Merge main into production Nov24

.env.example

@@ -1,13 +1,24 @@
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY="7(2w1sedok=aznpq)ta1mc4i%4h=xx@hxwx*o57ctsuml0x%fr"
+# SECRET_KEY="7(2w1sedok=aznpq)ta1mc4i%4h=xx@hxwx*o57ctsuml0x%fr"
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG=false
-USE_HTTPS=true
-
+# Your domain ("example.com"). If running development on localhost, set this to localhost
 DOMAIN=your.domain.here
+# This is the email address registered by certbot when you set up https in production
 EMAIL=your@email.here
 
+# If you use letsencrypt and get https directly to nginx, use https mode,
+
+# if you have something in front of nginx, like traefik/ngrok/apache that handles certificates and
+# you want to pass just http to nginx, use reverse_proxy mode.
+# For local development, use 'reverse_proxy' config to allow testing/development without an ssl certificate.
+#
+# If NGINX_SETUP is not defined, we default to https mode
+#
+# docker compose NGINX setup: https, reverse_proxy
+NGINX_SETUP=https
+
 # Instance default language (see options at bookwyrm/settings.py "LANGUAGES"
 LANGUAGE_CODE="en-us"
 # Used for deciding which editions to prefer
@@ -16,16 +27,17 @@ DEFAULT_LANGUAGE="English"
 ## Leave unset to allow all hosts
 # ALLOWED_HOSTS="localhost,127.0.0.1,[::1]"
 
-# Specify when the site is served from a port that is not the default
-# for the protocol (80 for HTTP or 443 for HTTPS).
-# Probably only necessary in development.
+# Specifying PORT is only necessary in reverse_proxy mode.
+# By default PORT is 443 unless you are using localhost for development work.
+# If developing with localhost you do not need to set a port and it defaults to 80.
 # PORT=1333
 
+STATIC_ROOT=static/
 MEDIA_ROOT=images/
 
 # Database configuration
 PGPORT=5432
-POSTGRES_PASSWORD=securedbypassword123
+# POSTGRES_PASSWORD=securedbypassword123
 POSTGRES_USER=bookwyrm
 POSTGRES_DB=bookwyrm
 POSTGRES_HOST=db
@@ -34,7 +46,7 @@ POSTGRES_HOST=db
 MAX_STREAM_LENGTH=200
 REDIS_ACTIVITY_HOST=redis_activity
 REDIS_ACTIVITY_PORT=6379
-REDIS_ACTIVITY_PASSWORD=redispassword345
+# REDIS_ACTIVITY_PASSWORD=redispassword345
 # Optional, use a different redis database (defaults to 0)
 # REDIS_ACTIVITY_DB_INDEX=0
 # Alternatively specify the full redis url, i.e. if you need to use a unix:// socket
@@ -43,7 +55,7 @@ REDIS_ACTIVITY_PASSWORD=redispassword345
 # Redis as celery broker
 REDIS_BROKER_HOST=redis_broker
 REDIS_BROKER_PORT=6379
-REDIS_BROKER_PASSWORD=redispassword123
+# REDIS_BROKER_PASSWORD=redispassword123
 # Optional, use a different redis database (defaults to 0)
 # REDIS_BROKER_DB_INDEX=0
 # Alternatively specify the full redis url, i.e. if you need to use a unix:// socket
@@ -52,7 +64,7 @@ REDIS_BROKER_PASSWORD=redispassword123
 # Monitoring for celery
 FLOWER_PORT=8888
 FLOWER_USER=admin
-FLOWER_PASSWORD=changeme
+# FLOWER_PASSWORD=changeme
 
 # Email config
 EMAIL_HOST=smtp.mailgun.org
@@ -92,6 +104,9 @@ S3_SIGNED_URL_EXPIRY=900
 # AWS_S3_URL_PROTOCOL=None        # "http:"
 # AWS_S3_REGION_NAME=None         # "fr-par"
 # AWS_S3_ENDPOINT_URL=None        # "https://s3.fr-par.scw.cloud"
+# AWS_DEFAULT_ACL=""              # AWS_DEFAULT_ACL defaults to public-read, however, not all providers, e.g. BackBlaze, support it.
+                                  # Uncomment and set this value to an empty string (for Back Blaze) or whatever is required by your provider to override it. 
+
 
 # Commented are example values if you use Azure Blob Storage
 # USE_AZURE=true
@@ -131,13 +146,6 @@ OTEL_EXPORTER_OTLP_HEADERS=
 # Service name to identify your app
 OTEL_SERVICE_NAME=
 
-# Set HTTP_X_FORWARDED_PROTO ONLY to true if you know what you are doing.
-# Only use it if your proxy is "swallowing" if the original request was made
-# via https. Please refer to the Django-Documentation and assess the risks
-# for your instance:
-# https://docs.djangoproject.com/en/3.2/ref/settings/#secure-proxy-ssl-header
-HTTP_X_FORWARDED_PROTO=false
-
 # TOTP settings
 # TWO_FACTOR_LOGIN_VALIDITY_WINDOW sets the number of codes either side
 # which will be accepted.
@@ -150,7 +158,7 @@ TWO_FACTOR_LOGIN_MAX_SECONDS=60
 CSP_ADDITIONAL_HOSTS=
 
 # Time before being logged out (in seconds)
-# SESSION_COOKIE_AGE=2592000   # current default: 30 days
+# SESSION_COOKIE_AGE=31536000 # current default: 365 days
 
 # Maximum allowed memory for file uploads (increase if users are having trouble
 # uploading BookWyrm export files).

.github/pull_request_template.md

@@ -1,35 +1,29 @@
 <!--
-Thanks for contributing!
-
-Please ensure the name of your PR is written in imperative present tense. For example:
-
-- "fix color contrast on submit buttons"
-- "add 'favourite food' value to Author model"
+Thanks for contributing! This template has some checkboxes that help keep track of what changes go into a release.
 
 To check (tick) a list item, replace the space between square brackets with an x, like this:
 
 - [x] I have checked the box
 
 You can find more information and tips for BookWyrm contributors at https://docs.joinbookwyrm.com/contributing.html
 -->
-
-## Are you finished?
-
-### Linters
+## Description
 <!--
-Please run linters on your code before submitting your PR.
-If you miss this step it is likely that the GitHub task runners will fail.
+Describe what your pull request does here
 -->
 
-- [ ] I have checked my code with `black`, `pylint`, and `mypy`, or `./bw-dev formatters`
 
-### Tests
-<!-- Check one -->
+<!--
+For pull requests that relate or close an issue, please include them
+below.  We like to follow [Github's guidance on linking issues to pull requests](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue).
 
-- [ ] My changes do not need new tests
-- [ ] All tests I have added are passing
-- [ ] I have written tests but need help to make them pass
-- [ ] I have not written tests and need help to write them
+For example having the text: "closes #1234" would connect the current pull
+request to issue 1234.  And when we merge the pull request, Github will
+automatically close the issue.
+-->
+
+- Related Issue #
+- Closes #
 
 ## What type of Pull Request is this?
 <!-- Check all that apply -->
@@ -48,21 +42,6 @@ If you miss this step it is likely that the GitHub task runners will fail.
 
 ### Details of breaking or configuration changes (if any of above checked)
 
-## Description
-
-<!--
-Describe what your pull request does here.
-
-For pull requests that relate or close an issue, please include them
-below.  We like to follow [Github's guidance on linking issues to pull requests](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue).
-
-For example having the text: "closes #1234" would connect the current pull
-request to issue 1234.  And when we merge the pull request, Github will
-automatically close the issue.
--->
-
-- Related Issue #
-- Closes #
 
 ## Documentation
 <!--
@@ -76,3 +55,14 @@ Our documentation is maintained in a separate repository at https://github.com/b
 - [ ] I have created a matching pull request in the Documentation repository
 - [ ] I intend to create a matching pull request in the Documentation repository after this PR is merged
 
+<!-- Amazing! Thanks for filling that out. Your PR will need to have passing tests and happy linters before we can merge
+You will need to check your code with `black`, `pylint`, and `mypy`, or `./bw-dev formatters`
+-->
+
+### Tests
+<!-- Check one -->
+
+- [ ] My changes do not need new tests
+- [ ] All tests I have added are passing
+- [ ] I have written tests but need help to make them pass
+- [ ] I have not written tests and need help to write them

.github/workflows/lint-frontend.yaml

@@ -15,7 +15,7 @@ on:
 jobs:
   lint:
     name: Lint with stylelint and ESLint.
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.

.github/workflows/prettier.yaml

@@ -10,7 +10,7 @@ on:
 jobs:
   lint:
     name: Lint with Prettier
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.

.github/workflows/python.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: postgres:13
+        image: postgres:17
         env: # does not inherit from jobs.build.env
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: hunter2
@@ -48,7 +48,7 @@ jobs:
     - name: Set up .env
       run: cp .env.example .env
     - name: Check migrations up-to-date
-      run: python ./manage.py makemigrations --check
+      run: python ./manage.py makemigrations --check -v 3
     - name: Run Tests
       run: pytest -n 3
 

.gitignore

@@ -39,5 +39,8 @@ nginx/default.conf
 #macOS
 **/.DS_Store
 
+#QTS (system in QNAP NAS)
+**/.@__thumb/
+
 # Docker
 docker-compose.override.yml

.pylintrc

@@ -3,7 +3,19 @@ ignore=migrations
 load-plugins=pylint.extensions.no_self_use
 
 [MESSAGES CONTROL]
-disable=E1101,E1135,E1136,R0903,R0901,R0902,W0707,W0511,W0406,R0401,R0801,C3001,import-error
+disable =
+    cyclic-import,
+    duplicate-code,
+    fixme,
+    no-member,
+    raise-missing-from,
+    too-few-public-methods,
+    too-many-ancestors,
+    too-many-instance-attributes,
+    unnecessary-lambda-assignment,
+    unsubscriptable-object,
+enable =
+    useless-suppression
 
 [FORMAT]
 max-line-length=88

CONTRIBUTING.md

@@ -0,0 +1,53 @@
+# Contributing to BookWyrm
+
+Our goal is to make BookWyrm a kind and welcoming place where everyone can contribute to the success of the project. Here are some ways you can join the project:
+
+## Report things that are confusing
+
+We want BookWyrm to be a fun experience that is intuitive to understand. If you're confused by something, it's probably because it is confusing! We are always keen to improve our [documentation](https://docs.joinbookwyrm.com) and Guided Tour as well as the platform itself.
+
+You can [create an issue to improve our documentation](https://github.com/bookwyrm-social/documentation/issues) or if you prefer, [ask for help in our Matrix chat room](https://app.element.io/#/room/#bookwyrm:matrix.org).
+
+## Report bugs
+
+Sometimes things don't work the way we intended. We would love to have fewer bugs, but we can only fix them if we know about them.
+
+You can [report bugs](https://github.com/bookwyrm-social/bookwyrm/issues) by clicking "New Issue". The more information you can provide, the easier it will be to understand the problem and squash that bug!
+
+It's a good idea to search the Issues for key words associated with your bug first because someone else may have already reported it.
+
+## Request and discuss new features
+
+Got a great idea for an improvement to BookWyrm? You can [request new features](https://github.com/bookwyrm-social/bookwyrm/issues) by clicking "New Issue".
+
+It's a good idea to search the Issues for key words associated with your feature suggestion first because someone else may have already requested it.
+
+## Translate BookWyrm into international languages
+
+Books are written in many languages, and BookWyrm should be too. If you know more than one language, you might be able to help us to [translate BookWyrm](https://translate.joinbookwyrm.com/). You can find out more about translation [in the documentation](https://docs.joinbookwyrm.com/translation.html).
+
+## Keep the documentation up to date
+
+Good documentation is crucial so that people know how to use, contribute to, and administer BookWyrm. No matter how you are involved with BookWyrm, your perspective is valuable and you can contribute to our documentation.
+
+We managed documentation in [a separate GitHub repository](https://github.com/bookwyrm-social/documentation) where you can [log a documentation issue](https://github.com/bookwyrm-social/documentation/issues) or contribute to the documentation yourself.
+
+## Test draft versions
+
+Are you a BookWyrm instance administrator? You can help to test new features when we release them in a draft version of BookWyrm, and report back on your experiences. This is crucial to helping us to release stable versions with fewer bugs.
+
+## Contribute code
+
+If you're able to write code, you can contribute that way! Check out the [Guide to the developer environment](https://docs.joinbookwyrm.com/install-dev.html) and our code [style guide](https://docs.joinbookwyrm.com/style_guide.html).
+
+## Provide expert advice
+
+Bibliographic metadata wizard? Celery nerd? ActivityPub expert? SQL query obsessive? We need all kinds of expertise! You can contribute to discussions in [the Issues](https://github.com/bookwyrm-social/bookwyrm/issues) or reach out to make suggestions [in our Matrix chat room](https://app.element.io/#/room/#bookwyrm:matrix.org) or via an Issue of your own.
+
+## More information
+
+You can find out more about BookWyrm and contributing at [JoinBookWyrm.com](https://joinbookwyrm.com/get-involved/).
+
+Ensure you are aware of and agree to our [Code of Conduct](https://github.com/bookwyrm-social/bookwyrm/blob/main/CODE_OF_CONDUCT.md).
+
+Please note that the BookWyrm project is licensed under the [Anti-capitalist Software License](https://github.com/bookwyrm-social/bookwyrm/blob/main/LICENSE.md).

FEDERATION.md

@@ -321,6 +321,8 @@ Bookwyrm uses the [Webfinger](https://datatracker.ietf.org/doc/html/rfc7033) sta
 
 Bookwyrm uses and requires HTTP signatures for all `POST` requests. `GET` requests are not signed by default, but if Bookwyrm receives a `403` response to a `GET` it will re-send the request, signed by the default server user. This usually will have a user id of `https://example.net/user/bookwyrm.instance.actor`
 
+As of the first version to be released in 2025, all `GET` requests will be signed by the instance user instead of re-sending requests that are rejected.
+
 #### publicKey id
 
 In older versions of Bookwyrm the `publicKey.id` was incorrectly listed in request headers as `https://example.net/user/username#main-key`. As of v0.6.3 the id is now listed correctly, as `https://example.net/user/username/#main-key`. In most ActivityPub implementations this will make no difference as the URL will usually resolve to the same place.

README.md

@@ -24,6 +24,8 @@ BookWyrm is built on [ActivityPub](http://activitypub.rocks/). With ActivityPub,
 
 Federation makes it possible to have small, self-determining communities, in contrast to the monolithic service you find on GoodReads or Twitter. An instance can be focused on a particular interest, be just for a group of friends, or anything else that brings people together. Each community can choose which other instances they want to federate with, and moderate and run their community autonomously. Check out https://runyourown.social/ to get a sense of the philosophy and logistics behind small, high-trust social networks.
 
+Developers of other ActivityPub software can find out more about BookWyrm's implementation at [`FEDERATION.md`](https://github.com/bookwyrm-social/bookwyrm/blob/main/FEDERATION.md).
+
 ## Features
 
 ### Post about books
@@ -61,3 +63,7 @@ Deployment
 
 ## Set up BookWyrm
 The [documentation website](https://docs.joinbookwyrm.com/) has instruction on how to set up BookWyrm in a [developer environment](https://docs.joinbookwyrm.com/install-dev.html) or [production](https://docs.joinbookwyrm.com/install-prod.html).
+
+## Contributing
+
+There are many ways you can contribute to the success and health of the BookWyrm project! You do not have to know how to write code and we are always keen to see more people get involved. Find out how you can join the project at [CONTRIBUTING.md](https://github.com/bookwyrm-social/bookwyrm/blob/main/CONTRIBUTING.md)

VERSION

@@ -1 +1 @@
-0.7.4
+0.8.0