feat: Upgrade to maple

Patches related to nginx are removed and Caddy is now being used as a reverse proxy.
In addition, application log storage has been moved in order to run as
non-root. The local log handler was removed.

.gitlab-ci.yml

@@ -2,7 +2,7 @@ variables:
     TUTOR_PLUGIN: discovery
     TUTOR_IMAGES: discovery
     TUTOR_PYPI_PACKAGE: tutor-discovery
-    OPENEDX_RELEASE: lilac
+    OPENEDX_RELEASE: maple
     GITHUB_REPO: overhangio/tutor-discovery
 
 include:

setup.py

@@ -29,7 +29,7 @@ setup(
     long_description=readme,
     packages=find_packages(exclude=["tests*"]),
     include_package_data=True,
-    install_requires=["tutor>=12.0.0,<13.0.0"],
+    install_requires=["tutor>=13.0.0,<14.0.0"],
     python_requires=">=3.5",
     entry_points={"tutor.plugin.v0": ["discovery = tutordiscovery.plugin"]},
     classifiers=[

tutordiscovery/__about__.py

@@ -1,2 +1 @@
-__version__ = "12.0.4"
-
+__version__ = "13.0.0"

tutordiscovery/patches/caddyfile

@@ -1,4 +1,8 @@
 # Discovery
-{{ DISCOVERY_HOST }}{% if not ENABLE_HTTPS %}:80{% endif %} {
-    reverse_proxy nginx:80
-}
+{{ DISCOVERY_HOST }}{$default_site_port} {
+    request_body {
+        max_size 10MB
+    }
+
+    import proxy "discovery:8000"
+}

tutordiscovery/patches/k8s-deployments

@@ -14,6 +14,9 @@ spec:
       labels:
         app.kubernetes.io/name: discovery
     spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
       containers:
         - name: discovery
           image: {{ DISCOVERY_DOCKER_IMAGE }}
@@ -26,6 +29,8 @@ spec:
             - mountPath: /openedx/discovery/course_discovery/settings/tutor/production.py
               name: settings
               subPath: production.py
+          securityContext:
+            allowPrivilegeEscalation: false
       volumes:
         - name: settings
           configMap:

tutordiscovery/patches/nginx-extra

@@ -1,19 +0,0 @@
-# Course discovery service
-upstream discovery-backend {
-    server discovery:8000 fail_timeout=0;
-}
-server {
-  listen 80;
-  server_name {{ DISCOVERY_HOST }};
-
-  # Disables server version feedback on pages and in headers
-  server_tokens off;
-
-  client_max_body_size 10m;
-
-  location / {
-    proxy_set_header Host $http_host;
-    proxy_redirect off;
-    proxy_pass http://discovery-backend;
-  }
-}

tutordiscovery/templates/discovery/apps/settings/partials/common.py

@@ -53,11 +53,12 @@ EMAIL_HOST_USER = "{{ SMTP_USERNAME }}"
 EMAIL_HOST_PASSWORD = "{{ SMTP_PASSWORD }}"
 EMAIL_USE_TLS = {{ SMTP_USE_TLS }}
 
-LOGGING["handlers"]["local"] = {
-    "class": "logging.handlers.WatchedFileHandler",
-    "filename": "/var/log/discovery.log",
-    "formatter": "standard",
-}
+# Get rid of the "local" handler
+LOGGING["handlers"].pop("local")
+for logger in LOGGING["loggers"].values():
+    if "local" in logger["handlers"]:
+        logger["handlers"].remove("local")
+# Decrease verbosity of algolia logger
 LOGGING["loggers"]["algoliasearch_django"] = {"level": "WARNING"}
 
 OAUTH_API_TIMEOUT = 5
@@ -92,4 +93,3 @@ EDX_DRF_EXTENSIONS = {
 }
 
 {{ patch("discovery-common-settings") }}
-

tutordiscovery/templates/discovery/build/discovery/Dockerfile

@@ -6,6 +6,10 @@ RUN apt update && \
   build-essential libffi-dev libmysqlclient-dev libxml2-dev libxslt-dev libjpeg-dev libssl-dev
 ENV LC_ALL en_US.UTF-8
 
+ARG APP_USER_ID=1000
+RUN useradd --home-dir /openedx --create-home --shell /bin/bash --uid ${APP_USER_ID} app
+USER ${APP_USER_ID}
+
 ARG DISCOVERY_REPOSITORY=https://github.com/edx/course-discovery.git
 ARG DISCOVERY_VERSION={{ OPENEDX_COMMON_VERSION }}
 RUN mkdir -p /openedx/discovery && \
@@ -19,7 +23,7 @@ ENV DISCOVERY_CFG /openedx/config.yml
 # Install python venv
 RUN python3 -m venv ../venv/
 ENV PATH "/openedx/venv/bin:$PATH"
-RUN pip install setuptools==44.1.0 pip==20.0.2 wheel==0.34.2
+RUN pip install setuptools==44.1.0 pip==20.3.4 wheel==0.37.0
 
 # Install a recent version of nodejs
 RUN pip install nodeenv
@@ -35,13 +39,13 @@ RUN npm install --verbose --registry=$NPM_REGISTRY --production
 RUN ./node_modules/.bin/bower install --allow-root --production
 
 # Install django-redis for using redis as a django cache
-RUN pip install django-redis==4.12.1
+RUN pip install django-redis==5.0.0
 
 # Install uwsgi
-RUN pip install uwsgi==2.0.19.1
+RUN pip install uwsgi==2.0.20
 
 # Collect static assets
-COPY assets.py ./course_discovery/settings/assets.py
+COPY --chown=app:app assets.py ./course_discovery/settings/assets.py
 ENV DJANGO_SETTINGS_MODULE course_discovery.settings.assets
 RUN make static
 

tutordiscovery/templates/discovery/build/discovery/assets.py

@@ -1,10 +1,10 @@
 from .base import *
 
-LOGGING["handlers"]["local"] = {
-    "class": "logging.handlers.WatchedFileHandler",
-    "filename": "/var/log/discovery.log",
-    "formatter": "standard",
-}
-
 COMPRESS_ENABLED = True
 COMPRESS_OFFLINE = True
+
+# Get rid of the "local" handler
+LOGGING["handlers"].pop("local")
+for logger in LOGGING["loggers"].values():
+    if "local" in logger["handlers"]:
+        logger["handlers"].remove("local")