config/settings/container/playground.py

+# Settings for a playground GraceDB instance (for user testing) running
+# in a container on AWS. These settings inherent from base.py) 
+# and overrides or adds to them.
+from .base import *
+
+TIER = "playground"
+CONFIG_NAME = "USER TESTING"
+
+# Debug settings
+DEBUG = False
+
+# Override EMBB email address
+# TP (8 Aug 2017): not sure why?
+EMBB_MAIL_ADDRESS = 'gracedb@{fqdn}'.format(fqdn=SERVER_FQDN)
+
+# Enforce that phone and email alerts are off XXX: Set by deployment variables!
+#SEND_PHONE_ALERTS = False
+#SEND_EMAIL_ALERTS = False
+
+# Enable Mattermost alerts
+SEND_MATTERMOST_ALERTS = True
+
+# Add testserver to ALLOWED_HOSTS
+ALLOWED_HOSTS += ['testserver']
+
+# Set up Sentry for error logging
+sentry_dsn = get_from_env('DJANGO_SENTRY_DSN', fail_if_not_found=False)
+if sentry_dsn is not None:
+    USE_SENTRY = True
+
+    # Set up Sentry
+    import sentry_sdk
+    from sentry_sdk.integrations.django import DjangoIntegration
+    sentry_sdk.init(
+        environment='playground',
+        dsn=sentry_dsn,
+        integrations=[DjangoIntegration()],
+        before_send=before_send,
+    )
+
+    # Turn off default admin error emails
+    LOGGING['loggers']['django.request']['handlers'] = []
+
+# Home page stuff
+INSTANCE_TITLE = 'GraceDB Playground'
+
+# Add sub-bullet with igwn-alert group:
+group_sub_bullet = """<ul>
+<li> Messages are sent to group: <span class="text-monospace"> {0}  </span></li>
+</ul>""".format(LVALERT_OVERSEER_INSTANCES[0]['igwn_alert_group'])
+INSTANCE_LIST = INSTANCE_LIST + group_sub_bullet
+
+INSTANCE_INFO = """
+<h5>Playground instance</h5>
+<hr>
+<p>
+This GraceDB instance is designed for users to develop and test their own
+applications. It mimics the production instance in all but the following ways:
+</p>
+<ul>
+{}
+<li>Only LIGO logins are provided (no login via InCommon or Google).</li>
+<li>Events and associated data will <b>not</b> be preserved indefinitely.
+A nightly cron job removes events older than 21 days.</li>
+</ul>
+""".format(INSTANCE_LIST)
+
+# Safety check on debug mode for playground
+if (DEBUG == True):
+    raise RuntimeError("Turn off debug mode for playground")

config/settings/container/production.py

+# Settings for a production GraceDB instance running in a container
+from .base import *
+
+TIER = "production"
+
+DEBUG = False
+
+# Turn on alerts: XXX: Set by deployment variables!
+#SEND_PHONE_ALERTS = True
+#SEND_EMAIL_ALERTS = True
+#SEND_MATTERMOST_ALERTS = True
+
+# TP, March 2019: for now, it looks infeasible to use multiple databases
+# since there are many operations which normal LVC users can do that
+# do a write and then a read very soon after.  And we can't rely on
+# the read replica being updated quickly enough for that to work.
+# So there are several workflows that need to be redone in order for
+# this to be possible, but it's not obvious that they even can be
+# reworked properly.  I.e. this is a much bigger project than expected
+# so we're going to have to revisit it at some point.  We'll leave the
+# config here for now.
+# if not PRIORITY_SERVER:
+#    # If not a priority server, we use the read-only replica database
+#    # for reads and master for writes.
+#    # The username, password, and database name are all replicated
+#    # from the production database
+#
+#    # Set up dict and add to DATABASES setting
+#    read_replica = {
+#        'NAME': DATABASES['default']['NAME'],
+#        'ENGINE': 'django.db.backends.mysql',
+#        'USER': DATABASES['default']['USER'],
+#        'PASSWORD': DATABASES['default']['PASSWORD'],
+#        'HOST': os.environ.get('DJANGO_REPLICA_DB_HOST', ''),
+#        'PORT': os.environ.get('DJANGO_REPLICA_DB_PORT', ''),
+#        'OPTIONS': {
+#            'init_command': 'SET storage_engine=MyISAM',
+#        },
+#    }
+#    DATABASES['read_replica'] = read_replica
+#
+#    # Set up database router
+#    DATABASE_ROUTERS = ['core.db.routers.NonPriorityRouter',]
+
+# Set up Sentry for error logging
+sentry_dsn = get_from_env('DJANGO_SENTRY_DSN', fail_if_not_found=False)
+if sentry_dsn is not None:
+    USE_SENTRY = True
+
+    # Set up Sentry
+    import sentry_sdk
+    from sentry_sdk.integrations.django import DjangoIntegration
+    sentry_sdk.init(
+        environment='production',
+        dsn=sentry_dsn,
+        integrations=[DjangoIntegration()],
+        before_send=before_send,
+    )
+
+    # Turn off default admin error emails
+    LOGGING['loggers']['django.request']['handlers'] = []
+
+# Home page stuff
+INSTANCE_TITLE = 'GraceDB'
+
+# Add sub-bullet with igwn-alert group:
+group_sub_bullet = """<ul>
+<li> Messages are sent to group: <span class="text-monospace"> {0}  </span></li>
+</ul>""".format(LVALERT_OVERSEER_INSTANCES[0]['igwn_alert_group'])
+INSTANCE_LIST = INSTANCE_LIST + group_sub_bullet
+
+INSTANCE_INFO = """
+<h5>GraceDB Notifications</h5>
+<hr>
+<p>
+GraceDB notifies registered users of Gravitational-Wave candidate detections 
+in real-time during LIGO/Virgo/KAGRA observation periods. Current notifications 
+mechanisms are:
+</p>
+<ul>
+{}
+</ul>
+""".format(INSTANCE_LIST)
+
+# Safety check on debug mode for production
+if (DEBUG == True):
+    raise RuntimeError("Turn off debug mode for production")
+
+# Hardcode pipelines not approved for production:
+UNAPPROVED_PIPELINES += ['aframe', 'GWAK']

config/settings/container/test.py

+# Settings for a test/dev GraceDB instance running in a container
+from .base import *
+
+TIER = "test"
+CONFIG_NAME = "TEST"
+
+# Debug settings
+DEBUG = True
+
+# Override EMBB email address
+# TP (8 Aug 2017): not sure why?
+EMBB_MAIL_ADDRESS = 'gracedb@{fqdn}'.format(fqdn=SERVER_FQDN)
+
+# Add middleware
+debug_middleware = 'debug_toolbar.middleware.DebugToolbarMiddleware'
+MIDDLEWARE += [
+    debug_middleware,
+    #'silk.middleware.SilkyMiddleware',
+    #'core.middleware.profiling.ProfileMiddleware',
+    #'core.middleware.admin.AdminsOnlyMiddleware',
+]
+
+# Add to installed apps
+INSTALLED_APPS += [
+    'debug_toolbar',
+    #'silk'
+]
+
+# Add testserver to ALLOWED_HOSTS
+ALLOWED_HOSTS += ['testserver']
+
+# Settings for django-silk profiler
+SILKY_AUTHENTICATION = True
+SILKY_AUTHORISATION = True
+if 'silk' in INSTALLED_APPS:
+    # Needed to prevent RequestDataTooBig for files > 2.5 MB
+    # when silk is being used. This setting is typically used to
+    # prevent DOS attacks, so should not be changed in production.
+    DATA_UPLOAD_MAX_MEMORY_SIZE = 20*(1024**2)
+
+# Tuple of IPs which are marked as internal, useful for debugging.
+# Tanner (5 Dec. 2017): DON'T CHANGE THIS! Django Debug Toolbar exposes
+# some headers which we want to keep hidden.  So to be safe, we only allow
+# it to be used through this server.  You need to configure a SOCKS proxy
+# on your local machine to use DJDT (see admin docs).
+INTERNAL_IPS = [
+    INTERNAL_IP_ADDRESS,
+]
+
+# Enforce that phone and email alerts are off XXX: Set by deployment variables!
+#SEND_PHONE_ALERTS = False
+#SEND_EMAIL_ALERTS = False
+#SEND_MATTERMOST_ALERTS = True
+
+# Set up Sentry for error logging
+sentry_dsn = get_from_env('DJANGO_SENTRY_DSN', fail_if_not_found=False)
+if sentry_dsn is not None:
+    USE_SENTRY = True
+
+    # Set up Sentry
+    import sentry_sdk
+    from sentry_sdk.integrations.django import DjangoIntegration
+    sentry_sdk.init(
+        environment='test',
+        dsn=sentry_dsn,
+        integrations=[DjangoIntegration()],
+        before_send=before_send,
+    )
+
+    # Turn off default admin error emails
+    LOGGING['loggers']['django.request']['handlers'] = []
+
+# Home page stuff
+INSTANCE_TITLE = 'GraceDB Testing Server'
+
+# Add sub-bullet with igwn-alert group:
+group_sub_bullet = """<ul>
+<li> Messages are sent to group: <span class="text-monospace"> {0}  </span></li>
+</ul>""".format(LVALERT_OVERSEER_INSTANCES[0]['igwn_alert_group'])
+INSTANCE_LIST = INSTANCE_LIST + group_sub_bullet
+
+INSTANCE_INFO = """
+<h5>Testing Instance</h5>
+<hr>
+<p>
+This GraceDB instance is designed for Quality Assurance (QA) testing and
+validation for GraceDB and electromagnetic follow-up (EMFollow) developers.
+Software should meet QA milestones on the test instance before being moved 
+to Playground or Production. Note, on this GraceDB instance:
+</p>
+<ul>
+{}
+<li>Only LIGO logins are provided (no login via InCommon or Google).</li>
+</ul>
+""".format(INSTANCE_LIST)

config/settings/vm/base.py

+# For running a VM that is provisioned by Puppet with a secret.py file
+# for secret settings
+from ..base import *
+# Get secret settings:
+# DB_PASSWORD, SECRET_KEY, TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN
+from ..secret import *
+import socket
+
+# Nested dict of settings for all databases
+DATABASES = {
+    'default' : {
+        'NAME': 'gracedb',
+        'ENGINE': 'django.db.backends.postgresql_psycopg2',
+        'USER': 'gracedb',
+        'PASSWORD': DB_PASSWORD,
+        'HOST':'127.0.0.1',
+        'PORT':'5432',
+        'CONN_MAX_AGE': 3600,
+    },
+}
+
+# Set up allowed hosts
+SERVER_FQDN = socket.getfqdn()
+SERVER_HOSTNAME = INTERNAL_HOSTNAME
+LIGO_FQDN = '{hostname}.ligo.org'.format(hostname=SERVER_HOSTNAME)
+ALLOWED_HOSTS += [SERVER_FQDN, LIGO_FQDN]
+
+# Email settings - dependent on server hostname and FQDN ----------------------
+EMAIL_HOST = 'localhost'
+SERVER_EMAIL = 'GraceDB <gracedb@{fqdn}>'.format(fqdn=SERVER_FQDN)
+ALERT_EMAIL_FROM = SERVER_EMAIL
+ALERT_EMAIL_TO = []
+ALERT_EMAIL_BCC = []
+ALERT_TEST_EMAIL_FROM = SERVER_EMAIL
+ALERT_TEST_EMAIL_TO = []
+# EMBB email settings
+EMBB_MAIL_ADDRESS = 'embb@{fqdn}.ligo.org'.format(fqdn=SERVER_FQDN)
+EMBB_SMTP_SERVER = 'localhost'
+EMBB_MAIL_ADMINS = [admin[1] for admin in ADMINS]
+EMBB_IGNORE_ADDRESSES = ['Mailer-Daemon@{fqdn}'.format(fqdn=SERVER_FQDN)]
+
+# Load modified caching middleware:
+# https://docs.djangoproject.com/en/2.2/ref/middleware/#middleware-ordering
+MIDDLEWARE = [
+    'django.middleware.cache.UpdateCacheMiddleware',
+    'django.middleware.gzip.GZipMiddleware',
+    'events.middleware.PerformanceMiddleware',
+    'core.middleware.accept.AcceptMiddleware',
+    'core.middleware.api.ClientVersionMiddleware',
+    'core.middleware.api.CliExceptionMiddleware',
+    'core.middleware.proxy.XForwardedForMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'user_sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'core.middleware.maintenance.MaintenanceModeMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+    'ligoauth.middleware.ShibbolethWebAuthMiddleware',
+    'ligoauth.middleware.ControlRoomMiddleware',
+    'django.middleware.cache.FetchFromCacheMiddleware',
+]
+
+# Set caches:
+CACHE_MIDDLEWARE_SECONDS = 5
+CACHES = {
+    'default': {
+        'BACKEND': 'django.core.cache.backends.memcached.PyMemcacheCache',
+        'LOCATION': 'localhost:11211',
+        'TIMEOUT': 60,
+        'KEY_PREFIX': 'NULL',
+        'OPTIONS': {
+            'ignore_exc': True,
+            }
+    },
+    # For API throttles
+    'throttles': {
+        'BACKEND': 'django.core.cache.backends.db.DatabaseCache',
+        'LOCATION': 'api_throttle_cache', # Table name
+    },    
+}
+
+# FIXME: hardwire this for now in the VMs for testing
+ENABLE_REDIS_QUEUE = True
+
+if ENABLE_REDIS_QUEUE:
+    # For async alert follow-up:
+    CACHES.update({"async_followup": {
+        "BACKEND": "django_redis.cache.RedisCache",
+        "LOCATION": f"redis://{REDIS_QUEUE_ADDRESS}:{REDIS_QUEUE_PORT}/{REDIS_QUEUE_DATABASE}",
+        "OPTIONS": {
+            "CLIENT_CLASS": "django_redis.client.DefaultClient",
+        }
+    }})
+
+
+    # Set queue backend for async django tasks:
+    # example django-redis connection
+    Q_CLUSTER = {
+        'name': Q_CLUSTER_NAME,
+        'label': Q_CLUSTER_LABEL,
+        'retry': REDIS_QUEUE_RETRY,
+        'timeout': REDIS_QUEUE_TIMEOUT,
+        'workers': REDIS_QUEUE_WORKERS,
+        'recycle': REDIS_QUEUE_RECYCLE,
+        'django_redis': 'async_followup'
+    }
+
+# DB "cool-down" factor for when a db conflict is detected. This
+# factor scales a random number of seconds between zero and one.
+DB_SLEEP_FACTOR = get_from_env(
+        'DJANGO_DB_SLEEP_FACTOR',
+        default_value=1.0,
+        fail_if_not_found=False
+)
+# Fix the factor (str to float)
+try:
+    DB_SLEEP_FACTOR = float(DB_SLEEP_FACTOR)
+except:
+    DB_SLEEP_FACTOR = 1.0
+
+BETA_REPORTS_LINK = True
+
+## EGAD (External GraceDB Alert Dispatcher) configuration
+ENABLE_EGAD_EMAIL = parse_envvar_bool(
+    get_from_env('ENABLE_EGAD_EMAIL',
+                 fail_if_not_found=False, default_value="false")
+)
+ENABLE_EGAD_KAFKA = parse_envvar_bool(
+    get_from_env('ENABLE_EGAD_KAFKA',
+                 fail_if_not_found=False, default_value="false")
+)
+ENABLE_EGAD_MATTERMOST = parse_envvar_bool(
+    get_from_env('ENABLE_EGAD_MATTERMOST',
+                 fail_if_not_found=False, default_value="false")
+)
+ENABLE_EGAD_PHONE = parse_envvar_bool(
+    get_from_env('ENABLE_EGAD_PHONE',
+                 fail_if_not_found=False, default_value="false")
+)
+
+ENABLE_EGAD = (
+    ENABLE_EGAD_EMAIL or ENABLE_EGAD_KAFKA
+    or ENABLE_EGAD_MATTERMOST or ENABLE_EGAD_PHONE
+)
+
+
+# Pull in remaining (phone/email) alert variables from
+# the environment. Default to false.
+SEND_PHONE_ALERTS = parse_envvar_bool(get_from_env(
+    'SEND_PHONE_ALERTS',
+    default_value='False',
+    fail_if_not_found=False
+    ))
+
+SEND_EMAIL_ALERTS = parse_envvar_bool(get_from_env(
+    'SEND_EMAIL_ALERTS',
+    default_value='False',
+    fail_if_not_found=False
+    ))
+
+SEND_MATTERMOST_ALERTS = parse_envvar_bool(get_from_env(
+    'SEND_MATTERMOST_ALERTS',
+    default_value='False',
+    fail_if_not_found=False
+    ))
+
+INSTANCE_STUB = """
+<li>Phone alerts (calls/SMS) are {0}</li>
+<li>Email alerts are {1}</li>
+<li><span class="text-monospace">igwn-alert</span> messages to <span class="text-monospace">{2}</span> are {3}</li>
+"""
+
+INSTANCE_LIST = INSTANCE_STUB.format(ENABLED[SEND_PHONE_ALERTS],
+                                ENABLED[SEND_EMAIL_ALERTS],
+                                LVALERT_OVERSEER_INSTANCES[0]['lvalert_server'],
+                                ENABLED[SEND_XMPP_ALERTS])
+
+if (len(LVALERT_OVERSEER_INSTANCES) == 2):
+    IGWN_STUB = '<li><span class="text-monospace">igwn-alert</span> messages to <span class="text-monospace">{0}</span> are {1}</li>'
+    IGWN_LIST = IGWN_STUB.format(LVALERT_OVERSEER_INSTANCES[1]['lvalert_server'],
+                                ENABLED[SEND_XMPP_ALERTS])
+    INSTANCE_LIST = INSTANCE_LIST + IGWN_LIST
+
+# Set SciToken accepted audience to server FQDN
+SCITOKEN_AUDIENCE = ["https://" + SERVER_FQDN, "https://" + LIGO_FQDN]

config/settings/vm/dev.py

+# Settings for a test/dev GraceDB instance running on a VM with Puppet
+# provisioning. Starts with vm.py settings (which inherits from base.py
+# settings) and overrides or adds to them.
+import socket
+from .base import *
+
+TIER = "dev"
+CONFIG_NAME = "DEV"
+
+# Debug settings
+DEBUG = True
+SEND_XMPP_ALERTS=True
+SEND_MATTERMOST_ALERTS=True
+
+# Override EMBB email address
+# TP (8 Aug 2017): not sure why?
+EMBB_MAIL_ADDRESS = 'gracedb@{fqdn}'.format(fqdn=SERVER_FQDN)
+
+# Add middleware
+debug_middleware = 'debug_toolbar.middleware.DebugToolbarMiddleware'
+MIDDLEWARE += [
+    debug_middleware,
+    #'silk.middleware.SilkyMiddleware',
+    #'core.middleware.profiling.ProfileMiddleware',
+    #'core.middleware.admin.AdminsOnlyMiddleware',
+]
+
+# Add to installed apps
+INSTALLED_APPS += [
+    'debug_toolbar',
+]
+
+# Add testserver to ALLOWED_HOSTS
+ALLOWED_HOSTS += ['testserver']
+
+# Settings for django-silk profiler
+SILKY_AUTHENTICATION = True
+SILKY_AUTHORISATION = True
+if 'silk' in INSTALLED_APPS:
+    # Needed to prevent RequestDataTooBig for files > 2.5 MB
+    # when silk is being used. This setting is typically used to
+    # prevent DOS attacks, so should not be changed in production.
+    DATA_UPLOAD_MAX_MEMORY_SIZE = 20*(1024**2)
+
+# Tuple of IPs which are marked as internal, useful for debugging.
+# Tanner (5 Dec. 2017): DON'T CHANGE THIS! Django Debug Toolbar exposes
+# some headers which we want to keep hidden.  So to be safe, we only allow
+# it to be used through this server.  You need to configure a SOCKS proxy
+# on your local machine to use DJDT (see admin docs).
+INTERNAL_IPS = [
+    INTERNAL_IP_ADDRESS,
+]
+INSTANCE_TITLE = 'GraceDB Development VM'
+
+# Add sub-bullet with igwn-alert group:
+if (len(LVALERT_OVERSEER_INSTANCES) == 2):
+    igwn_alert_group = os.environ.get('IGWN_ALERT_GROUP', 'lvalert-dev')
+    group_sub_bullet = """<ul>
+    <li> Messages are sent to group: <span class="text-monospace"> {0}  </span></li>
+    </ul>""".format(igwn_alert_group)
+    INSTANCE_LIST = INSTANCE_LIST + group_sub_bullet
+
+INSTANCE_INFO = """
+<h5>Development Instance</h5>
+<hr>
+<p>
+This GraceDB instance is designed for GraceDB maintainers to develop and
+test in the AWS cloud architecture. There is <b>no guarantee</b> that the
+behavior of this instance will mimic the production system at any time.
+Events and associated data may change or be removed at any time.
+</p>
+<ul>
+{}
+<li>Only LIGO logins are provided (no login via InCommon or Google).</li>
+</ul>
+""".format(INSTANCE_LIST)
+
+# Turn off public page caching for development and testing:
+PUBLIC_PAGE_CACHING = 0
+
+# Hardcode pipelines not approved for production (for vm testing)
+# UNAPPROVED_PIPELINES += ['aframe', 'GWAK']

config/settings/vm/playground.py

+# Settings for a playground GraceDB instance (for user testing) running
+# on a VM with Puppet provisioning. Starts with vm.py settings (which inherits
+# from base.py settings) and overrides or adds to them.
+from .base import *
+
+TIER = "playground"
+CONFIG_NAME = "USER TESTING"
+
+# Debug settings
+DEBUG = False
+
+# Override EMBB email address
+# TP (8 Aug 2017): not sure why?
+EMBB_MAIL_ADDRESS = 'gracedb@{fqdn}'.format(fqdn=SERVER_FQDN)
+
+# Turn on XMPP alerts
+SEND_XMPP_ALERTS = True
+
+# Turn on Mattermost alerts
+SEND_MATTERMOST_ALERTS = True
+
+# Enforce that phone and email alerts are off
+SEND_PHONE_ALERTS = False
+SEND_EMAIL_ALERTS = False
+
+# Define correct LVAlert settings
+LVALERT_OVERSEER_INSTANCES = [
+    {
+        "lvalert_server": "lvalert-playground.cgca.uwm.edu",
+        "listen_port": 8001,
+    },
+]
+
+# Add testserver to ALLOWED_HOSTS
+ALLOWED_HOSTS += ['testserver']
+
+# Home page stuff
+INSTANCE_TITLE = 'GraceDB Playground'
+INSTANCE_INFO = """
+<h3>Playground instance</h3>
+<p>
+This GraceDB instance is designed for users to develop and test their own
+applications. It mimics the production instance in all but the following ways:
+</p>
+<ul>
+<li>Phone and e-mail alerts are turned off.</li>
+<li>Only LIGO logins are provided (no login via InCommon or Google).</li>
+<li>LVAlert messages are sent to lvalert-playground.cgca.uwm.edu.</li>
+<li>Events and associated data will <b>not</b> be preserved indefinitely.
+A nightly cron job removes events older than 21 days.</li>
+</ul>
+"""
+
+# Safety check on debug mode for playground
+if (DEBUG == True):
+    raise RuntimeError("Turn off debug mode for playground")

config/settings/vm/production.py

+# Settings for a production GraceDB instance running on a VM with Puppet
+# provisioning. Starts with vm.py settings (which inherits from base.py
+# settings) and overrides or adds to them.
+from .base import *
+
+TIER = "production"
+
+DEBUG = False
+
+# LVAlert Overseer settings
+LVALERT_OVERSEER_INSTANCES = [
+    {
+        "lvalert_server": "lvalert.cgca.uwm.edu",
+        "listen_port": 8000,
+    },
+]
+
+# Turn on alerts
+SEND_XMPP_ALERTS = True
+SEND_PHONE_ALERTS = True
+SEND_EMAIL_ALERTS = True
+SEND_MATTERMOST_ALERTS = True
+
+# Safety check on debug mode for production
+if (DEBUG == True):
+    raise RuntimeError("Turn off debug mode for production")

config/urls.py

+from django.conf import settings
+
+from django.urls import re_path, include
+
+from django.contrib import admin
+from django.contrib.auth.views import LogoutView
+from django.views.generic import TemplateView
+
+# Import feeds
+import core.views
+from events.feeds import EventFeed, feedview
+import events.reports
+import events.views
+from ligoauth.views import (
+    manage_password, ShibLoginView, ShibPostLoginView
+)
+import search.views
+
+# Django admin auto-discover
+admin.autodiscover()
+
+feeds = {
+    'latest' : EventFeed
+}
+
+
+urlpatterns = [
+    re_path(r'^$', events.views.index, name="home"),
+    re_path(r'^navbar_only$', TemplateView.as_view(
+        template_name='navbar_only.html'), name="navbar-only"),
+    re_path(r'^SPInfo', TemplateView.as_view(template_name='gracedb/spinfo.html'),
+         name="spinfo"),
+    re_path(r'^SPPrivacy', TemplateView.as_view(
+        template_name='gracedb/spprivacy.html'), name="spprivacy"),
+    re_path(r'^DiscoveryService', TemplateView.as_view(
+        template_name='discovery.html'), name="discovery"),
+    re_path(r'^events/', include('events.urls')),
+    re_path(r'^superevents/', include('superevents.urls')),
+    re_path(r'^alerts/', include('alerts.urls')),
+    re_path(r'^feeds/(?P<url>.*)/$', EventFeed()),
+    re_path(r'^feeds/$', feedview, name="feeds"),
+
+    re_path(r'^other/$', TemplateView.as_view(template_name='other.html'),
+        name='other'),
+    re_path(r'^performance/$', events.views.performance, name="performance"),
+    re_path(r'^reports/$', events.reports.reports_page_context, name="reports"),
+    re_path(r'^latest/$', search.views.latest, name="latest"),
+    #(r'^reports/(?P<path>.+)$', 'django.views.static.serve',
+    #        {'document_root': settings.LATENCY_REPORT_DEST_DIR}),
+    re_path(r'^search/$', search.views.search, name="mainsearch"),
+
+    # Authentication
+    re_path(r'^login/$', ShibLoginView.as_view(), name='login'),
+    re_path(r'^post-login/$', ShibPostLoginView.as_view(), name='post-login'),
+    re_path(r'^logout/$', LogoutView.as_view(), name='logout'),
+
+    # Password management
+    re_path('^manage-password/$', manage_password, name='manage-password'),
+
+    # API URLs
+    re_path(r'^api/', include('api.urls')),
+    # Legacy API URLs - must be maintained!
+    re_path(r'^apibasic/', include('api.urls', namespace='legacy_apibasic')),
+    re_path(r'^apiweb/', include('api.urls', namespace='legacy_apiweb')),
+
+    # Heartbeat URL
+    re_path(r'^heartbeat/$', core.views.heartbeat, name='heartbeat'),
+
+    # Uncomment the admin/doc line below and add 'django.contrib.admindocs'
+    # to INSTALLED_APPS to enable admin documentation:
+    # (r'^admin/doc/', include('django.contrib.admindocs.urls')),
+    re_path(r'^admin/', admin.site.urls),
+
+    # Sessions
+    re_path(r'^', include('user_sessions.urls', 'user_sessions')),
+
+]
+
+# We don't require settings.DEBUG for django-silk since running unit tests
+# by default setings settings.DEBUG to False, unless you use the
+# --debug-mode flag
+if ('silk' in settings.INSTALLED_APPS):
+    # Add django-silk
+    urlpatterns = [
+        re_path(r'^silk/', include('silk.urls', namespace='silk'))
+    ] + urlpatterns
+
+# Add django-debug-toolbar
+if settings.DEBUG and 'debug_toolbar' in settings.INSTALLED_APPS:
+    import debug_toolbar
+    urlpatterns = [
+        re_path(r'^__debug__/', include(debug_toolbar.urls)),
+    ] + urlpatterns

config/wsgi.py

+import os
+import sys
+from os.path import abspath, dirname, join
+
+# Parameters
+DEFAULT_SETTINGS_MODULE = 'config.settings.vm.dev'
+PROJECT_ROOT_NAME = 'gracedb'
+
+# Set up base dir of repository
+BASE_DIR = abspath(join(dirname(__file__), ".."))
+
+# Add the source code directory and project root
+sys.path.append(BASE_DIR)
+sys.path.append(join(BASE_DIR, PROJECT_ROOT_NAME))
+
+# Set DJANGO_SETTINGS_MODULE environment variable if it's not already set
+os.environ.setdefault('DJANGO_SETTINGS_MODULE', DEFAULT_SETTINGS_MODULE)
+
+# Matplotlib config directory
+os.environ['MPLCONFIGDIR'] = '/tmp/'
+
+from django.core.wsgi import get_wsgi_application
+application = get_wsgi_application()

django.wsgi

-import os
-import sys
-
-os.environ['DJANGO_SETTINGS_MODULE'] = 'settings'
-
-# Sandbox libs here, if required.
-#
-sys.path.append('/home/lars/wsgi-sandbox/lib/python2.6')
-sys.path.append('/home/lars/wsgi-sandbox/lib/python2.6/site-packages')
-sys.path.append('/home/gracedb/graceproj')
-
-# Scott's Shib app uses loggers.
-import logging
-logging.basicConfig()
-
-#logging.basicConfig(level=logging.DEBUG,
-#                    format='%(asctime)s %(levelname)s %(message)s',
-#                    filename='/tmp/myapp.log',
-#                    filemode='w')
-
-import django.core.handlers.wsgi
-application = django.core.handlers.wsgi.WSGIHandler()
-

doc/CHANGES

-==================================================================
-ER2
-
-    settings refactor
-        More unified settings/config.
-            settings/__init__.py
-                 locates and imports * from settings.default then settings.WHATEVER
-            settings/defaut.py
-                    /production.py
-                    /development.py
-                    /misc.py
-
-        Simple enough and gets rid of settings_dev crap.
-        Keeps prod/dev configs from diverging too much.
-
-==================================================================
-Branch goocharts
-
-==================================================================
-Branch Master
-Django 1.1 -> 1.3
-Tue Dec 20 14:32:32 CST 2011
-
-Deprecation warnings in apache log.  /var/log/apache2/error.log
-
-    [Tue Dec 20 10:28:11 2011] [error] /home/lars/wsgi-sandbox/lib/python2.6/site-packages/django/db/__init__.py:19: DeprecationWarning: settings.DATABASE_* is deprecated; use settings.DATABASES instead.
-    [Tue Dec 20 10:28:11 2011] [error]   DeprecationWarning
-    [Tue Dec 20 10:28:11 2011] [error] /home/lars/wsgi-sandbox/lib/python2.6/site-packages/django/db/__init__.py:60: DeprecationWarning: Short names for ENGINE in database configurations are deprecated. Prepend default.ENGINE with 'django.db.backends.'
-    [Tue Dec 20 10:28:11 2011] [error]   DeprecationWarning
-
-Changed settings.py to new syntax.
-
------------------
-
-    [Tue Dec 20 10:28:12 2011] [error] /usr/lib/python2.6/dist-packages/pytz/__init__.py:32: UserWarning: Module _mysql was already imported from /usr/lib/pymodules/python2.6/_mysql.so, but /usr/lib/pymodules/python2.6 is being added to sys.path
-    [Tue Dec 20 10:28:12 2011] [error]   from pkg_resources import resource_stream
-
-Ugh.  This is a bug in distribute/pkg_resources, apparently.  Did a workaround -- an early import of
-pkg_resources will prevent this, so there is a pointless import at the beginning of settings.py.
-This seemed to rid us of this message.
-
------------------
-
-    [Tue Dec 20 10:28:12 2011] [error] /home/lars/wsgi-sandbox/lib/python2.6/site-packages/django/contrib/auth/__init__.py:26: DeprecationWarning: Authentication backends without a `supports_object_permissions` attribute are deprecated. Please define it in gracedb.middleware.auth.LigoAuthBackend.
-    [Tue Dec 20 10:28:12 2011] [error]   DeprecationWarning)
-    [Tue Dec 20 10:28:12 2011] [error] /home/lars/wsgi-sandbox/lib/python2.6/site-packages/django/contrib/auth/__init__.py:31: DeprecationWarning: Authentication backends without a `supports_anonymous_user` attribute are deprecated. Please define it in gracedb.middleware.auth.LigoAuthBackend.
-    [Tue Dec 20 10:28:12 2011] [error]   DeprecationWarning)
-
-Modified gracdeb.middleware.auth.LigoAuthBackend to have supports_object_permissions
-and supports_anonymous_user class attributes.
-
------------------
-
-    [Tue Dec 20 10:28:12 2011] [error] /home/lars/wsgi-sandbox/lib/python2.6/site-packages/django/core/context_processors.py:27: DeprecationWarning: The context processor at `django.core.context_processors.auth` is deprecated; use the path `django.contrib.auth.context_processors.auth` instead.
-    [Tue Dec 20 10:28:12 2011] [error]   DeprecationWarning
-
-Replaced in settings.py / settings_dev.py
-
------------------
-
-    [Tue Dec 20 10:28:12 2011] [error] /home/lars/wsgi-sandbox/lib/python2.6/site-packages/django/template/loaders/filesystem.py:58: DeprecationWarning: 'django.template.loaders.filesystem.load_template_source' is deprecated; use 'django.template.loaders.filesystem.Loader' instead.
-    [Tue Dec 20 10:28:12 2011] [error]   DeprecationWarning
-
-Replaced in settings.py / settings_dev.py
-
------------------
-
-error.log:[Thu Dec 22 14:40:20 2011] [error] /home/lars/wsgi-sandbox/lib/python2.6/site-packages/django/contrib/syndication/views.py:194: DeprecationWarning: The syndication feed() view is deprecated. Please use the new class based view API.
-
-Done.  Fixed in gracedb/feeds.py and urls.py.
-==================================================================

doc/README

-
-Report generation.
-    ./manage.py make_histograms
-==================================================================
-
-Requirements:
-    gnuplot >= v4.2
-    glue   (python-glue in debian)
-    python-pyxmpp
-
-    mysql-server
-    MySQLdb-python  (python-mysqldb in debian)
-    mod_wsgi    (libapache2-mod-wsgi)
-    mod_auth_kerb (libapache2-mod-auth-kerb)
-
-    voevent
-
-==================================================================
-
-
-#   ligo-shibboleth-metadata-3.2.0-1
-    ligo-shibboleth-sp-2.0.0-1
-    shibboleth-2.4.3-2.2
-#   liblog4shib1-1.0.4-2.1
-
-    Apache must (should?) use MPM prefork and NOT worker model.
-        (debian - apache2-mpm-prefork)
-        This is because the Django ORM is (probably? possibly?) not threadsafe,
-        or maybe it probably *is* threadsafe...  hard to tell, but prefork
-        would be safer.
-
-        http://groups.google.com/group/django-developers/browse_thread/thread/905f79e350525c95
-        http://code.djangoproject.com/ticket/1442
-    
-We need glue.ligolw, which requires SOOO many things from pylal
-  it's just easier to install pylal all of LAL.
-
-
-    python-virtualenv
-
-
-    pip install django
-    pip install pytz
-    pip install simplejson
-
-nfs0001
-    certs
-    apache config
-    install services
-    TAKE NOTES FOR CFENGINE -- ANYTHING outside of /home
-
-clients/configs ... remove references to archie / push to repos.
-
-
-CREATE DATABASE gracedb;
-CREATE DATABASE gracedb_test;
-GRANT ALL PRIVILEGES ON gracedb.* TO 'gracedb' IDENTIFIED BY 'redrum4x';
-GRANT ALL PRIVILEGES ON gracedb_test.* TO 'gracedb' IDENTIFIED BY 'redrum4x';
-FLUSH PRIVILEGES;
-

doc/schema-1.0-1.1.sql

-
-ALTER TABLE gracedb_event
-ADD COLUMN far double AFTER gpstime
-;

doc/schema-1.1-1.2.sql

-
-ALTER TABLE  gracedb_eventlog
-MODIFY COLUMN comment LONGTEXT NOT NULL
-;

doc/schema-1.2-1.3.sql

-
-ALTER TABLE userprofile_trigger
-ADD COLUMN farThresh double AFTER triggerType
-;
-

docker/apache-config

+ServerName ${DJANGO_PRIMARY_FQDN}
+
+<VirtualHost *:80>
+  ServerName https://${DJANGO_PRIMARY_FQDN}:443
+  UseCanonicalName On
+  ServerSignature On
+  ErrorLog /dev/stderr
+  Transferlog /dev/stdout
+
+  ServerAdmin cgca-admins@uwm.edu
+
+  ## Log format
+  LogFormat "APACHE | %a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
+
+  ## Vhost docroot
+  DocumentRoot "/var/www/html"
+
+  ## Directories, there should at least be a declaration for /var/www/html
+
+  <Directory "/var/www/html">
+    Options Indexes FollowSymLinks MultiViews
+    AllowOverride None
+    Require all granted
+  </Directory>
+
+  # Improve proxy behavior with gunicorn:
+  # https://serverfault.com/questions/206738/intermittent-error-when-using-mod-proxy-to-do-reverse-proxy-to-soap-service#comment1327184_209006
+  # https://github.com/benoitc/gunicorn/issues/207
+
+  SetEnv force-proxy-request-1.0 1
+  SetEnv proxy-nokeepalive 1
+
+  ## Custom fragment
+  # gUnicorn edits
+  Alias /shibboleth-ds/idpselect_config.js /etc/shibboleth-ds/idpselect_config.js
+  Alias /shibboleth-ds/idpselect.js /etc/shibboleth-ds/idpselect.js
+  Alias /shibboleth-ds/idpselect.css /etc/shibboleth-ds/idpselect.css
+  Alias /static/ "/app/gracedb_project/static_root/"
+  # Aliases for docs and admin_docs
+  Alias /documentation/ "/app/gracedb_project/docs/user_docs/build/"
+  Alias /admin_docs/ "/app/gracedb_project/docs/admin_docs/build/"
+  ProxyPreserveHost on
+  ProxyAddHeaders off
+  ProxyPass "/robots.txt" "!"
+  ProxyPass "/shibboleth-ds" "!"
+  ProxyPass "/Shibboleth.sso" "!"
+  ProxyPass "/static" "!"
+  ProxyPass "/documentation" "!"
+  ProxyPass "/admin_docs" "!"
+  ProxyPass "/" "http://localhost:8080/" timeout=120
+  ProxyPassReverse "/" "http://localhost:8080/"
+
+  # This section is for apache2 timeout and keepalive tuning parameters. 
+  # https://ioflood.com/blog/2020/02/21/what-is-apache-keepalive-timeout-how-to-optimize-this-critical-setting/
+  
+  # KeepAlive will... keep a connection alive for subsequent requests. 
+  # Turn this on.
+  KeepAlive On
+
+  # The maximum number of requests served to a client before terminating the connection.
+  # This can be large, possibly safely unlimited. (0 = unlimited)
+  MaxKeepAliveRequests 0
+
+  # The number of seconds Apache will wait for a subsequent request before closing the 
+  # connection. Once a request has been received, the timeout value specified by the 
+  # Timeout directive applies. Setting KeepAliveTimeout to a high value may cause 
+  # performance problems in heavily loaded servers. The higher the timeout, the more 
+  # server processes will be kept occupied waiting on connections with idle clients
+  KeepAliveTimeout 5
+
+  # Amount of time the server will wait for certain events before failing a 
+  # request. The TimeOut directive defines the length of time Apache will wait for
+  # I/O (e.g., when reading data from the client, when writing data to the client, etc.) 
+  # Default: 300s. Try setting this lower, then do a test like a long query with the API
+  # and in the browser and see what happens. 
+  Timeout 60
+
+  # Unset certain headers to help prevent spoofing
+  RequestHeader unset REMOTE_USER
+  RequestHeader unset ISMEMBEROF
+  RequestHeader unset X_FORWARDED_FOR
+  RequestHeader unset REMOTE_ADDR
+  RequestHeader unset SSL_CLIENT_S_DN
+  RequestHeader unset SSL_CLIENT_I_DN
+  RequestHeader unset X_FORWARDED_PROTO
+
+  # Get a few of them from the environment
+  RequestHeader set X_FORWARDED_FOR "%{X_FORWARDED_FOR}e" env=X_FORWARDED_FOR
+  RequestHeader set REMOTE_ADDR "%{REMOTE_ADDR}e" env=REMOTE_ADDR
+
+  # Set X_FORWARDED_PROTO to https
+  RequestHeader set X_FORWARDED_PROTO "https"
+
+  # Increase the max allowable header size:
+  LimitRequestFieldSize 16384
+
+  # Set up mod_xsendfile for serving static event files as directed by Django
+  XSendFile On
+  XSendFilePath /app/db_data/
+
+  Alias /shibboleth-ds/idpselect_config.js /etc/shibboleth-ds/idpselect_config.js
+  Alias /shibboleth-ds/idpselect.js /etc/shibboleth-ds/idpselect.js
+  Alias /shibboleth-ds/idpselect.css /etc/shibboleth-ds/idpselect.css
+
+  <Directory /etc/shibboleth-ds>
+    Require all granted
+  </Directory>
+
+  # Deny access to the DocumentRoot. This makes it possible to upload
+  # large files. See notes.
+  <Directory "/var/www/">
+    Require all denied
+  </Directory>
+
+  <Directory "/app/gracedb_project/static_root/">
+    AllowOverride None
+    Options None
+    Require all granted
+  </Directory>
+
+  Alias /robots.txt /app/gracedb_project/static_root/robots.txt
+
+  <Location /Shibboleth.sso>
+    SetHandler shib
+    Require all granted
+  </Location>
+
+  <Location /shibboleth-sp>
+    Require all granted
+  </Location>
+
+  <Location "/post-login/">
+    AuthType Shibboleth
+    Require shibboleth
+    ShibRequestSetting requireSession true
+    ShibUseHeaders On
+
+    # use funky method to get REMOTE_USER variable
+    RewriteEngine On
+    RewriteCond %{LA-U:REMOTE_USER} (.+)
+    RewriteRule . - [E=RU:%1]
+    RequestHeader set REMOTE_USER %{RU}e
+
+    # this way only works with SSLEngine On because REMOTE_USER is secure variable
+    #RequestHeader set REMOTE_USER %{REMOTE_USER}s
+    RequestHeader set ISMEMBEROF "%{ISMEMBEROF}e" env=ISMEMBEROF
+  </Location>
+
+  <Directory "/app/gracedb_project/docs/user_docs/build/">
+    Require all granted
+  </Directory>
+
+  # Restrict access to admin documentation
+  <Location "/admin_docs/">
+    AuthType Shibboleth
+    ShibRequestSetting requireSession true
+    ShibUseHeaders On
+    Require shib-user duncan.meacher@ligo.org alexander.pace@ligo.org daniel.wysocki@ligo.org patrick.brady@ligo.org
+  </Location>
+
+</VirtualHost>

docker/backports.pref

+Explanation: shibboleth 3.0 dependencies
+Package: init-system-helpers libxerces-c3.2
+Pin: release a=stretch-backports
+Pin-Priority: 500

docker/check_shibboleth_status

+#!/usr/bin/python3
+
+'''
+Pulls Shibboleth status.sso page, checks for:
+  1. Presence of <OK/> tags under Status and SessionCache,
+  2. Presence of required metadata feeds (see metadata_feeds).
+Run ./check_shibboleth_status -h for help.
+'''
+
+# Imports
+import argparse
+import sys
+import xml.etree.ElementTree as ET
+try:
+    from urllib.request import urlopen
+    from urllib.error import URLError
+except ImportError:  # python < 3
+    from urllib2 import (urlopen, URLError)
+
+# Parameters - may need to be modified in the future
+# if Shibboleth status pages change or new metadata
+# providers are added.
+tags_to_check = ["Status", "SessionCache"] # XML tags to check for "OK" status.
+# Metadata feeds.
+default_metadata_feeds = ["ligo-approved-idp-none", "incommon", "cirrus"]
+
+# Default arguments
+default_host = "localhost"
+default_urlpath = "Shibboleth.sso/Status"
+default_timeout = 10
+
+# Process arguments.
+parser = argparse.ArgumentParser(formatter_class=
+                                 argparse.ArgumentDefaultsHelpFormatter)
+parser.add_argument("-H", "--host", type=str,
+                    help="Hostname of gracedb server",
+                    default=default_host)
+parser.add_argument("-U", "--urlpath", type=str,
+                    help="Path to gracedb server Shibboleth status page",
+                    default=default_urlpath)
+parser.add_argument("-T", "--timeout", type=int,
+                    help="Maximum time (in sec.) to allow connecting to server",
+                    default=default_timeout)
+parser.add_argument("-F", "--feeds", type=str,
+                    help=("Comma-separated list of metadata feeds to check"
+                    "for the presence of"), default=",".join(
+                    default_metadata_feeds))
+args = parser.parse_args()
+host = "http://" + args.host
+urlpath = args.urlpath
+timeout = args.timeout
+metadata_feeds = args.feeds.split(",")
+
+# Get XML data from URL.
+host_url = host + "/" + urlpath
+try:
+    response = urlopen(host_url, timeout=timeout)
+except URLError:
+    print("Error opening Shibboleth status page (" + host_url + ").")
+    sys.exit(2)
+except:
+    print("Unknown error opening Shibboleth status page (" + host_url + ").")
+    sys.exit(3)
+
+# Convert from string to ElementTree
+try:
+    status_tree = ET.fromstring(response.read())
+except ET.ParseError:
+    # Error parsing response.
+    print("Error parsing response from server - not in XML format.")
+    sys.exit(2)
+except:
+    # Error that is not ParseError.
+    print("Unknown error occurred when parsing response from server.")
+    sys.exit(3)
+response.close()
+
+# Process XML. ----------------------------
+# Check 1: find <Status> and <SessionCache> tags, make sure
+# they both contain an <OK/> child.
+for tag in tags_to_check:
+    status_tag = status_tree.find(tag)
+    if (status_tag is None):
+        print("Error: tag \'" +  tag + "\' not found.")
+        sys.exit(2)
+    else:
+        status_OK = status_tag.find('OK')
+        if (status_OK is None):
+            print("Error: tag \'" + tag + "\' is not OK.")
+            sys.exit(2)
+
+# Check 2: make sure metadata feeds that we expect
+# are actually there.
+metaprov_tags = status_tree.findall("MetadataProvider")
+srcs = [element.attrib['source'] for element in metaprov_tags]
+for feed in metadata_feeds:
+    feed_found = [src.lower().find(feed) >= 0 for src in srcs]
+    if (sum(feed_found) < 1):
+        print("MetadataProvider " + feed + " not found.")
+        sys.exit(2)
+    elif (sum(feed_found) < 1):
+        print("MetadataProvider " + feed + "found in multiple elements.")
+        sys.exit(2)
+
+# If we make it to this point, everything is OK.
+print("All MetadataProviders found. Status and SessionCache are OK.")
+sys.exit(0)