CODEWITHSUNDEEP
pythondjangoapachemod-wsgi
greekbeard
greekbeard

Reputation: 214

Placing code outside of document root problems with Apache and Django

I am having trouble fulfilling the Django recommendation for code placement. I have searched google and beyond trying all types of VirtualHost configurations. However I cannot get the Django site to work with Apache like it does with Django's built in test web server.

I am using Django 1.5.4 and mod_wsgi

The Django documentation states that:

Where should this code live?

If your background is in plain old PHP (with no use of modern frameworks), you’re probably used to putting code under the Web server’s document root (in a place such as /var/www). With Django, you don’t do that. It’s not a good idea to put any of this Python code within your Web server’s document root, because it risks the possibility that people may be able to view your code over the Web. That’s not good for security.

Put your code in some directory outside of the document root, such as /home/mycode.

And in trying to do that I am failing.

Here is an example of my directory structure: I have /home/user/djangoRoot which I want for the document root and /home/user/djangoCode for where I want to put the code. I have followed the tutorial running django-admin.py startproject djangoSite and all the folders and files are created as they should. Database sync works great. I can view the site when I use Django's built in testing web server. But I feel like something is wrong with my apache virtual host because I cannot view the site the same way with apache.

Again, in the spirit of keeping code out of the document root, I want djangoRoot as my root directory and djangoCode for my code directory (with djangoSite/djangoSite directories in it that were created after running the django-admin.py start project djangoSite command).

I have tried

  1. Making the DjangoCode/DjangoSite my root directory, but I can see the file structure inthe browser
  2. Eliminating the DocumentRoot from the VirtualHost as quite a few suggessted.
  3. And I have tried what I gathered from django and the rest

None worked.

So here is my current apache virtualhost

WSGIPythonPath /home/user/djangoCode/djangoSite/djangoSite

<VirtualHost *:80>
ServerAdmin webmaster@localhost
ServerName example.com
ServerAlias www.example.com

DocumentRoot /home/user/djangoRoot
<Directory /home/user/djangoRoot>
    Options Indexes FollowSymLinks MultiViews
    AllowOverride None
    Order allow,deny
    allow from all
</Directory>

WSGIScriptAlias /djangoRoot /home/user/djangoCode/djangoSite/djangoSite/wsgi.py

<Directory "/home/user/djangoCode/djangoSite/djangoSite/wsgi.py">
<Files wsgi.py>
    Order deny,allow
    Allow from all
</Files>
</Directory>
    
    ...
</VirtualHost>

This currently only allows me to see document root with no sign of django. Is my virtual host configured wrong? Am I taking this "code outside of document root too far"?

Upvotes: 4

Views: 3390

Answers (1)

Daniel Roseman
Daniel Roseman

Reputation: 599520

I really don't understand why you're finding this so hard, but you're clearly not following me at all. The point of the explanation in the docs is that the place where you code lives in your filesystem is completely independent from the point that Apache serves it at. The latter is given by the first parameter to WSGIScriptAlias. The former is given by the second parameter.

The document root is the default place for Apache to serve files from. But you're not serving files, you're running code to serve dynamic content. So, you proxy to the WSGI app, at the point given by the first parameter to WSGIScriptAlias. That is the root URL of your site. In the example you've given, that means that - assuming your domain name is example.com - your Django app will be accessible under example.com/djangoRoot. If you actually visited that URL in your browser, you'd see whatever page is configured under / in your urls.py. That is almost certainly not what you want. In the vast majority of cases, the first parameter - as shown in the docs - should just be /.

So I'm not sure why you think that goes against the security warning. Here, the document root stays at whatever it is by default - usually /var/www - but the code lives in /home/user/djangoCode/... and is served at /.

Upvotes: 6

Related Questions