Changes

blango/settings.py

@@ -10,8 +10,10 @@
 https://docs.djangoproject.com/en/3.2/ref/settings/
 """
 
+import os
 from pathlib import Path
 
+
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
 
@@ -25,8 +27,14 @@
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
 
-ALLOWED_HOSTS = []
-
+ALLOWED_HOSTS = ['*']
+X_FRAME_OPTIONS = 'ALLOW-FROM ' + os.environ.get('CODIO_HOSTNAME') + '-8000.codio.io'
+CSRF_COOKIE_SAMESITE = None
+CSRF_TRUSTED_ORIGINS = ['https://' + os.environ.get('CODIO_HOSTNAME') + '-8000.codio.io']
+CSRF_COOKIE_SECURE = True
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SAMESITE = 'None'
+SESSION_COOKIE_SAMESITE = 'None'
 
 # Application definition
 
@@ -37,24 +45,25 @@
     'django.contrib.sessions',
     'django.contrib.messages',
     'django.contrib.staticfiles',
+    'blog',
 ]
 
 MIDDLEWARE = [
     'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'django.middleware.common.CommonMiddleware',
-    'django.middleware.csrf.CsrfViewMiddleware',
+    #'django.middleware.csrf.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
-    'django.middleware.clickjacking.XFrameOptionsMiddleware',
+    #'django.middleware.clickjacking.XFrameOptionsMiddleware',
 ]
 
 ROOT_URLCONF = 'blango.urls'
 
 TEMPLATES = [
     {
         'BACKEND': 'django.template.backends.django.DjangoTemplates',
-        'DIRS': [],
+        'DIRS': [BASE_DIR / 'templates'],
         'APP_DIRS': True,
         'OPTIONS': {
             'context_processors': [
@@ -123,3 +132,5 @@
 # https://docs.djangoproject.com/en/3.2/ref/settings/#default-auto-field
 
 DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
+
+

blango/urls.py

@@ -15,7 +15,9 @@
 """
 from django.contrib import admin
 from django.urls import path
+import blog.views
 
 urlpatterns = [
     path('admin/', admin.site.urls),
+    path("", blog.views.index)
 ]

blog/admin.py

@@ -0,0 +1,10 @@
+from django.contrib import admin
+from blog.models import Tag, Post, Comment
+
+class PostAdmin(admin.ModelAdmin):
+    prepopulated_fields = {"slug": ("title",)}
+
+# Register your models here.
+admin.site.register(Tag)
+admin.site.register(Post, PostAdmin)
+admin.site.register(Comment)

blog/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class BlogConfig(AppConfig):
+    default_auto_field = 'django.db.models.BigAutoField'
+    name = 'blog'

blog/migrations/0001_initial.py

@@ -0,0 +1,39 @@
+# Generated by Django 3.2.5 on 2026-07-13 19:07
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Tag',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('value', models.TextField(max_length=100)),
+            ],
+        ),
+        migrations.CreateModel(
+            name='Post',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('modified_at', models.DateTimeField(auto_now=True)),
+                ('published_at', models.DateTimeField(blank=True, null=True)),
+                ('title', models.TextField(max_length=100)),
+                ('slug', models.SlugField()),
+                ('summary', models.TextField(max_length=500)),
+                ('content', models.TextField()),
+                ('author', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL)),
+                ('tags', models.ManyToManyField(related_name='posts', to='blog.Tag')),
+            ],
+        ),
+    ]

blog/migrations/0002_comment.py

@@ -0,0 +1,29 @@
+# Generated by Django 3.2.5 on 2026-07-13 23:01
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('contenttypes', '0002_remove_content_type_name'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ('blog', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Comment',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('content', models.TextField()),
+                ('object_id', models.PositiveIntegerField()),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('modified_at', models.DateTimeField(auto_now=True)),
+                ('content_type', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='contenttypes.contenttype')),
+                ('creator', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
+            ],
+        ),
+    ]

blog/models.py

@@ -0,0 +1,37 @@
+from django.db import models
+from django.conf import settings
+
+from django.contrib.contenttypes.fields import GenericForeignKey, GenericRelation
+from django.contrib.contenttypes.models import ContentType
+
+# Create your models here.
+class Tag(models.Model):
+    value = models.TextField(max_length=100)
+
+    def __str__(self):
+        return self.value
+
+class Comment(models.Model):
+    creator = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
+    content = models.TextField()
+    content_type = models.ForeignKey(ContentType, on_delete=models.CASCADE)
+    object_id = models.PositiveIntegerField()
+    content_object = GenericForeignKey("content_type", "object_id")
+    created_at = models.DateTimeField(auto_now_add=True)
+    modified_at = models.DateTimeField(auto_now=True)
+
+class Post(models.Model):
+    author = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.PROTECT)
+    created_at = models.DateTimeField(auto_now_add=True)
+    modified_at = models.DateTimeField(auto_now=True)
+    published_at = models.DateTimeField(blank=True, null=True)
+    title = models.TextField(max_length=100)
+    slug = models.SlugField()
+    summary = models.TextField(max_length=500)
+    content = models.TextField()
+    tags = models.ManyToManyField(Tag, related_name="posts")
+    comments = GenericRelation(Comment)
+
+    def __str__(self):
+        return self.title
+

blog/templatetags/blog_extras.py

@@ -0,0 +1,31 @@
+from django.utils.html import escape
+from django.utils.safestring import mark_safe
+from django import template
+from django.contrib.auth import get_user_model
+from django.utils.html import format_html
+
+register = template.Library()
+user_model = get_user_model()
+
+@register.filter
+def author_details(author, current_user=None):
+    if not isinstance(author, user_model):
+        # return empty string as safe default
+        return ""
+
+    if author == current_user:
+        return format_html("<strong>me</strong>")
+
+    if author.first_name and author.last_name:
+        name = f"{author.first_name} {author.last_name}"
+    else:
+        name = f"{author.username}"
+
+    if author.email:
+        prefix = format_html('<a href="mailto:{}">', author.email)
+        suffix = format_html("</a>")
+    else:
+        prefix = ""
+        suffix = ""
+
+    return format_html('{}{}{}', prefix, name, suffix)

blog/tests.py

@@ -0,0 +1,3 @@
+from django.test import TestCase
+
+# Create your tests here.

blog/views.py

@@ -0,0 +1,8 @@
+from django.shortcuts import render
+from django.utils import timezone
+from blog.models import Post
+
+# Create your views here.
+def index(request):
+    posts = Post.objects.filter(published_at__lte=timezone.now())
+    return render(request, "blog/index.html", {"posts": posts})

templates/base.html

@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
+    <title>Hello, world!</title>
+  </head>
+  <body>
+    {% block content %}
+
+    {% endblock %}
+    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js" integrity="sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM" crossorigin="anonymous"></script>
+  </body>
+</html>

templates/blog/index.html

@@ -0,0 +1,18 @@
+{% extends "base.html" %}
+{% load blog_extras %}
+{% block content %}
+    <h2>Blog Posts</h2>
+    {% for post in posts %}
+    <div class="row">
+        <div class="col">
+            <h3>{{ post.title }}</h3>
+            <small>By {{ post.author|author_details:request.user }} on {{ post.published_at|date:"M, d Y" }}</small>
+            <p>{{ post.summary }}</p>
+            <p>
+                ({{ post.content|wordcount }} words)
+                <a href="#">Read More</a>
+            </p>
+        </div>
+    </div>
+    {% endfor %}
+{% endblock %}