Django 5

sudo systemctl is-active gunicorn.service nginx.service postgresql.service /opt/django/venv/bin/python -c "import django; print('Django', django.get_version())"

sudo cat /stage/scripts/django-credentials.log

Note DJANGO_URL, DJANGO_ADMIN_URL, DJANGO_ADMIN_USER and DJANGO_ADMIN_PASSWORD. The file also contains the database password and the per-VM SECRET_KEY.

curl -sf -o /dev/null -w 'admin login: HTTP %{http_code}\n' http://127.0.0.1/admin/login/
curl -sf -o /dev/null -w 'static base.css: HTTP %{http_code}\n' http://127.0.0.1/static/admin/css/base.css

The first call reaches gunicorn through nginx. The second call proves that nginx serves collected static files directly, which is faster than going through Django.

Browse to http://<vm-ip>/admin/ and sign in as SecureAnyCloud with the password from Step 5.

After you sign in, the Site Administration page shows the auto-discovered admin models. These are Authentication and Authorization (Users, Groups) and any apps you add to INSTALLED_APPS.

Click Users to see the SecureAnyCloud superuser. Add more users from this page, or run manage.py createsuperuser.

set -a; . /etc/django/sac.env; export DJANGO_SETTINGS_MODULE=sac.settings; set +a cd /opt/django/sac
sudo -E -u django /opt/django/venv/bin/python manage.py migrate --noinput | tail -3 sudo -E -u django /opt/django/venv/bin/python manage.py showmigrations --plan | tail -10

The first command is idempotent, so already-applied migrations are no-ops. The second command prints the migration plan ordering.

Replace <app-name> with the name of your app:

cd /opt/django/sac
sudo -u django /opt/django/venv/bin/python manage.py startapp <app-name>

Edit sac/settings.py to add '<app-name>' to INSTALLED_APPS, and define your models in <app-name>/models.py. Then run makemigrations <app-name> && migrate.

Edit /etc/django/sac.env to raise GUNICORN_WORKERS, and then restart gunicorn:

sudo systemctl restart gunicorn.service

Defaults on Standard_B2s:

• GUNICORN_WORKERS: 3
• DJANGO_DEBUG: False
• DJANGO_ALLOWED_HOSTS: localhost,127.0.0.1,<public-ip>
• DB: PostgreSQL 16, role SecureAnyCloud, db SecureAnyCloud

For production raise workers to 2 × CPU + 1 (e.g. 9 on a D4s_v5).

Edit /etc/django/sac.env and add your domain to the comma-separated list:

DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,<vm-ip>,apps.example.com

Then restart gunicorn:

sudo systemctl restart gunicorn.service

Point the DNS A record of your domain at this VM, and then run:

sudo apt-get install -y python3-certbot-nginx
sudo certbot --nginx -d apps.example.com -m you@example.com --agree-tos --non-interactive --redirect

Certbot edits /etc/nginx/sites-available/django-sac to add the SSL server block and a :80 → :443 redirect, and then reloads nginx. The certbot.timer systemd unit handles renewal and runs twice daily.

Take a consistent backup while the services keep running. Dump the database with pg_dump, and archive the media/ upload directory:

PASS=$(sudo grep '^DJANGO_DB_PASSWORD=' /stage/scripts/django-credentials.log | cut -d= -f2-) PGPASSWORD="$PASS" pg_dump -h 127.0.0.1 -U sac sac | gzip > /var/backups/sac-db-$(date +%F).sql.gz
sudo tar czf /var/backups/sac-media-$(date +%F).tgz -C /opt/django/sac media

Copy /var/backups to Azure Blob Storage (az storage blob upload-batch) periodically for off-VM retention.

sudo journalctl -u gunicorn.service --no-pager -n 80
sudo journalctl -u nginx.service --no-pager -n 30
sudo journalctl -u postgresql.service --no-pager -n 30
sudo tail -50 /var/log/nginx/access.log
sudo tail -50 /var/log/nginx/error.log

Django app errors are surfaced through gunicorn's --access-logfile - and --error-logfile -, which both go to the systemd journal. For more verbose logs, set DJANGO_DEBUG=true in /etc/django/sac.env. Use this setting for development only.