djamazing 0.1.0
Safe storage for django using AWS S3+CloudFront
License: MIT

-----------------------------------------------
Djamazing - a safe storage for AWS
-----------------------------------------------

Djamazing [d͡ʒəˈmeɪzɪŋ] offers a way to use S3+Cloudfront as Django Storage. It has the
benefit over conventional storages, that it generates signed URLs, so only the
user who was able to display the URL is also able to access it. Djamazing
can work in two modes:

    unprotected mode
        In this mode the storage simply generates URL-s to cloudfront. The
        cloudfront distribution should be publicly accessible. This can be used
        for files that don't require special security.

    protected mode
        The URLs are signed in this model using the ``SECRET_KEY``. These
        signatures are only valid for the current user. Please remember that
        it is *up to the developer* to ensure that the signed URLs are created
        only when the user that can access them is logged in (some kind of
        per-row authorization should probably be in place).  After clicking
        these a special view redirects the user to a signed cloudfront URL.
        This URL is only valid for a very small amount of time.

AWS configuration
-------------------------

1. Create an S3 bucket.
2. Generate a keypair for the user that can access the bucket.
3. Create a cloudfront distribution that has origin in the bucket and is
   restricted to signed URLs.
4. (for protected mode) Generate a cloudfront keypair that can be used in
    the distribution.

Installation
------------------------

1. Install djamazing by pip::

   $ pip install djamazing

   NOTE: If you are using `djamazing` with Django 1.10 you need a yet
   unpublished version of `django-threadlocals`::

   $ pip install git+https://github.com/nebstrebor/django-threadlocals.git

2. Set ``"djamazing.storage.DjamazingStorage"`` as your DEFAULT_FILE_STORAGE.
3. Configure Djamazing::
   
    DJAMAZING = {
        'CLOUDFRONT_KEY': b"""-----BEGIN RSA PRIVATE KEY-----                                                 
    (...)
    -----END RSA PRIVATE KEY-----""",
        'CLOUDFRONT_KEY_ID': '...',
        'CLOUDFRONT_URL': 'http://....cloudfront.net/', 
        'S3_KEY_ID': '...',
        'S3_SECRET_KEY': '...',
        'S3_BUCKET': '...',
        'SIGNATURE_TIMEOUT': datetime.timedelta(seconds=2),
    }

   For unprotected mode omit the ``CLOUDFRONT_KEY`` and ``CLOUDFRONT_KEY_ID``
   keys.
   If you want to store a cloudfornt key in the file ``CLOUDFRONT_KEY_FILE``
   parameter may be also used with file path.
   Note that the `SIGNATURE_TIMEOUT` is the time that doesn't require any human
   interaction, only the browser to handle the redirection. If unspecified - it
   defaults to 1.5 second.
4. Add threadlocals middleware
   ``'threadlocals.middleware.ThreadLocalMiddleware'`` to your ``MIDDLEWARE``
5. Add djamazing URLs to ``urls.py``::

    url(r'^djamazing/', include(djamazing.urls)),

Using various configurations in one project
---------------------------------------------

If you want to use various configurations in one project (e.g. unprotected for
static file and protected for uploads), you can use inheritance. Create a
simple subclass of ``DjamazingStorage`` like::

    class StaticStorage(DjamazingStorage):
        """Storage for static files"""

        def __init__(self):
            super(StaticStorage, self).__init__(settings.STATIC_DJAMAZING)

now you can use it as your storage like::

    STATICFILES_STORAGE = 'some.path.StaticStorage'
    STATIC_DJAMAZING = { ... }

and the ``STATIC_DJAMAZING`` configuration would override ``DJAMAZING``
configuration for this storage.