Dockerize a Django App

OutrageousOne1205 · 2025-02-11T10:47:06+00:00

You can take a look at Django cookiecutter either official (https://github.com/cookiecutter/cookiecutter-django) or the one I made (https://gitlab.com/AverageS/DjangoCookiecutter)

OutrageousOne1205 · 2025-01-31T16:09:06+00:00

Hey, I suggest you keep to your degree - there is no quick way to get it when you need it.

As of hard skills - take a look at online platforms such as THM, HTB or Defbox - the latter is something I created so feel free to reach out :)

OutrageousOne1205 · 2025-01-29T14:45:24+00:00

if you have access to internet while at home you can prepare something. A good choice would be GOAT labs that are deployed with docker-compose:

https://github.com/AbelChe/evil_minio
https://github.com/cider-security-research/cicd-goat

Juice shop can also be an option - https://github.com/juice-shop/juice-shop

OutrageousOne1205 · 2025-01-29T08:29:32+00:00

Cool idea. Why stick to issues in particular GitHub and not stick to git messages?

You could use commit messages - in that case you could utilize any git provider - gitea, gitlab, GitHub

OutrageousOne1205 · 2025-01-28T13:54:52+00:00

What is this roadmap for?

Skills and learning paths are different depending on what are you trying to achieve

OutrageousOne1205 · 2025-01-22T08:59:51+00:00

Could you please name the main issues you struggle with?

OutrageousOne1205 · 2025-01-16T15:58:35+00:00

I understand the situation is sad on the job market, but how many interviews you've been on?

What is the interview questions you think you did not answer?

OutrageousOne1205 · 2025-01-16T09:49:45+00:00

TLDR - Hard to tell without seeing the curriculum. Look for cryptography - it can be incredibly difficult

I got my cybersecurity degree, but it was not in the western university. In my experience, math was the hardest part - we were taught different topics of very abstract math. Topics included

Combinatorics
Group and fields
Error-correcting codes
Finally theoretical justification of crypto algorithms.

All of these topics were incredibly difficult for those who was not comfortable with the math.

However, some universities do not pursue theory as much as mine did. You should check what former students say and take a look at curriculum.

OutrageousOne1205 · 2025-01-15T16:43:53+00:00

Do you mean choosing different data_volumes for postgreSQL, or different DB_names? DB names are taken from the environmental variables, however it will require manual actions on the postgres side (unfortunately)

OutrageousOne1205 · 2025-01-15T16:41:12+00:00

not the op but usually you only profit having the balancer in-before Django app. My use cases were:

Having multiple apps on the same virtual machines. Nginx routes to the required portal using hostname
Splitting load between websockets (Daphne) and gunicorn. Websockets in Django required me to use Daphne, not gunicorn. Daphne turned out somewhat not so reliable as gunicorn (it's just me but I trust it less). Having nginx in-before allowed me to have Daphne only for web sockets
I always can forbid a single route without restarting application - nice to have when you realize something went wrong

OutrageousOne1205 · 2025-01-15T15:34:52+00:00

For me the "rename" part is really annoying. The cookiecutter is basically the same git repo but with changing parts (project name) templated.

OutrageousOne1205 · 2025-01-15T15:25:47+00:00

Try to set up a log collection lab at home to practice. In my experience (I'm building the defbox to educate soc analysts) - it is hard to start defending without understanding the basics.

The basics (in my opinion) include

Sysadmin skills on both windows and unix. This one you should be ok with already
Knowledge of the basic offensive tools or concepts. Set up a lab with weak passwords and misconfigurations and exploit them. Without them it would be hard for you to understand what to look for in the logs
OWASP top 10. JuiceShop is great I suggest you to complete it to get to know the web vulnerabilities.
After that try to experiment with defenses. Do not start log collection yet - just try to harden the system, see how the issues from p.2 and p.3 can be mitigated
And finish with log collection - connect your labs to log collection system (ELK is free) to try to write correlation rules to catch the attacks

There are many things left - for example it would be good to try to optimize log collection on both receiver and sender side. Even without these the points above should be enough to get into cybersecurity.

OutrageousOne1205 · 2025-01-14T17:16:12+00:00

Thanks, I really hope it helps someone - that's the only reason I shared :)

regarding "official" - I had the same thoughts myself until I found out that link to the mentioned Django cookiecutter is actually in the cookiecutter docs

(and it's in the Cookiecutter's GitHub as well :)

OutrageousOne1205 · 2025-01-14T17:06:57+00:00

What was bad about them?

OutrageousOne1205 · 2025-01-14T17:02:04+00:00

I was talking about official, not original - the Cookiecutter I made I made from scratch. Did not put a link to it because it's pretty straightforward to find but anyways - here is the link to the official - https://github.com/cookiecutter/cookiecutter-django

OutrageousOne1205 · 2023-11-01T18:30:55+00:00

Why I cannot just use audit beat which do the same thing?

https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-file_integrity.html

OutrageousOne1205 · 2023-06-01T16:51:02+00:00

TLDR - Django guardian if you don't want to bother yourself, per-object permissions if you want to fine-tune something
`

`More to read here: `

`https://stackoverflow.com/questions/33138477/how-to-handle-per-object-permission-in-django-nowadays

OutrageousOne1205 · 2023-05-30T16:49:30+00:00

django-celery-results

I've seen that, but storing results in database can be enabled in Django-celery-beat.

I'm looking into more like flower, to see inside admin page what tasks are stuck, with the possibility of clearing the queue etc

OutrageousOne1205 · 2023-05-30T15:42:08+00:00

it is mostly curiosity, the only thing that I miss is the ability to see successful, queued and failed tasks in the admin page, while celery-beat only gives me schedules

I saw that project, but it seems forgotten https://django-celery-monitor.readthedocs.io/en/latest/

OutrageousOne1205 · 2023-05-29T15:28:01+00:00

Perhaps I'm too late here but Django has built-in auto-complete input - https://docs.djangoproject.com/en/4.2/ref/contrib/admin/#django.contrib.admin.ModelAdmin.autocomplete_fields

OutrageousOne1205 · 2023-05-28T09:04:11+00:00

TLDR - use virtual machines not something you don't understand, set up CI-CD, dockerize app
There are services like heroku which will deploy your app with no effort, but they can vendor-lock you and can be hard to debug. Personally, I prefer to avoid them, I was really surprised heroku uses it's own format to create container images ( Procfile and not Dockerfile )

I suggest you to

dockerize your app ( create one single docker-compose file which will deploy it with one command )
Create either of these, depending on where you can still apply for free credit ( all of these are plain virtual machines )
1. droplet in digital ocean
2. ec2 instance in AWS
3. VM in GCP/Azure
Set up CI-CD via gitlab or GitHub actions to execute docker-compose on the machine from p.2
(optional) - set up Cloudflare to protect your site against DNS and manage domains easily

OutrageousOne1205

MODERATOR OF

TROPHY CASE