Disable some security options in django settings.

.gitignore

@@ -2,3 +2,4 @@
 *.log
 *.log
 *.sass-cache/
+/web/mailman-web/settings_local.py

docker-compose.yaml

@@ -15,6 +15,7 @@ services:
     - database
     environment:
     - DATABASE_URL=postgres://mailman:mailmanpass@database/mailmandb
+    - HYPERKITTY_API_KEY=someapikey
     networks:
       mailman:
         ipv4_address: 172.19.199.2
@@ -38,6 +39,7 @@ services:
     - UWSGI_WORKERS=2
     - UWSGI_THREADS=4
     - DATABASE_URL=postgres://mailman:mailmanpass@database/mailmandb
+    - HYPERKITTY_API_KEY=someapikey
     networks:
       mailman:
         ipv4_address: 172.19.199.3

web/README.md

@@ -43,6 +43,9 @@ change them unless you know what you want.
 
 - `SMTP_PORT`: Port used for SMTP. Default is `25`.
 
+- `DJANGO_LOG_URL`: Path to the django's log file. Defaults to
+  `/opt/mailman-web-data/logs/mailmanweb.log`.
+
 Running
 =======
 

web/assets/run.sh

@@ -94,7 +94,7 @@ python manage.py migrate
 # to /opt/mailman-web/logs/uwsgi.log
 # It can also point to a logging daemon accessible at a URL.
 if [[ -z "$UWSGI_LOG_URL" ]]; then
-	echo "No $UWSGI_LOG_URL defined, logging uwsgi to /opt/mailman-web-data/logs/uwsgi.log ..."
+	echo "No UWSGI_LOG_URL defined, logging uwsgi to /opt/mailman-web-data/logs/uwsgi.log ..."
 	export UWSGI_LOG_URL='/opt/mailman-web-data/logs/uwsgi.log'
 	if [[ ! -e "$UWSGI_LOG_URL" ]]; then
 		touch "$UWSGI_LOG_URL"
@@ -103,7 +103,7 @@ fi
 
 if [[ -z "$UWSGI_WSGI_FILE" ]]; then
 	export UWSGI_WSGI_FILE="wsgi.py"
-	export UWSGI_HTTP=":8000"
+	export UWSGI_HTTP=:8000
 	export UWSGI_WORKERS=2
 	export UWSGI_THREADS=4
 fi

web/mailman-web/settings.py

@@ -48,9 +48,10 @@ SITE_ID = 1
 ALLOWED_HOSTS = [
     "localhost",  # Archiving API from Mailman, keep it.
     # "lists.your-domain.org",
-    os.environ.get('SERVE_FROM_DOMAIN'),
     # Add here all production URLs you may have.
     "mailman-web",
+    "172.19.199.3",
+    os.environ.get('SERVE_FROM_DOMAIN'),
 ]
 
 # Mailman API credentials
@@ -168,12 +169,12 @@ SECURE_REDIRECT_EXEMPT = [
     # Request from Mailman.
     "archives/api/mailman/.*",
      ]
-SESSION_COOKIE_SECURE = True
+# SESSION_COOKIE_SECURE = True
 # SECURE_CONTENT_TYPE_NOSNIFF = True
-SECURE_BROWSER_XSS_FILTER = True
-CSRF_COOKIE_SECURE = True
+# SECURE_BROWSER_XSS_FILTER = True
+# CSRF_COOKIE_SECURE = True
 # CSRF_COOKIE_HTTPONLY = True
-X_FRAME_OPTIONS = 'DENY'
+# X_FRAME_OPTIONS = 'DENY'
 
 
 # Password validation
@@ -401,7 +402,7 @@ LOGGING = {
             'level': 'INFO',
             'class': 'logging.handlers.RotatingFileHandler',
             #'class': 'logging.handlers.WatchedFileHandler',
-            'filename': '/opt/mailman-web-data/logs/mailmanweb.log',
+            'filename': os.environ.get('DJANGO_LOG_URL','/opt/mailman-web-data/logs/mailmanweb.log'),
             'formatter': 'verbose',
         },
         'console': {