.

.env.dev

@@ -18,5 +18,6 @@ GUNICORN_WORKERS=3
 GUNICORN_LOGLEVEL=info
 
 # Nginx host ports for local development (override prod defaults)
-NGINX_HTTP_PORT=8000
+NGINX_HTTP_PORT=8080
-NGINX_HTTPS_PORT=8443
+# Pick a non-privileged HTTPS port to avoid conflicts with host installs
+NGINX_HTTPS_PORT=8444

.gitignore

@@ -16,3 +16,5 @@ temp/
 # Loki runtime data
 /docker/loki-data/
 /docker/loki-wal/
+# Local runtime logs collected by Promtail
+/logs/

deploy/nginx/dev.conf

@@ -7,6 +7,10 @@ server {
     listen [::]:80;
     server_name _;
 
+    # Write logs to the host-mounted folder so Promtail can scrape them
+    access_log /var/log/rad/nginx.access.log combined;
+    error_log  /var/log/rad/nginx.error.log warn;
+
     client_max_body_size 100M;
 
     location /static/ {

deploy/nginx/prod.conf

@@ -8,6 +8,10 @@ server {
     listen [::]:80;
     server_name _;
 
+    # Write logs to the host-mounted folder so Promtail can scrape them
+    access_log /var/log/rad/nginx.access.log combined;
+    error_log  /var/log/rad/nginx.error.log warn;
+
     client_max_body_size 100M;
 
     # Serve static files from the static volume
@@ -112,6 +116,10 @@ server {
 
     client_max_body_size 4G;
 
+    # Write logs to the host-mounted folder so Promtail can scrape them
+    access_log /var/log/rad/nginx.access.log combined;
+    error_log  /var/log/rad/nginx.error.log warn;
+
     # Same static/media handling as above
     location /static/ { alias /usr/src/app/static/; }
     location /media { alias /usr/src/app/media; }

docker/docker-compose.dev.yml

@@ -24,6 +24,7 @@ services:
     image: nginx:1.25-alpine
     volumes:
       - ../deploy/nginx/dev.conf:/etc/nginx/conf.d/default.conf:ro
+      - ../logs:/var/log/rad:rw
 
   loki:
     image: grafana/loki:2.8.2

docker/docker-compose.prod.yml

@@ -45,6 +45,7 @@ services:
       - web
     volumes:
       - ../deploy/nginx/prod.conf:/etc/nginx/conf.d/default.conf:ro
+      - ../logs:/var/log/rad:rw
       - static_volume:/usr/src/app/static:ro
       - media_volume:/usr/src/app/media:ro
       - ../deploy/nginx/certs:/etc/letsencrypt:ro

generic/mixins.py

@@ -65,6 +65,9 @@ class AuthorMixin():
 
     def is_author(self, user: User) -> bool:
         """Returns True if the user is an author of the object"""
+        if user.is_superuser:
+            return True
+
         return self.author.filter(id=user.id).exists()
 
 

generic/views.py

@@ -1774,7 +1774,7 @@ class ExamViews(View, LoginRequiredMixin):
     def exam_list_collection(self, request, collection_id):
         collection = get_object_or_404(ExamCollection, pk=collection_id)
 
-        if not request.user in collection.author.all():
+        if not collection.is_author(request.user):
             raise PermissionDenied
 
         return self.exam_list(request, all=True, collection=collection)