Django AWS EC2 Nginx Gunicorn (ตอน 2)

ติดต่อเรา

python

from django.contrib import admin
from django.urls import path, include
 
urlpatterns = [
    path("admin/", admin.site.urls),
    path("api/", include("djoser.urls")),
    path("api/", include("users.urls")),
]

python

AWS_SES_ACCESS_KEY_ID="" # ตรงนี้ต้องแก้ ตามเลข 2
AWS_SES_SECRET_ACCESS_KEY="" # ตรงนี้ต้องแก้ ตามเลข 3
 
AWS_SES_FROM_EMAIL="[email protected]" # ตรงนี้ต้องแก้ ตามอีเมลที่เรากำหนดใน Verified identities ใช้ gmail ก็ได้ครับ

nginx

[Unit]
Description=gunicorn daemon
Requires=gunicorn.socket
After=network.target
 
[Service]
User=<your-user>
Group=www-data
WorkingDirectory=<Project-Directory-Root>
Environment="PATH=/home/<your-user>/<your-project>/env/bin"
ExecStart=path-to-gunicorn \
          --access-logfile - \
          --workers 3 \
          --bind unix:/run/gunicorn.sock \
 <your-project>.wsgi:application
 
[Install]
WantedBy=multi-user.target

nginx

[Unit]
Description=gunicorn daemon
Requires=gunicorn.socket
After=network.target
 
[Service]
User=django
Group=www-data
WorkingDirectory=/home/django/django-auth
Environment="PATH=/home/django/django-auth/env/bin"
ExecStart=/home/django/django-auth/env/bin/gunicorn \
          --access-logfile - \
          --workers 3 \
          --bind unix:/run/gunicorn.sock \
 django_auth.wsgi:application
 
[Install]
WantedBy=multi-user.target

bash

❯ sudo systemctl daemon-reload
❯ sudo systemctl start gunicorn
❯ sudo systemctl enable gunicorn
Created symlink /etc/systemd/system/multi-user.target.wants/gunicorn.service → /etc/systemd/system/gunicorn.service.

Django AWS EC2 Nginx Gunicorn (ตอน 2) | Bunchee

nginx

server {
    listen 80;
    server_name server_domain_or_IP;
 
    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/<your-user>/<your-project>;
    }
 
    location / {
        include proxy_params;
        proxy_pass http://unix:/run/gunicorn.sock;
    }
}

nginx

server {
    listen 80;
    server_name staging-auth-api.example.com;
 
    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/django/django-auth;
    }
 
    location / {
        include proxy_params;
        proxy_pass http://unix:/run/gunicorn.sock;
    }
}

python

from django.db import models
from django.contrib.auth.models import (
    BaseUserManager,
    AbstractBaseUser,
    PermissionsMixin,
)
 
 
class UserAccountManager(BaseUserManager):
    def create_user(self, email, password=None, **kwargs):
        if not email:
            raise ValueError("โปรดใส่อีเมลด้วยค่ะ")
 
        email = self.normalize_email(email)
        email = email.lower()
 
        user = self.model(email=email, **kwargs)
 
        user.set_password(password)
        user.save(using=self._db)
        return user
 
    def create_superuser(self, email, password=None, **kwargs):
        user = self.create_user(
            email,
            password=password,
            **kwargs
        )
        user.is_staff = True
        user.is_superuser = True
        user.save(using=self._db)
        return user
 
 
class UserAccount(AbstractBaseUser, PermissionsMixin):
    first_name = models.CharField(max_length=255)
    last_name = models.CharField(max_length=255)
    email = models.EmailField(
        max_length=255,
        unique=True,
    )
    is_active = models.BooleanField(default=True)
    is_staff = models.BooleanField(default=False)
    is_superuser = models.BooleanField(default=False)
 
    objects = UserAccountManager()
 
    USERNAME_FIELD = "email"
    REQUIRED_FIELDS = ["first_name", "last_name"]
 
    def __str__(self):
        return self.email

python

from django.conf import settings
from rest_framework_simplejwt.authentication import JWTAuthentication
 
 
class CustomJWTAuthentication(JWTAuthentication):
    def authenticate(self, request):
        try:
            header = self.get_header(request)
            if header is None:
                raw_token = request.COOKIES.get(settings.AUTH_COOKIE)
            else:
                raw_token = self.get_raw_token(header)
 
            if raw_token is None:
                return None
            validated_token = self.get_validated_token(raw_token)
 
            return self.get_user(validated_token), validated_token
        except Exception:
            return None

python

from django.conf import settings
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import status
from djoser.social.views import ProviderAuthView
from rest_framework_simplejwt.views import (
    TokenObtainPairView,
    TokenRefreshView,
    TokenVerifyView,
)
 
 
class CustomProviderAuthView(ProviderAuthView):
    def post(self, request, *args, **kwargs):
        response = super().post(request, *args, **kwargs)
 
        if response.status_code == 201:
            access_token = response.data.get("access")
            refresh_token = response.data.get("refresh")
 
            response.set_cookie(
                "access",
                access_token,
                max_age=settings.AUTH_COOKIE_ACCESS_MAX_AGE,
                path=settings.AUTH_COOKIE_PATH,
                secure=settings.AUTH_COOKIE_SECURE,
                httponly=settings.AUTH_COOKIE_HTTP_ONLY,
                samesite=settings.AUTH_COOKIE_SAMESITE,
            )
 
            response.set_cookie(
                "refresh",
                refresh_token,
                max_age=settings.AUTH_COOKIE_REFRESH_MAX_AGE,
                path=settings.AUTH_COOKIE_PATH,
                secure=settings.AUTH_COOKIE_SECURE,
                httponly=settings.AUTH_COOKIE_HTTP_ONLY,
                samesite=settings.AUTH_COOKIE_SAMESITE,
            )
 
        return response
 
 
class CustomTokenObtainPairView(TokenObtainPairView):
    def post(self, request, *args, **kwargs):
        response = super().post(request, *args, **kwargs)
 
        if response.status_code == 200:
            access_token = response.data.get("access")
            refresh_token = response.data.get("refresh")
 
            response.set_cookie(
                "access",
                access_token,
                max_age=settings.AUTH_COOKIE_ACCESS_MAX_AGE,
                path=settings.AUTH_COOKIE_PATH,
                secure=settings.AUTH_COOKIE_SECURE,
                httponly=settings.AUTH_COOKIE_HTTP_ONLY,
                samesite=settings.AUTH_COOKIE_SAMESITE,
            )
 
            response.set_cookie(
                "refresh",
                refresh_token,
                max_age=settings.AUTH_COOKIE_REFRESH_MAX_AGE,
                path=settings.AUTH_COOKIE_PATH,
                secure=settings.AUTH_COOKIE_SECURE,
                httponly=settings.AUTH_COOKIE_HTTP_ONLY,
                samesite=settings.AUTH_COOKIE_SAMESITE,
            )
        return response
 
 
class CustomTokenRefreshView(TokenRefreshView):
    def post(self, request, *args, **kwargs):
        refresh_token = request.COOKIES.get("refresh")
 
        if refresh_token:
            request.data["refresh"] = refresh_token
 
        response = super().post(request, *args, **kwargs)
 
        if response.status_code == 200:
            access_token = response.data.get("access")
 
            response.set_cookie(
                "access",
                access_token,
                max_age=settings.AUTH_COOKIE_ACCESS_MAX_AGE,
                path=settings.AUTH_COOKIE_PATH,
                secure=settings.AUTH_COOKIE_SECURE,
                httponly=settings.AUTH_COOKIE_HTTP_ONLY,
                samesite=settings.AUTH_COOKIE_SAMESITE,
            )
 
        return response
 
 
class CustomTokenVerifyView(TokenVerifyView):
    def post(self, request, *args, **kwargs):
        access_token = request.COOKIES.get("access")
        if access_token:
            request.data["token"] = access_token
 
        return super().post(request, *args, **kwargs)
 
 
class LogoutView(APIView):
    def post(self, request, *args, **kwargs):
        response = Response(status=status.HTTP_204_NO_CONTENT)
        response.delete_cookie("access")
        response.delete_cookie("refresh")
 
        return response

python

from django.urls import path, re_path
from .views import (
    CustomProviderAuthView,
    CustomTokenObtainPairView,
    CustomTokenRefreshView,
    CustomTokenVerifyView,
    LogoutView,
)
 
urlpatterns = [
    re_path(
        r"^o/(?P<provider>\S+)/$",
        CustomProviderAuthView.as_view(),
        name="provider-auth",
    ),
    path("jwt/create/", CustomTokenObtainPairView.as_view()),
    path("jwt/refresh/", CustomTokenRefreshView.as_view()),
    path("jwt/verify/", CustomTokenVerifyView.as_view()),
    path("logout/", LogoutView.as_view()),
]

bash

❯ python manage.py migrate
/home/django/django-auth
False
Operations to perform:
  Apply all migrations: admin, auth, contenttypes, django_ses, sessions, social_django, users
Running migrations:
  Applying contenttypes.0001_initial... OK
  Applying contenttypes.0002_remove_content_type_name... OK
  Applying auth.0001_initial... OK
  Applying auth.0002_alter_permission_name_max_length... OK
  Applying auth.0003_alter_user_email_max_length... OK
  Applying auth.0004_alter_user_username_opts... OK
  Applying auth.0005_alter_user_last_login_null... OK
  Applying auth.0006_require_contenttypes_0002... OK
  Applying auth.0007_alter_validators_add_error_messages... OK
  Applying auth.0008_alter_user_username_max_length... OK
  Applying auth.0009_alter_user_last_name_max_length... OK
  Applying auth.0010_alter_group_name_max_length... OK
  Applying auth.0011_update_proxy_permissions... OK
  Applying auth.0012_alter_user_first_name_max_length... OK
  Applying users.0001_initial... OK
  Applying admin.0001_initial... OK
  Applying admin.0002_logentry_remove_auto_add... OK
  Applying admin.0003_logentry_add_action_flag_choices... OK
  Applying django_ses.0001_initial... OK
  Applying sessions.0001_initial... OK
  Applying social_django.0001_initial... OK
  Applying social_django.0002_add_related_name... OK
  Applying social_django.0003_alter_email_max_length... OK
  Applying social_django.0004_auto_20160423_0400... OK
  Applying social_django.0005_auto_20160727_2333... OK
  Applying social_django.0006_partial... OK
  Applying social_django.0007_code_timestamp... OK
  Applying social_django.0008_partial_timestamp... OK
  Applying social_django.0009_auto_20191118_0520... OK
  Applying social_django.0010_uid_db_index... OK
  Applying social_django.0011_alter_id_fields... OK
  Applying social_django.0012_usersocialauth_extra_data_new... OK
  Applying social_django.0013_migrate_extra_data... OK
  Applying social_django.0014_remove_usersocialauth_extra_data... OK
  Applying social_django.0015_rename_extra_data_new_usersocialauth_extra_data... OK

bash

❯ python manage.py runserver
/home/django/django-auth
False
/home/django/django-auth
False
Performing system checks...
 
System check identified no issues (0 silenced).
December 12, 2023 - 13:03:27
Django version 5.0, using settings 'django_auth.settings'
Starting development server at http://127.0.0.1:8000/
Quit the server with CONTROL-C.

bash

❯ sudo certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): [email protected]
 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
 
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: staging-auth-api.example.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Requesting a certificate for staging-auth-api.example.com
 
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/staging-auth-api.example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/staging-auth-api.example.com/privkey.pem
This certificate expires on 2024-03-11.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
 
Deploying certificate
Successfully deployed certificate for staging-auth-api.example.com to /etc/nginx/sites-enabled/django-auth
Congratulations! You have successfully enabled HTTPS on https://staging-auth-api.example.com
 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Django AWS EC2 Nginx Gunicorn (ตอน 2)

แก้ไขไฟล์ตามนี้

django_auth/urls.py

users/models.py

users/authentication.py

users/views.py

users/urls.py

Social Authentication

Google OAuth2

Facebook OAuth2

AWS SES

วิธีสร้างอีเมล เพื่อทดสอบ AWS SES

SES SMTP Credential

Custom Domain Name

Development -> Production

Gunicorn

systemd socket

systemd service

Restart Gunicorn

Nginx

sites-available

sites-enabled

ทดสอบ nginx

เปิดพอร์ตให้ nginx

run คำสั่ง Django 3 คำสั่ง

Collectstatic

enable HTTPS ด้วย Certbot

สรุปการ Deploy Django บน EC2 Nginx

วิธีแก้ Certbot fail

เอกสารอ้างอิง

ความคิดเห็น