Справка по внешним интеграциям, security-sensitive настройкам и текущим ограничениям.
Django выпускает JWT через rest_framework_simplejwt.
Go chat service проверяет те же JWT:
DJANGO_SECRET_KEY или JWT_SECRET;HS256;token_type=access;user_id.DJANGO_SECRET_KEY должен совпадать в Django и chat service.
Django:
ALLOWED_HOSTSCSRF_TRUSTED_ORIGINSCORS_ALLOWED_ORIGINSChat WebSocket:
WS_ALLOWED_ORIGINSЕсли WS_ALLOWED_ORIGINS пустой, Go websocket upgrader разрешает origin. Для production список должен быть явным.
Compose запускает Redis с --requirepass ${REDIS_PASSWORD:-password}.
Redis используется для:
chat:events.OTP SMS provider: Mobizon.
Default/dev behavior:
MOBIZON_ENABLED=0;0000;Production behavior:
MOBIZON_ENABLED=1;MOBIZON_API_KEY;OTP_SMS_SEND_TIMEOUT_SECONDS ограничивает повторную отправку;OTP_SMS_STRICT_DELIVERY=1 делает ошибку отправки блокирующей.S3 storage включается при наличии:
AWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYAWS_STORAGE_BUCKET_NAMEAWS_S3_ENDPOINT_URLOptional:
AWS_S3_REGION_NAMEAWS_S3_CUSTOM_DOMAINProduction должен использовать S3-compatible storage или отдельную доработку persistent local media storage. Текущий production compose не монтирует media volume, nginx не содержит /media/ route.
billing.providers contains reusable operation layers for Ioka, AirBaPay and FreedomPay. Current public card/payment endpoints use FreedomPay:
/api/v1/billing/cards/bind/ and /api/v1/billing/cards/bind/complete/;/api/v1/billing/card-banks/ and /api/v1/billing/card-payment-systems/;/api/v1/billing/webhooks/freedompay/*;FreedomPayProviderResponse.Security-sensitive FreedomPay settings:
FREEDOMPAY_AUTH_IDFREEDOMPAY_ACCEPT_SECRET_KEYFREEDOMPAY_MERCHANT_IDFREEDOMPAY_MERCHANT_SECRET_KEYFREEDOMPAY_DEFREEZE_SECRET_KEYWebhook endpoints are intentionally unauthenticated because they are called by FreedomPay. The service validates payload shape, maps provider statuses to internal order statuses and stores provider responses.
The notifications app provides authenticated push device APIs and Celery tasks:
GET /api/v1/push/statusGET /api/v1/push/devicesPOST /api/v1/push/devices/registerPOST /api/v1/push/devices/unregisterPushNotificationService sends through Firebase Admin SDK when FIREBASE_ENABLED=1; otherwise it returns a disabled/no-op result. Invalid tokens are marked inactive.
Production requirements:
FirebaseQueue worker containers;FIREBASE_PROJECT_ID and FIREBASE_CREDENTIALS_FILE;CELERY_QUEUE=FirebaseQueue.DEBUG=0.DJANGO_SECRET_KEY.ALLOWED_HOSTS.CSRF_TRUSTED_ORIGINS.CORS_ALLOWED_ORIGINS.WS_ALLOWED_ORIGINS.REDIS_PASSWORD.