         return Response({"error": "Invalid OTP data format"}, status=401)
 
@@ -268,7 +268,7 @@ def verify_callback_api(request):
                 status=401,
             )
 
-    except (ValueError, TypeError):
+    except ValueError, TypeError:
         logger.error("Error parsing submission timestamp")
         return Response({"error": "Invalid submission timestamp"}, status=401)
 

apps/web/views.py

@@ -134,7 +134,7 @@ def _filter_by_score(self, queryset):
                 try:
                     threshold = int(param_value)
                     queryset = queryset.filter(**{f"{field_name}__gte": threshold})
-                except (ValueError, TypeError):
+                except ValueError, TypeError:
                     pass
         return queryset
 

compose.dev.yaml

@@ -0,0 +1,34 @@
+services:
+  db:
+    ports:
+      - "5432:5432"
+
+  cache:
+    ports:
+      - "6379:6379"
+
+  backend:
+    build:
+      context: .
+      dockerfile: Containerfile
+    ports:
+      - "8000:8000"
+    env_file:
+      - .env
+    environment:
+      DATABASE__URL: ${DATABASE__URL:-postgres://admin:test@db:5432/coursereview}
+      REDIS__URL: ${REDIS__URL:-redis://cache:6379/0}
+    volumes:
+      - ./config.yaml:/app/config.yaml:ro
+
+  migrate:
+    build:
+      context: .
+      dockerfile: Containerfile
+    env_file:
+      - .env
+    environment:
+      DATABASE__URL: ${DATABASE__URL:-postgres://admin:test@db:5432/coursereview}
+      REDIS__URL: ${REDIS__URL:-redis://cache:6379/0}
+    volumes:
+      - ./config.yaml:/app/config.yaml:ro

compose.prod.yaml

@@ -0,0 +1,20 @@
+services:
+  backend:
+    ports:
+      - "8000:8000"
+    env_file:
+      - /etc/coursereview/secrets.env
+    environment:
+      DATABASE__URL: ${DATABASE__URL:-postgres://admin:test@db:5432/coursereview}
+      REDIS__URL: ${REDIS__URL:-redis://cache:6379/0}
+    volumes:
+      - /etc/coursereview/config.yaml:/app/config.yaml:ro
+
+  migrate:
+    env_file:
+      - /etc/coursereview/secrets.env
+    environment:
+      DATABASE__URL: ${DATABASE__URL:-postgres://admin:test@db:5432/coursereview}
+      REDIS__URL: ${REDIS__URL:-redis://cache:6379/0}
+    volumes:
+      - /etc/coursereview/config.yaml:/app/config.yaml:ro

compose.yaml

@@ -0,0 +1,61 @@
+services:
+  db:
+    image: postgres:18-alpine
+    volumes:
+      - postgres18_data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-coursereview}
+      POSTGRES_USER: ${POSTGRES_USER:-admin}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-test}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-admin} -d ${POSTGRES_DB:-coursereview}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  cache:
+    image: valkey/valkey:9-alpine
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  backend:
+    image: coursereview-backend
+    depends_on:
+      db:
+        condition: service_healthy
+      cache:
+        condition: service_healthy
+    environment:
+      PYTHONUNBUFFERED: "1"
+      GUNICORN_CMD_ARGS: "--control-socket /tmp/gunicorn.ctl --worker-tmp-dir /tmp"
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "python",
+          "-c",
+          "__import__('urllib.request').request.urlopen('http://127.0.0.1:8000/api/user/status/',timeout=5)",
+        ]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    restart: unless-stopped
+
+  migrate:
+    image: coursereview-backend
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      PYTHONUNBUFFERED: "1"
+    command: ["python", "django_manage.py", "migrate"]
+    restart: "no"
+
+volumes:
+  postgres18_data:

docs/setup.md

@@ -4,7 +4,7 @@
 
 - Ubuntu Linux (most modern Linux distros and MacOS are supposedly supported.)
 
-- Use your corresponding package manager. This guide uses ubuntu/debian's `apt`, python `uv`, modern javascript runtime and package manager `bun`.
+- Use your corresponding package manager. This guide uses ubuntu/debian's `apt`, python `uv`, modern javascript runtime, package manager `bun` and `podman`.
 
 - python 3.10 to 3.13
 
@@ -39,7 +39,9 @@
 8. Build static files: `make collect`
 
 9. Configure database
+
    1. Install Postgres:
+
       - `sudo apt update`
 
       - `sudo apt install postgresql`
@@ -53,6 +55,7 @@
    5. Switch to user postgres: `sudo -iu postgres`
 
    6. `psql`
+
       1. Initialize coursereview database, user and privileges
 
          ```sql
@@ -93,6 +96,7 @@
 11. `make run` and visit <http://127.0.0.1:8000/>
 
 12. Add local admin:
+
     1. `make createsuperuser`. The email can be blank. Use a strong password in production.
 
     2. Enter interactive python shell: `make shell`. (Different from directly running `python` from shell.)
@@ -104,11 +108,12 @@
        u = User.objects.last()
        u.is_active = True
        u.is_staff = True
-       u.is_admin = True
+       u.is_superuser = True
        u.save()
        ```
 
 13. Crawl data from JI official website:
+
     1. Edit `COURSE_DETAIL_URL_PREFIX` in `apps/spider/crawlers/orc.py`: Add a number after url param `id` like this: `...?id=23`, so only course id starting from 23 (e.g. 230-239, 2300) will be crawled, so as to save time during development. Remember not to commit this change.
 
     2. Enter interactive python shell: `make shell`.
@@ -121,9 +126,11 @@
        ```
 
 ## Frontend
+
 Two ways to run/develop the frontend:
 
 1. Git submodule (in `CourseReview/frontend`):
+
    - `cd CourseReview` and run `git submodule update --init --recursive`
    - Dev server: `make dev-frontend` (visit http://127.0.0.1:5173/)
    - Development workflow: `cd CourseReview/frontend` (treat it like a normal repo)
@@ -133,7 +140,9 @@ Two ways to run/develop the frontend:
    - Dev server: `cd CourseFront` then `bun run dev` (visit http://127.0.0.1:5173/)
 
 ### Set up
+
 From the frontend directory (`CourseReview/frontend` or `CourseFront`):
+
 1. `cp .env.example .env`
 
 2. `bun install`