.

- Added logging configuration to WSGI for persistent log collection.
- Updated Docker Compose files for local and development environments, including Redis, PostgreSQL, and Grafana services.
- Introduced Promtail configuration for log scraping and integration with Loki.
- Created application log directory in Dockerfile for log persistence.

.env.dev

@@ -0,0 +1,22 @@
+# Django
+DEBUG=1
+SECRET_KEY=w(s0&(_eb058wvmg@44_repv8)r9@5p8fx*g_@c)1dm&d*ew^u
+DJANGO_ALLOWED_HOSTS=localhost 127.0.0.1 [::1]
+
+# External DB (you mentioned production uses an external DB)
+DB_HOST=db-postgresql-lon1-05515-jan-22-backup-do-user-8165014-0.c.db.ondigitalocean.com
+DB_PORT=25060
+DB_NAME=testing
+DB_USER=django
+DB_PASSWORD=AVNS_NG_s4i7SMMobWLO
+
+# Redis
+REDIS_URL=redis://redis:6379/0
+
+# Gunicorn tuning
+GUNICORN_WORKERS=3
+GUNICORN_LOGLEVEL=info
+
+# Nginx host ports for local development (override prod defaults)
+NGINX_HTTP_PORT=8000
+NGINX_HTTPS_PORT=8443

.env.prod.example

@@ -0,0 +1,20 @@
+# Copy this to .env.prod on the server and fill in production values (do NOT commit secrets).
+
+# Django
+SECRET_KEY=replace-me-with-a-secure-random-string
+DEBUG=0
+ALLOWED_HOSTS=example.com
+
+# External DB (you mentioned production uses an external DB)
+DATABASE_HOST=your.db.host
+DATABASE_PORT=5432
+DATABASE_NAME=rad
+DATABASE_USER=django
+DATABASE_PASSWORD=strong-db-password
+
+# Redis
+REDIS_URL=redis://redis:6379/0
+
+# Gunicorn tuning
+GUNICORN_WORKERS=3
+GUNICORN_LOGLEVEL=info

.gitignore

@@ -12,3 +12,7 @@ venv
 *.log
 
 temp/
+
+# Loki runtime data
+/docker/loki-data/
+/docker/loki-wal/

anatomy/api.py

@@ -19,51 +19,50 @@ from django.contrib.auth import get_user_model
 router = Router()
 
 class CidUserSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = CidUser
 
-        model_fields = ["cid", "name", "email"]
+        fields = ["cid", "name", "email"]
 
 class UserUserSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = get_user_model()
-        model_fields = ["id", "email"]
+        fields = ["id", "email"]
 
 class CidUserExamSchema(ModelSchema):
     cid_user : CidUserSchema | None
     user_user : UserUserSchema | None
-    class Config:
+    class Meta:
         model = CidUserExam
-        model_fields = ["id"]
+        fields = ["id"]
 
 class ExamStatusSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = ExamUserStatus
-        model_fields = ["id", "datetime", "status", "extra"]
+        fields = ["id", "datetime", "status", "extra"]
 
 class ExamUserStatusSchema(ModelSchema):
 
     #cid_user : CidUserSchema | None
     #user_user : UserUserSchema | None
     cid_user_exam : CidUserExamSchema | None
-    class Config:
+    class Meta:
         model = ExamUserStatus
-        model_fields = ["id", "datetime", "status", "extra"]
+        fields = ["id", "datetime", "status", "extra"]
 
 class QuestionSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Question
 
-        #model_fields = ["question", "history", "feedback", "normal", "laterality"]
-        model_fields = "__all__"
+        fields = "__all__"
 
-        #model_exclude = ["answers"]
+        #exclude = ["answers"]
 
 class ExamSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Exam
 
-        model_fields = ["id", "name", "active", "publish_results"]
+        fields = ["id", "name", "active", "publish_results"]
 
 @router.get('/')
 def list_questions(request):

atlas/api.py

@@ -32,9 +32,9 @@ router = Router()
 class SeriesSchema(ModelSchema):
     case_id: List[int] = []
 
-    class Config:
+    class Meta:
         model = Series
-        model_fields = [
+        fields = [
             "id",
             "modality",
             "examination",
@@ -48,9 +48,9 @@ class SeriesSchema(ModelSchema):
 
 
 class CaseSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Case
-        model_fields = ["id", "title"]
+        fields = ["id", "title"]
 
 
 @router.post("/upload_dicom", auth=django_auth)

atlas/filters.py

@@ -209,9 +209,15 @@ class ConditionFilter(django_filters.FilterSet):
 
 
 class FindingFilter(django_filters.FilterSet):
+    # Replace legacy `primary`/`synonym` with canonical-based filters
+    is_canonical = django_filters.BooleanFilter(method="filter_is_canonical", label="Canonical")
+    synonym = django_filters.ModelChoiceFilter(queryset=Finding.objects.all(), method="filter_synonym", label="Synonym group")
+
     class Meta:
         model = Finding
-        fields = ("name", "primary", "synonym")
+        fields = {
+            "name": ["icontains"],
+        }
 
     def __init__(
         self,
@@ -227,11 +233,29 @@ class FindingFilter(django_filters.FilterSet):
         )
         pass
 
+    def filter_is_canonical(self, queryset, name, value):
+        if value in (True, "True", "true", 1, "1"):
+            return queryset.filter(canonical__isnull=True)
+        if value in (False, "False", "false", 0, "0"):
+            return queryset.filter(canonical__isnull=False)
+        return queryset
+
+    def filter_synonym(self, queryset, name, value):
+        # value is a Finding instance selected in the filter. Return all
+        # Findings that belong to the same canonical group as `value`.
+        if not value:
+            return queryset
+        master = value.canonical if value.canonical else value
+        return queryset.filter(Q(canonical=master) | Q(pk=master.pk))
+
 
 class StructureFilter(django_filters.FilterSet):
+    is_canonical = django_filters.BooleanFilter(method="filter_is_canonical", label="Canonical")
+    synonym = django_filters.ModelChoiceFilter(queryset=Structure.objects.all(), method="filter_synonym", label="Synonym group")
+
     class Meta:
         model = Structure
-        fields = {"name": ["icontains"], "primary": ["exact"], "synonym": ["exact"]}
+        fields = {"name": ["icontains"]}
 
     def __init__(
         self,
@@ -247,6 +271,19 @@ class StructureFilter(django_filters.FilterSet):
         )
         pass
 
+    def filter_is_canonical(self, queryset, name, value):
+        if value in (True, "True", "true", 1, "1"):
+            return queryset.filter(canonical__isnull=True)
+        if value in (False, "False", "false", 0, "0"):
+            return queryset.filter(canonical__isnull=False)
+        return queryset
+
+    def filter_synonym(self, queryset, name, value):
+        if not value:
+            return queryset
+        master = value.canonical if value.canonical else value
+        return queryset.filter(Q(canonical=master) | Q(pk=master.pk))
+
 
 class PresentationFilter(django_filters.FilterSet):
     class Meta:

atlas/forms.py

@@ -56,7 +56,8 @@ from generic.models import Examination  # , Sign
 
 from django.contrib.admin.widgets import FilteredSelectMultiple
 from django.forms.widgets import RadioSelect, TextInput, Textarea, Select
-from crispy_forms.layout import Submit, Layout, Fieldset, Field, Div, HTML
+from crispy_forms.layout import Submit, Layout, Fieldset, Field, Div, HTML, Button
+from django.urls import reverse
 from crispy_forms.bootstrap import Accordion, AccordionGroup
 
 from tinymce.widgets import TinyMCE
@@ -118,11 +119,10 @@ class ConditionForm(ModelForm):
     class Meta:
         model = Condition
         exclude = ["rcr_curriculum"]
-
         widgets = {
-            "synonym": autocomplete.ModelSelect2Multiple(
-                url="atlas:condition-autocomplete"
-            ),
+            # Use an AJAX/autocomplete single-select for canonical so users
+            # can search for existing canonical Conditions by name.
+            "canonical": autocomplete.ModelSelect2(url="atlas:condition-autocomplete"),
             "parent": autocomplete.ModelSelect2Multiple(
                 url="atlas:condition-autocomplete"
             ),
@@ -138,7 +138,21 @@ class ConditionForm(ModelForm):
             self.helper = FormHelper()
             self.helper.form_method = "post"
             self.helper.form_tag = True
+            # Primary submit
             self.helper.add_input(Submit("submit", "Submit"))
+            # Cancel as a button that redirects back to the condition list
+            try:
+                cancel_url = reverse("atlas:condition_view")
+            except Exception:
+                cancel_url = "#"
+            self.helper.add_input(
+                Button(
+                    "cancel",
+                    "Cancel",
+                    css_class="btn btn-secondary ms-2",
+                    onclick=f"window.location='{cancel_url}'",
+                )
+            )
         except Exception:
             # If crispy not available or something goes wrong, don't break form
             pass
@@ -327,9 +341,10 @@ class FindingForm(ModelForm):
     class Meta:
         model = Finding
         exclude = []
-
+        # Use the canonical FK in forms (if users want to mark this Finding
+        # as an alias of another). The old `synonym` M2M has been removed.
         widgets = {
-            "synonym": autocomplete.ModelSelect2Multiple(
+            "canonical": autocomplete.ModelSelect2(
                 url="atlas:finding-autocomplete"
             ),
         }
@@ -339,9 +354,8 @@ class StructureForm(ModelForm):
     class Meta:
         model = Structure
         exclude = []
-
         widgets = {
-            "synonym": autocomplete.ModelSelect2Multiple(
+            "canonical": autocomplete.ModelSelect2(
                 url="atlas:structure-autocomplete"
             ),
         }

atlas/migrations/0088_remove_finding_primary_remove_finding_synonym_and_more.py

@@ -0,0 +1,40 @@
+# Generated by Django 5.2.7 on 2025-11-24 10:17
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('atlas', '0087_alter_condition_canonical'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='finding',
+            name='primary',
+        ),
+        migrations.RemoveField(
+            model_name='finding',
+            name='synonym',
+        ),
+        migrations.RemoveField(
+            model_name='structure',
+            name='primary',
+        ),
+        migrations.RemoveField(
+            model_name='structure',
+            name='synonym',
+        ),
+        migrations.AddField(
+            model_name='finding',
+            name='canonical',
+            field=models.ForeignKey(blank=True, help_text='If set, this Finding is an alias and points to the canonical Finding.', null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='aliases', to='atlas.finding'),
+        ),
+        migrations.AddField(
+            model_name='structure',
+            name='canonical',
+            field=models.ForeignKey(blank=True, help_text='If set, this Structure is an alias and points to the canonical Structure.', null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='aliases', to='atlas.structure'),
+        ),
+    ]

atlas/migrations/0089_remove_condition_primary_remove_condition_synonym.py

@@ -0,0 +1,21 @@
+# Generated by Django 5.2.7 on 2025-11-24 10:31
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('atlas', '0088_remove_finding_primary_remove_finding_synonym_and_more'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='condition',
+            name='primary',
+        ),
+        migrations.RemoveField(
+            model_name='condition',
+            name='synonym',
+        ),
+    ]

atlas/models.py

@@ -110,10 +110,24 @@ class SynMixin(object):
     #    abstract = True
 
     def __str__(self) -> str:
-        if self.primary:
+        # Determine whether this record should be displayed as the
+        # canonical/primary entry. Prefer the new canonical FK pattern
+        # (`canonical is None` means this object is the master). Fallback
+        # to legacy `primary` boolean when present.
+        # If the model supports canonical FK, consider canonical==None as
+        # the primary/master entry. For models without canonical (legacy
+        # edge-cases), treat the instance as primary by default.
+        if hasattr(self, "canonical"):
+            try:
+                if self.canonical is None or self.canonical == self:
                     return self.name
-        else:
                 return f"{self.name} [syn]"
+            except Exception:
+                # defensive fallback
+                return f"{self.name} [syn]"
+
+        # No canonical support: assume primary
+        return self.name
 
     def get_old_str(self) -> str:
         # Prefer using a model-specific get_synonyms (e.g. Condition.get_synonyms)
@@ -121,19 +135,30 @@ class SynMixin(object):
             syns = self.get_synonyms()
         except Exception:
             syns = None
+        # If the model supports canonical, only canonical==None entries
+        # should be rendered as the primary name. For models without
+        # canonical, treat instance as primary.
+        if hasattr(self, "canonical"):
+            try:
+                is_primary = self.canonical is None or self.canonical == self
+            except Exception:
+                is_primary = False
+        else:
+            is_primary = True
 
-        if self.primary:
+        if is_primary:
             if syns is None:
-                if getattr(self, "synonym", None) is None or self.synonym.count() == 0:
+                synonyms_field = getattr(self, "synonym", None)
+                if synonyms_field is None or (hasattr(synonyms_field, "count") and synonyms_field.count() == 0):
                     return self.name
-                synonyms = ",".join([i.name for i in self.synonym.all()])
+                synonyms = ",".join([i.name for i in synonyms_field.all()])
                 return f"{self.name} ({synonyms})"
             else:
                 if not syns:
                     return self.name
                 synonyms = ",".join([i.name for i in syns])
                 return f"{self.name} ({synonyms})"
-        else:
+
         return f"{self.name} [syn]"
 
     def get_synonym(self):
@@ -143,16 +168,33 @@ class SynMixin(object):
             syns = self.get_synonyms()
         except Exception:
             syns = None
-
-        if getattr(self, "primary", False):
+        # If canonical is present and this instance is the master, mark Primary
+        if hasattr(self, "canonical"):
+            try:
+                if self.canonical is None or self.canonical == self:
                     return "[Primary]"
-        else:
+            except Exception:
+                pass
+
         if syns is None:
-                s = self.synonym.filter(primary=True).values_list("name", flat=True)
+            synonyms_field = getattr(self, "synonym", None)
+            if synonyms_field is None:
+                return ""
+            # If the old M2M exists, prefer those marked primary if such a
+            # attribute exists on the related objects.
+            try:
+                # Select all synonym names; legacy `primary` flag removed.
+                s = synonyms_field.values_list("name", flat=True)
+            except Exception:
+                s = []
             return ", ".join(s)
-            else:
+
         # prefer primary names among synonyms if present
-                primary_names = [i.name for i in syns if getattr(i, "primary", False)]
+        primary_names = []
+        for i in syns:
+            # Prefer items that are canonical/master in the group
+            if getattr(i, "canonical", None) is None:
+                primary_names.append(i.name)
         if primary_names:
             return ", ".join(primary_names)
         return ", ".join([i.name for i in syns])
@@ -162,17 +204,24 @@ class SynMixin(object):
             syns = self.get_synonyms()
         except Exception:
             syns = None
-
-        if getattr(self, "primary", False):
+        # Prefer canonical/master check
+        if hasattr(self, "canonical"):
+            try:
+                if self.canonical is None or self.canonical == self:
                     return "[Primary]"
-        else:
+            except Exception:
+                pass
+
         if syns is None:
             # fall back to all M2M synonyms (not just primary) for models
             # that still use the old synonym field (e.g. Finding, Structure)
-                syns_qs = self.synonym.all()
+            synonyms_field = getattr(self, "synonym", None)
+            if synonyms_field is None:
+                return ""
+            syns_qs = synonyms_field.all()
             items = [f"<a href='{s.get_absolute_url()}'>{s.name}</a>" for s in syns_qs]
             return ", ".join(items)
-            else:
+
         # render links for synonyms/canonical group
         items = [f"<a href='{s.get_absolute_url()}'>{s.name}</a>" for s in syns]
         return ", ".join(items)
@@ -183,22 +232,40 @@ class SynMixin(object):
 
 class Finding(SynMixin, models.Model):
     name = models.CharField(max_length=255, unique=True)
-    synonym = models.ManyToManyField("self", blank=True)
-
-    primary = models.BooleanField(default="True")
+    # New canonical/alias field: if set, this Finding is an alias and points
+    # to the canonical/master Finding. We remove the old M2M `synonym` and
+    # `primary` boolean in favour of this single canonical FK.
+    canonical = models.ForeignKey(
+        "self",
+        null=True,
+        blank=True,
+        on_delete=models.SET_NULL,
+        related_name="aliases",
+        help_text="If set, this Finding is an alias and points to the canonical Finding.",
+    )
 
     def get_absolute_url(self):
         return reverse("atlas:finding_detail", kwargs={"pk": self.pk})
 
+    @property
+    def canonical_finding(self):
+        return self.canonical if self.canonical else self
+
+    def get_synonyms(self):
+        """Return other Findings that are aliases/synonyms for this concept.
+
+        Behaviour mirrors Condition.get_synonyms: if this Finding is an alias
+        (has canonical set) return the canonical and other aliases (excluding
+        self). If this Finding is canonical, return all aliases (excluding
+        self).
+        """
+        master = self.canonical_finding
+        qs = Finding.objects.filter(models.Q(canonical=master) | models.Q(pk=master.pk)).exclude(pk=self.pk)
+        return qs
+
 
 class Condition(SynMixin, models.Model):
     name = models.CharField(max_length=255, unique=True)
-
-    synonym = models.ManyToManyField(
-        "self",
-        blank=True,
-        help_text="Use if a direct synonym for the condition exists, e.g. 'Wegener granulomatosis' and 'Granulomatosis with Polyangitis'.",
-    )
     # New canonical/alias field (Option B): if set, this Condition is an alias
     # and points to the canonical/master Condition.
     canonical = models.ForeignKey(
@@ -218,10 +285,10 @@ class Condition(SynMixin, models.Model):
         help_text="Use if the condition could be considered a subset of another, e.g. 'Alzheimer disease' and 'Dementia'.",
     )
 
-    primary = models.BooleanField(
-        default="True",
-        help_text="Sets if this should be the canonical item, all other synonyms will then redirect to this by default.",
-    )
+    # Legacy fields `synonym` (M2M) and `primary` (boolean) have been removed.
+    # Canonical/aliases are represented by the `canonical` ForeignKey and
+    # the reverse `aliases` related_name. Use `get_synonyms()` /
+    # `canonical_condition` to access canonical groups.
 
     subspecialty = models.ManyToManyField(
         "subspecialty",
@@ -339,14 +406,28 @@ class Differential(models.Model):
 
 class Structure(SynMixin, models.Model):
     name = models.CharField(max_length=255, unique=True)
-
-    synonym = models.ManyToManyField("self", blank=True)
-
-    primary = models.BooleanField(default="True")
+    # Migrate to canonical/aliases model like Condition and Finding
+    canonical = models.ForeignKey(
+        "self",
+        null=True,
+        blank=True,
+        on_delete=models.SET_NULL,
+        related_name="aliases",
+        help_text="If set, this Structure is an alias and points to the canonical Structure.",
+    )
 
     def get_absolute_url(self):
         return reverse("atlas:structure_detail", kwargs={"pk": self.pk})
 
+    @property
+    def canonical_structure(self):
+        return self.canonical if self.canonical else self
+
+    def get_synonyms(self):
+        master = self.canonical_structure
+        qs = Structure.objects.filter(models.Q(canonical=master) | models.Q(pk=master.pk)).exclude(pk=self.pk)
+        return qs
+
 
 @reversion.register
 class Case(models.Model, AuthorMixin, QuestionMixin):

atlas/tables.py

@@ -276,7 +276,7 @@ class ConditionTable(SelectionTable):
     class Meta(SelectionTable.Meta):
         model = Condition
         template_name = "django_tables2/bootstrap4.html"
-        fields = ("primary", "subspecialty", "rcr_curriculum_map", "rcr_curriculum")
+        fields = ("subspecialty", "rcr_curriculum_map", "rcr_curriculum")
         sequence = ("name",)
 
 
@@ -312,7 +312,7 @@ class FindingTable(SelectionTable):
     class Meta(SelectionTable.Meta):
         model = Finding
         template_name = "django_tables2/bootstrap4.html"
-        fields = ("name", "primary")
+        fields = ("name",)
         sequence = ("name",)
 
 
@@ -339,7 +339,7 @@ class StructureTable(SelectionTable):
     class Meta(SelectionTable.Meta):
         model = Structure
         template_name = "django_tables2/bootstrap4.html"
-        fields = ("name", "primary")
+        fields = ("name",)
         sequence = ("name",)
 
 

atlas/templates/atlas/collection_case_displaysetup.html

@@ -30,7 +30,7 @@
                 document.getElementById('viewerstate-save-response').innerHTML = "<span class='text-danger'>Viewer state could not be retrieved.</span>";
                 return;
             }
-            fetch({% if case_number %}"{% url 'atlas:collection_case_displaysetup' casedetail.collection.pk case_number=case_number %}"{% else %}"{% url 'atlas:collection_case_displaysetup_legacy' casedetail.collection.pk casedetail.case.pk %}"{% endif %}, {
+            fetch({% if case_number %}"{% url 'atlas:collection_case_displaysetup' casedetail.collection.pk case_number %}"{% else %}"{% url 'atlas:collection_case_displaysetup_legacy' casedetail.collection.pk casedetail.case.pk %}"{% endif %}, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
@@ -47,7 +47,7 @@
                 });
         });
         document.getElementById('reset-viewerstate').addEventListener('click', function() {
-            fetch({% if case_number %}"{% url 'atlas:collection_case_displaysetup' casedetail.collection.pk case_number=case_number %}"{% else %}"{% url 'atlas:collection_case_displaysetup_legacy' casedetail.collection.pk casedetail.case.pk %}"{% endif %}, {
+            fetch({% if case_number %}"{% url 'atlas:collection_case_displaysetup' casedetail.collection.pk case_number %}"{% else %}"{% url 'atlas:collection_case_displaysetup_legacy' casedetail.collection.pk casedetail.case.pk %}"{% endif %}, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",

atlas/templates/atlas/collection_case_view_take.html

@@ -2,8 +2,11 @@
 {% load crispy_forms_tags %}
 
 {% block content %}
-    <span class="collection-name-blend">Collection: {{collection}}</span>
-    <h2>Case {{case_number|add:1}}
+    <div class="mb-2"><small class="text-muted">Collection: <strong>{{collection}}</strong></small></div>
+
+    <div class="d-flex justify-content-between align-items-start mb-3">
+        <div>
+            <h2 class="h4 mb-0">Case {{case_number|add:1}}
 
                 {% if show_title %}
                     : {{case.title}}
@@ -11,19 +14,36 @@
 
 
                 {% if question_completed %}
-            <span class="stamp-white">REVIEW</span>
+                    <span class="badge bg-warning text-dark ms-2 small">REVIEW</span>
                 {% endif %}
 
-
             </h2>
+        </div>
+
+        <div class="d-flex align-items-center ms-3">
+            <div class="dropdown">
+                <a class="btn btn-outline-secondary btn-sm dropdown-toggle" href="#" role="button" id="caseJump" data-bs-toggle="dropdown" aria-expanded="false"
+                   hx-get="{% url 'atlas:collection_case_jump_partial' pk=collection.pk %}?current={{case_number}}{% if cid %}&cid={{cid}}&passcode={{passcode}}{% endif %}"
+                   hx-target="#case-jump-menu"
+                   hx-swap="innerHTML"
+                   hx-trigger="click">
+                    Jump
+                </a>
+                <div class="dropdown-menu dropdown-menu-end" id="case-jump-menu">
+                    <div class="px-3 py-2 text-muted">Loading...</div>
+                </div>
+            </div>
+        </div>
+    </div>
 
     {% if not question_completed and collection.question_time_limit is not None %}
-        <div id="question-timer-block" style="margin-top:8px; margin-bottom:8px;" title="This question has a time limit of {{ collection.question_time_limit }} seconds. The timer will start when the page loads.">
-            <strong>Time remaining:</strong>
-            <span id="question-timer" aria-live="polite">&nbsp;</span>
-            <div id="question-timer-progress" style="display:inline-block; vertical-align: middle; width: 200px; margin-left:12px;">
-                <div id="question-timer-progress-outer" style="background:#e9ecef; border-radius:6px; height:10px; overflow:hidden;">
-                    <div id="question-timer-progress-inner" style="width:100%; height:100%; background:var(--timer-color, #28a745);"></div>
+        <div id="question-timer-block" class="mb-3" title="This question has a time limit of {{ collection.question_time_limit }} seconds. The timer will start when the page loads.">
+            <div class="d-flex align-items-center gap-3">
+                <div><strong>Time remaining:</strong> <span id="question-timer" aria-live="polite">&nbsp;</span></div>
+                <div style="flex:1; max-width:320px;">
+                    <div class="progress" style="height:10px;">
+                        <div id="question-timer-progress-inner" class="progress-bar" role="progressbar" style="width:100%; background:var(--timer-color, #28a745);"></div>
+                    </div>
                 </div>
             </div>
             <div id="timer-htmx-target" style="display:none;"></div>
@@ -38,12 +58,10 @@
 
     {% if not question_completed %}
         {% if resources %}
-            <h5>Resources</h4>
-            <ul class="no-list-style">
+            <h5 class="mt-3">Resources</h5>
+            <ul class="list-group list-group-flush mb-3">
                 {% for caseresource in resources %}
-                    <li>
-                        {{caseresource.resource.get_display}}
-                    </li>
+                    <li class="list-group-item py-1 small">{{caseresource.resource.get_display}}</li>
                 {% endfor %}
             </ul>
         {% endif %}
@@ -51,14 +69,21 @@
 
 
     {% if show_description and case.description %}
-        <div>
-            Description: {{case.description}}
+        <div class="mb-3">
+            <h6 class="mb-1">Description</h6>
+            <p class="mb-0">{{case.description}}</p>
         </div>
     {% endif %}
     {% if show_history %}
-        <div>
-            History: {{casedetail.get_history_pre|linebreaks}}
-
+        <div class="card mb-3">
+            <div class="card-body p-2 d-flex justify-content-between align-items-start">
+                <div class="me-3 small text-muted">History: {{casedetail.get_history_pre|linebreaks}}</div>
+                {% if has_priors %}
+                    <div class="ms-2">
+                        <span title="This case has priors available for comparison" class="badge bg-secondary text-white rounded-pill small">Priors{% if prior_count %} ({{ prior_count }}){% endif %}</span>
+                    </div>
+                {% endif %}
+            </div>
         </div>
     {% endif %}
 
@@ -66,9 +91,9 @@
         <div>
 
             {% if question_completed %}
-                <iframe id="viewer" style="width: 100%; height: 100%; border: none; padding: 0px; min-height: 700px" src="/ohif/viewer/dicomjson?url=https://www.penracourses.org.uk{% if case_number %}{% url 'atlas:collection_case_dicom_json_review' collection.pk case_number=case_number %}{% else %}{% url 'atlas:collection_case_dicom_json_review_legacy' collection.pk case.pk %}{% endif %}"></iframe>
+                <iframe id="viewer" style="width: 100%; height: 100%; border: none; padding: 0px; min-height: 700px" src="/ohif/viewer/dicomjson?url=https://www.penracourses.org.uk{% if case_number %}{% url 'atlas:collection_case_dicom_json_review' collection.pk case_number %}{% else %}{% url 'atlas:collection_case_dicom_json_review_legacy' collection.pk case.pk %}{% endif %}"></iframe>
             {% else %}
-                <iframe id="viewer" style="width: 100%; height: 100%; border: none; padding: 0px; min-height: 700px" src="/ohif/viewer/dicomjson?url=https://www.penracourses.org.uk{% if case_number %}{% url 'atlas:collection_case_dicom_json' collection.pk case_number=case_number %}{% else %}{% url 'atlas:collection_case_dicom_json_legacy' collection.pk case.pk %}{% endif %}"></iframe>
+                <iframe id="viewer" style="width: 100%; height: 100%; border: none; padding: 0px; min-height: 700px" src="/ohif/viewer/dicomjson?url=https://www.penracourses.org.uk{% if case_number %}{% url 'atlas:collection_case_dicom_json' collection.pk case_number %}{% else %}{% url 'atlas:collection_case_dicom_json_legacy' collection.pk case.pk %}{% endif %}"></iframe>
             {% endif %}
 
         </div>
@@ -78,9 +103,9 @@
     {% if collection.show_ohif_viewer_link %}
         <div>
             {% if question_completed %}
-                <a target="_blank" href="/ohif/viewer/dicomjson?url=https://www.penracourses.org.uk{% if case_number %}{% url 'atlas:collection_case_dicom_json_review' collection.pk case_number=case_number %}{% else %}{% url 'atlas:collection_case_dicom_json_review_legacy' collection.pk case.pk %}{% endif %}" title="Click to open the case in the advanced viewer. This will open in a new tab/window."><button class="viewer"><i class="bi bi-collection"></i> Launch advanced viewer.</button></a>
+                <a target="_blank" href="/ohif/viewer/dicomjson?url=https://www.penracourses.org.uk{% if case_number %}{% url 'atlas:collection_case_dicom_json_review' collection.pk case_number %}{% else %}{% url 'atlas:collection_case_dicom_json_review_legacy' collection.pk case.pk %}{% endif %}" title="Click to open the case in the advanced viewer. This will open in a new tab/window."><button class="viewer"><i class="bi bi-collection"></i> Launch advanced viewer.</button></a>
             {% else %}
-                <a target="_blank" href="/ohif/viewer/dicomjson?url=https://www.penracourses.org.uk{% if case_number %}{% url 'atlas:collection_case_dicom_json' collection.pk case_number=case_number %}{% else %}{% url 'atlas:collection_case_dicom_json_legacy' collection.pk case.pk %}{% endif %}" title="Click to open the case in the advanced viewer. This will open in a new tab/window."><button class="viewer"><i class="bi bi-collection"></i> Launch advanced viewer.</button></a>
+                <a target="_blank" href="/ohif/viewer/dicomjson?url=https://www.penracourses.org.uk{% if case_number %}{% url 'atlas:collection_case_dicom_json' collection.pk case_number %}{% else %}{% url 'atlas:collection_case_dicom_json_legacy' collection.pk case.pk %}{% endif %}" title="Click to open the case in the advanced viewer. This will open in a new tab/window."><button class="viewer"><i class="bi bi-collection"></i> Launch advanced viewer.</button></a>
             {% endif %}
         </div>
     {% endif %}
@@ -131,28 +156,24 @@
     {% endif %}
 
     {% if show_discussion and case.discussion %}
-        <p>
-            <details>
-                <summary>
-                    Discussion:
+        <details class="card mb-3">
+            <summary class="card-header p-2" style="cursor: pointer;">
+                <strong>Discussion</strong>
             </summary>
-                <div>
+            <div class="card-body p-2 small">
                 {{case.discussion|linebreaks}}
             </div>
         </details>
-        </p>
     {% endif %}
     {% if show_report and case.report %}
-        <p>
-            <details>
-                <summary>
-                    Report:
+        <details class="card mb-3">
+            <summary class="card-header p-2" style="cursor: pointer;">
+                <strong>Report</strong>
             </summary>
-                <div>
+            <div class="card-body p-2 small">
                 {{case.report|linebreaks}}
             </div>
         </details>
-        </p>
     {% endif %}
 
     {% if question_completed %}
@@ -246,25 +267,28 @@
             {% endif %}
 
         {% endif %}
+        <div class="mb-2">
             {% if previous %}
-            <button type="submit" name="previous" class="save btn btn-default">Previous</button>
+                <button type="submit" name="previous" class="btn btn-outline-secondary btn-sm me-2">Previous</button>
             {% endif %}
             {% if next %}
-            <button type="submit" name="next" class="save btn btn-default">Next</button>
+                <button type="submit" name="next" class="btn btn-primary btn-sm me-2">Next</button>
             {% elif collection.collection_type == "REP" %}
                 {% if not exam.publish_results %}
-                <button type="submit" name="save" class="save btn btn-default">Save</button>
+                    <button type="submit" name="save" class="btn btn-primary btn-sm me-2">Save</button>
                 {% endif %}
             {% endif %}
+        </div>
 
         {% if collection.self_review and not collection.feedback_once_collection_complete and not question_completed %}
-            <button type="submit" name="complete_case" class="save btn btn-default">Finish Case</button>
+            <button type="submit" name="complete_case" class="btn btn-success btn-sm">Finish Case</button>
         {% endif %}
 
 
-        <br />
-        <button type="submit" name="finish" class="save btn btn-default">Overview</button>
+        <div class="mt-3">
+            <button type="submit" name="finish" class="btn btn-outline-secondary btn-sm">Overview</button>
             <button type="submit" id="goto-button" value="test" name="goto" class="hide">goto</button>
+        </div>
     </form>
     <style>
         label {

atlas/templates/atlas/condition_form.html

@@ -15,11 +15,6 @@
     <form action="" method="post" enctype="multipart/form-data" id="condition-form">
         {% csrf_token %}
         {% crispy form %}
-
-        <div class="mt-3">
-            <button type="submit" class="btn btn-primary">Submit</button>
-            <a class="btn btn-secondary ms-2" href="{% url 'atlas:condition_view' %}">Cancel</a>
-        </div>
     </form>
 
 {% endblock %}

atlas/templates/atlas/partials/_collection_case_jump.html

@@ -0,0 +1,11 @@
+{% for cd in casedetails %}
+    {% with idx=forloop.counter0 %}
+        {% if cid %}
+            <a class="dropdown-item {% if idx == current %}active{% endif %}" href="{% url 'atlas:collection_case_view_take' pk=collection.pk case_number=idx cid=cid passcode=passcode %}">
+        {% else %}
+            <a class="dropdown-item {% if idx == current %}active{% endif %}" href="{% url 'atlas:collection_case_view_take_user' pk=collection.pk case_number=idx %}">
+        {% endif %}
+        Case {{ forloop.counter }}: {{ cd.case.title|default:cd.case.pk|truncatechars:60 }}
+        </a>
+    {% endwith %}
+{% endfor %}

atlas/templates/atlas/partials/_prior_card.html

@@ -27,7 +27,7 @@
                 {% if not added %}
                     <form class="row g-2"
                           {% if case_number %}
-                              hx-post="{% url 'atlas:collection_case_priors' collection.id case_number=case_number %}"
+                              hx-post="{% url 'atlas:collection_case_priors' collection.id case_number %}"
                           {% else %}
                               hx-post="{% url 'atlas:collection_case_priors_legacy' collection.id casedetail.case.pk %}"
                           {% endif %}
@@ -51,7 +51,7 @@
                 {% else %}
                     <form
                         {% if case_number %}
-                            hx-post="{% url 'atlas:collection_case_priors' collection.id case_number=case_number %}"
+                            hx-post="{% url 'atlas:collection_case_priors' collection.id case_number %}"
                         {% else %}
                             hx-post="{% url 'atlas:collection_case_priors_legacy' collection.id casedetail.case.pk %}"
                         {% endif %}

atlas/templates/atlas/partials/series_images.html

@@ -0,0 +1,31 @@
+{% load static %}
+
+<div class="series-images-list">
+    {% for image in images %}
+        <div class="d-flex align-items-center mb-2">
+            {% if image.image %}
+                <a href="{% url 'atlas:series_image_dicom' pk=image.pk %}" target="_blank" class="me-2">
+                    <img src="{{ image.image.url }}" alt="image-{{ image.pk }}" style="width:96px;height:auto;object-fit:cover;border-radius:.25rem;" class="img-thumbnail">
+                </a>
+            {% else %}
+                <div class="me-2 bg-secondary" style="width:96px;height:72px;border-radius:.25rem;"></div>
+            {% endif %}
+
+            <div class="flex-grow-1">
+                <div><strong>{{ image.image.name|default:"(no file)" }}</strong></div>
+                {% if image.image %}
+                    <div class="small text-muted">{{ image.image.size|filesizeformat }}</div>
+                {% endif %}
+                {% if image.image_blake3_hash %}
+                    <div class="small text-muted">hash: {{ image.image_blake3_hash|truncatechars:12 }}</div>
+                {% endif %}
+            </div>
+
+            <div class="ms-auto text-end">
+                <a href="{% url 'atlas:series_image_dicom' pk=image.pk %}" class="btn btn-sm btn-outline-secondary">View DICOM</a>
+            </div>
+        </div>
+    {% empty %}
+        <p class="text-muted">No images found for this series.</p>
+    {% endfor %}
+</div>

atlas/templates/atlas/series_viewer.html

@@ -1,7 +1,7 @@
 {% load crispy_forms_tags %}
 {% with image_url_array_and_count=series.get_image_url_array_and_count %}
 
-<div class="container my-4">
+    <div class="container my-4">
         <div class="row">
             <div class="col-12 mb-3">
                 <div class="card shadow-sm">
@@ -49,7 +49,6 @@
                         <div class="ms-auto text-muted small">{{ series.get_image_count }} images</div>
                     </div>
                 </div>
-
                 <div class="mt-3">
                 <!-- Finding form moved below the viewport -->
                     <div class="card mt-3">
@@ -114,6 +113,31 @@
                         </div>
                     </details>
                 </div>
+
+            <!-- Images (loaded on demand via HTMX) -->
+                <div class="card mt-3">
+                    <div class="card-header d-flex justify-content-between align-items-center">
+                        <span>Images</span>
+                        <div>
+                            <button id="load-images-button" class="btn btn-sm btn-outline-primary"
+                                    hx-get="{% url 'atlas:series_images' series.pk %}"
+                                    hx-target="#series-images-container"
+                                    hx-swap="innerHTML"
+                                    hx-trigger="click"
+                                    hx-on="htmx:beforeRequest: document.getElementById('images-loading-indicator').style.display='inline-block'; htmx:afterSwap: document.getElementById('images-loading-indicator').style.display='none'; document.getElementById('load-images-button').disabled = true">
+                                Load images
+                            </button>
+                            <a href="{% url 'atlas:series_download' series.pk %}" class="btn btn-sm btn-outline-success ms-2" target="_blank" rel="noopener">Download</a>
+                            <span id="images-loading-indicator" class="spinner-border spinner-border-sm ms-2" role="status" aria-hidden="true" style="display:none"></span>
+                        </div>
+                    </div>
+                    <div class="card-body">
+                        <div id="series-images-container">
+                            <p class="text-muted small">Click 'Load images' to fetch.</p>
+                        </div>
+                    </div>
+                </div>
+
             </div>
 
             <div class="col-md-4 mb-3">
@@ -190,17 +214,17 @@
                 {% endif %}
             </div>
         </div>
-</div>
+    </div>
 
 
-<div id="clone-findings-modal" class="modal modal-blur fade" tabindex="-1">
+    <div id="clone-findings-modal" class="modal modal-blur fade" tabindex="-1">
         <div class="modal-dialog modal-dialog-centered related-finding-modal" style="max-width: 700px;">
             <div class="modal-content"></div>
         </div>
-</div>
+    </div>
 
 
-<script>
+    <script>
         $(document).ready(function () {
             const apiKey = "root"
 
@@ -331,7 +355,7 @@
                 }
             });
         });
-</script>
+    </script>
 
 {% endwith %}
 
@@ -402,14 +426,14 @@
         transition: background 0.2s, font-size 0.2s;
     }
 
-details.styled-detail:not([open]) {
+    details.styled-detail:not([open]) {
         padding-bottom: 0;
         min-height: 0;
-}
+    }
 
-details.styled-detail:not([open]) > *:not(summary) {
+    details.styled-detail:not([open]) > *:not(summary) {
         display: none;
-}
+    }
 
     details.styled-detail:not([open]) > summary {
         padding: 0.7em 1.2em 0.3em 1.2em;

atlas/urls.py

@@ -112,6 +112,11 @@ urlpatterns = [
         views.CollectionCaseUpdate.as_view(),
         name="collection_case_update",
     ),
+    path(
+        "collection/<int:pk>/case_jump",
+        views.collection_case_jump_partial,
+        name="collection_case_jump_partial",
+    ),
     path(
         "collection/add_cases",
         views.add_cases_to_collection,
@@ -452,6 +457,7 @@ urlpatterns = [
     # TODO: case context series viewing (so that we can view series in the context of a case)
     path("series/<int:pk>", views.series_detail, name="series_detail"),
     path("series/<int:pk>/viewer", views.series_viewer, name="series_viewer"),
+    path("series/<int:pk>/images/", views.series_images_partial, name="series_images"),
     path("series/<int:pk>/authors", views.SeriesAuthorUpdate.as_view(), name="series_authors"),
     path("series/<int:series_id>/finding/related", views.series_finding_related, name="series_finding_related"),
     path("series/", views.SeriesView.as_view(), name="series_view"),

atlas/views.py

@@ -796,6 +796,17 @@ def series_detail(request, pk, finding_pk=None):
     )
 
 
+@login_required
+@user_is_author_or_atlas_series_checker_or_atlas_marker_or_open_access
+def series_images_partial(request, pk):
+    """Return a small fragment that lists images for a series. Intended for HTMX."""
+    series = get_object_or_404(Series, pk=pk)
+    logger.debug(series)
+    images = series.images.filter(removed=False).order_by("pk")
+    logger.debug(images)
+    return render(request, "atlas/partials/series_images.html", {"series": series, "images": images})
+
+
 @login_required
 # @user_is_atlas_editor
 def question_schema_detail(request, pk: int):
@@ -1134,6 +1145,46 @@ def collection_options(request):
     html = render_to_string("atlas/partials/collection_options.html", {"collections": collections}, request=request)
     return HttpResponse(html)
 
+
+@login_required
+def collection_case_jump_partial(request, pk: int):
+    """Return an HTMX partial containing a jump list for cases in the collection.
+
+    Expects optional GET params:
+      - current: the current case index (0-based) to mark active
+      - cid, passcode: optional candidate identifiers so links include them when present
+    """
+    # Allow non-HTMX callers to still get the fragment (useful for testing)
+    collection = get_object_or_404(CaseCollection, pk=pk)
+
+    casedetails = (
+        CaseDetail.objects.filter(collection=collection)
+        .select_related('case')
+        .order_by('sort_order')
+    )
+
+    try:
+        current = int(request.GET.get('current', 0) or 0)
+    except Exception:
+        current = 0
+
+    cid = request.GET.get('cid')
+    passcode = request.GET.get('passcode')
+
+    html = render_to_string(
+        'atlas/partials/_collection_case_jump.html',
+        {
+            'collection': collection,
+            'casedetails': casedetails,
+            'current': current,
+            'cid': cid,
+            'passcode': passcode,
+        },
+        request=request,
+    )
+
+    return HttpResponse(html)
+
 @login_required
 def remove_cases_from_collection(request):
     if not request.htmx:
@@ -3104,6 +3155,9 @@ def collection_case_priors(request, exam_id, case_number):
 
     previous = collection.get_previous_case(casedetail.case)
     next = collection.get_next_case(casedetail.case)
+    # Determine whether the current user can edit this collection/case so
+    # included fragments which rely on `can_edit` have the value available.
+    can_edit = request.user.is_superuser or collection.author.filter(pk=request.user.pk).exists()
 
     return render(
         request,
@@ -3121,20 +3175,19 @@ def collection_case_priors(request, exam_id, case_number):
             "case_number": case_number,
             "added_priors": added_priors,
             "available_priors": available_priors,
+            "can_edit": can_edit,
+            # Provide a default `error` value so `{% if error %}` checks in included
+            # partials won't raise during variable resolution when the key is absent.
+            "error": None,
         },
     )
 
 
 @user_is_collection_author_or_atlas_editor
-def collection_case_questions(request, exam_id, case_id):
-    # Support either case_number (index) or case_id (case PK)
-    try:
-        casedetail = CaseDetail.objects.get(case=case_id, collection=exam_id)
-        collection = casedetail.collection
-    except Exception:
+def collection_case_questions(request, exam_id, case_number):
     collection = get_object_or_404(CaseCollection, pk=exam_id)
     try:
-            case_obj = collection.get_case_by_index(int(case_id))
+        case_obj = collection.get_case_by_index(case_number)
         casedetail = CaseDetail.objects.get(case=case_obj, collection=collection)
     except Exception:
         raise Http404("Case not found in collection")
@@ -3800,6 +3853,10 @@ def collection_case_view_take(
             case _:
                 continue
 
+    # Determine whether any prior series will be shown to the candidate.
+    has_priors = any(prior_flag for (_, prior_flag, _) in series_to_load)
+    prior_count = prior_cases.count()
+
     return render(
         request,
         "atlas/collection_case_view_take.html",
@@ -3810,6 +3867,8 @@ def collection_case_view_take(
             "casedetail": casedetail,
             "series_list": series_list,
             "series_to_load": series_to_load,
+            "has_priors": has_priors,
+            "prior_count": prior_count,
             "case_number": case_number,
             "previous": previous,
             "next": next,

deploy/nginx/dev.conf

@@ -0,0 +1,30 @@
+upstream app_server {
+    server web:8000;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    client_max_body_size 100M;
+
+    location /static/ {
+        alias /usr/src/app/static/;
+        expires 30d;
+        add_header Cache-Control "public, max-age=2592000";
+    }
+
+    location /media {
+        alias /usr/src/app/media;
+    }
+
+    location / {
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+        proxy_redirect off;
+        proxy_buffering off;
+        proxy_pass http://app_server;
+    }
+}

deploy/nginx/prod.conf

@@ -0,0 +1,127 @@
+upstream app_server {
+    # In production we proxy to the 'web' service (gunicorn) listening on 8000
+    server web:8000;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    client_max_body_size 100M;
+
+    # Serve static files from the static volume
+    location /static/ {
+        alias /usr/src/app/static/;
+        expires 30d;
+        add_header Cache-Control "public, max-age=2592000";
+    }
+
+    # Serve media files from the media volume. CORS handling preserved.
+    set $cors "";
+    if ($http_origin ~* (https?://(localhost:5173|viewer\.penracourses\.org\.uk))) {
+        set $cors $http_origin;
+    }
+
+    location /media {
+        if ($request_method = OPTIONS ) {
+            add_header 'Access-Control-Allow-Origin' $cors always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Allow-Headers' "Origin, X-Requested-With, Content-Type, Accept" always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+            add_header 'Access-Control-Max-Age' 1728000;
+            add_header 'Content-Type' 'text/plain; charset=utf-8';
+            add_header 'Content-Length' 0;
+            return 200;
+        }
+        add_header 'Access-Control-Allow-Origin' $cors always;
+        alias /usr/src/app/media;
+    }
+
+    # Viewer / OHIF / other static frontends - mount these into the nginx container at deploy time
+    location /viewer {
+        alias /srv/www/viewer;
+        index index.html;
+        try_files $uri $uri/ /viewer/index.html;
+        add_header Cache-Control "no-store, no-cache, must-revalidate";
+        add_header 'Cross-Origin-Resource-Policy' 'cross-origin';
+    }
+
+    location /ohif {
+        add_header 'Cross-Origin-Opener-Policy' 'same-origin' always;
+        add_header 'Cross-Origin-Embedder-Policy' 'require-corp' always;
+        add_header 'Cross-Origin-Resource-Policy' 'same-site' always;
+        alias /srv/www/ohif;
+        try_files $uri /ohif/index.html;
+    }
+
+    # rts and other host-mounted folders
+    location /rts {
+        alias /srv/www/rts;
+    }
+
+    location /rota {
+        alias /srv/proc/rota;
+        autoindex on;
+    }
+
+    location /uploader {
+        alias /srv/uploader;
+        autoindex on;
+    }
+
+    # Reporter proxy - if you run a reporter service, set it up on the 'reporter' network name
+    location ~ ^/reporter/(.*)$ {
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Authorization $http_authorization;
+        proxy_pass_header Authorization;
+
+        proxy_pass http://reporter:5129/$1?$args;
+        proxy_set_header X-Forwarded-Prefix /reporter;
+        proxy_redirect http://reporter:5129/ /reporter/;
+    }
+
+    # Default proxy to the Django/gunicorn upstream
+    location / {
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+        proxy_redirect off;
+        proxy_buffering off;
+        add_header 'Cross-Origin-Embedder-Policy' 'require-corp' always;
+        add_header 'Cross-Origin-Resource-Policy' 'same-site' always;
+
+        proxy_pass http://app_server;
+    }
+
+    # Default dev / health server block; keep 443 managed outside of docker unless you mount certs
+}
+
+# A minimal HTTPS server block that expects certs to be mounted at /etc/letsencrypt
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name www.penracourses.org.uk penracourses.org.uk viewer.penracourses.org.uk;
+
+    ssl_certificate /etc/letsencrypt/live/www.penracourses.org.uk/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.penracourses.org.uk/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    client_max_body_size 4G;
+
+    # Same static/media handling as above
+    location /static/ { alias /usr/src/app/static/; }
+    location /media { alias /usr/src/app/media; }
+
+    location / {
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+        proxy_redirect off;
+        proxy_buffering off;
+        proxy_pass http://app_server;
+    }
+}

deploy/settings_local.py

@@ -0,0 +1,122 @@
+"""
+Example `settings_local.py` derived from the production server file.
+This file is a template only — DO NOT commit real secrets. Copy it to
+`rad/deploy/settings_local.py` on your server (or provide your own) and
+ensure the real file is excluded from git.
+"""
+import os
+
+DEBUG = True
+
+INTERNAL_IPS = ["82.69.88.125", "217.155.198.96", "localhost", "127.0.0.1"]
+
+# When running in Docker (dev), requests will often come from an internal
+# container/network address. Add any discovered host/container IPs (and a
+# likely gateway address) to INTERNAL_IPS so the debug toolbar can render.
+if DEBUG:
+    try:
+        import socket
+
+        hostname, _, ips = socket.gethostbyname_ex(socket.gethostname())
+        for ip in ips:
+            if ip not in INTERNAL_IPS:
+                INTERNAL_IPS.append(ip)
+            # common docker gateway pattern: replace last octet with '1'
+            parts = ip.split('.')
+            if len(parts) == 4:
+                parts[-1] = '1'
+                gw = '.'.join(parts)
+                if gw not in INTERNAL_IPS:
+                    INTERNAL_IPS.append(gw)
+    except Exception:
+        # best-effort only; don't fail startup if this lookup doesn't work
+        pass
+
+# In local/dev enable the toolbar unconditionally to avoid IP/proxy
+# headaches while developing inside Docker/behind nginx.
+DEBUG_TOOLBAR_CONFIG = {
+    "SHOW_TOOLBAR_CALLBACK": lambda request: True,
+}
+
+# Paths inside the nginx container / host-mounted deploy directories.
+# On the server, these paths are mounted into nginx as described in the
+# deployment README. Adjust as needed.
+STATIC_ROOT = '/usr/src/app/static/'
+
+EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
+
+if not DEBUG:
+    LOGGING = {
+        'version': 1,
+        'disable_existing_loggers': False,
+        'formatters': {
+            'verbose': {
+                'format': "[%(asctime)s] %(levelname)s [%(name)s:%(lineno)s] %(message)s",
+                'datefmt': "%d/%b/%Y %H:%M:%S",
+            },
+            'simple': {
+                'format': '%(levelname)s %(message)s',
+            },
+        },
+        'handlers': {
+            'file': {
+                'level': 'DEBUG',
+                'class': 'logging.FileHandler',
+                'filename': 'log.txt',
+                'formatter': 'verbose',
+            },
+        },
+        'loggers': {
+            'django': {
+                'handlers': ['file'],
+                'propagate': True,
+                'level': 'DEBUG',
+            },
+            'atlas': {
+                'handlers': ['file'],
+                'level': 'DEBUG',
+            },
+        }
+    }
+
+# External service credentials (placeholders)
+CIMAR_USERNAME = "your.username@example.com"
+CIMAR_PASSWORD = "<REPLACE-WITH-SECRET>"
+
+# Celery settings — when running in docker the redis service is
+# reachable at the `redis` hostname provided by docker compose.
+CELERY_BROKER_URL = "redis://redis:6379"
+CELERY_RESULT_BACKEND = "redis://redis:6379"
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.postgresql_psycopg2",
+        "NAME": os.environ.get("DB_NAME", "django"),
+        "USER": os.environ.get("DB_USER", "django"),
+        "PASSWORD": os.environ.get("DB_PASSWORD", "AVNS_NG_s4i7SMMobWLO"),
+        #"HOST": os.environ.get("DB_HOST", "db-postgresql-lon1-05515-do-user-8165014-0.b.db.ondigitalocean.com"),
+        "HOST": os.environ.get("DB_HOST", "db-postgresql-lon1-05515-jan-22-backup-do-user-8165014-0.c.db.ondigitalocean.com"),
+        "PORT": os.environ.get("DB_PORT", "25060"),
+        #"NAME": os.environ.get("DB_NAME", "django"),
+        #"USER": os.environ.get("DB_USER", "django"),
+        #"PASSWORD": os.environ.get("DB_PASSWORD", "f7bf31dc9bda1256ea827953480d1917"),
+        #"HOST": os.environ.get("DB_HOST", "161.35.163.87"),
+        #"PORT": os.environ.get("DB_PORT", "5432"),
+    }
+}
+
+# Development overrides to avoid forcing HTTPS and secure cookies in local dev
+# (production should keep these True).
+SECURE_SSL_REDIRECT = False
+SESSION_COOKIE_SECURE = False
+CSRF_COOKIE_SECURE = False
+SECURE_HSTS_SECONDS = 0
+
+# Allow requests from the local dev nginx/dev server and direct runserver
+# (include scheme+host+port for Django's origin checking).
+CSRF_TRUSTED_ORIGINS = [
+    "http://127.0.0.1:8000",
+    "http://localhost:8000",
+]
+
+REMOTE_URL = "http://127.0.0.1:8000"

deploy/settings_local.py.example

@@ -0,0 +1,60 @@
+"""
+Example `settings_local.py` derived from the production server file.
+This file is a template only — DO NOT commit real secrets. Copy it to
+`rad/deploy/settings_local.py` on your server (or provide your own) and
+ensure the real file is excluded from git.
+"""
+
+DEBUG = False
+
+INTERNAL_IPS = ["82.69.88.125", "217.155.198.96"]
+
+# Paths inside the nginx container / host-mounted deploy directories.
+# On the server, these paths are mounted into nginx as described in the
+# deployment README. Adjust as needed.
+STATIC_ROOT = '/usr/src/app/static/'
+
+EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
+
+if not DEBUG:
+    LOGGING = {
+        'version': 1,
+        'disable_existing_loggers': False,
+        'formatters': {
+            'verbose': {
+                'format': "[%(asctime)s] %(levelname)s [%(name)s:%(lineno)s] %(message)s",
+                'datefmt': "%d/%b/%Y %H:%M:%S",
+            },
+            'simple': {
+                'format': '%(levelname)s %(message)s',
+            },
+        },
+        'handlers': {
+            'file': {
+                'level': 'DEBUG',
+                'class': 'logging.FileHandler',
+                'filename': 'log.txt',
+                'formatter': 'verbose',
+            },
+        },
+        'loggers': {
+            'django': {
+                'handlers': ['file'],
+                'propagate': True,
+                'level': 'DEBUG',
+            },
+            'atlas': {
+                'handlers': ['file'],
+                'level': 'DEBUG',
+            },
+        }
+    }
+
+# External service credentials (placeholders)
+CIMAR_USERNAME = "your.username@example.com"
+CIMAR_PASSWORD = "<REPLACE-WITH-SECRET>"
+
+# Celery settings — when running in docker the redis service is
+# reachable at the `redis` hostname provided by docker compose.
+CELERY_BROKER_URL = "redis://redis:6379"
+CELERY_RESULT_BACKEND = "redis://redis:6379"

docker/docker-compose.dev.yml

@@ -0,0 +1,69 @@
+# Development override: point the web service to rad/.env.dev and map nginx to
+# non-privileged host ports so you can run without sudo.
+
+services:
+  web:
+    env_file:
+      - ../.env.dev
+    # Development: run Django's autoreloading development server instead of
+    # the production entrypoint/gunicorn. Mount the repository into the
+    # container so code edits on the host trigger Django's autoreload.
+    entrypoint: ["python", "manage.py", "runserver", "0.0.0.0:8000"]
+    # Clear any command set by the prod compose file (which would be passed
+    # as an extra argument to manage.py). Setting an empty command prevents
+    # the image `command` from being appended to the entrypoint.
+    command: []
+    volumes:
+      - ../:/usr/src/app:cached
+      # Mount the app log directory so logs are visible on the host at ./logs
+      - ../logs:/var/log/rad
+  nginx:
+    # Development nginx override: mount a simplified config that does not
+    # reference LetsEncrypt certs so the container can start without real
+    # certificates present on the host.
+    image: nginx:1.25-alpine
+    volumes:
+      - ../deploy/nginx/dev.conf:/etc/nginx/conf.d/default.conf:ro
+
+  loki:
+    image: grafana/loki:2.8.2
+    command: -config.file=/etc/loki/local-config.yaml
+    ports:
+      - "3100:3100"
+    volumes:
+      - ./loki-config/local-config.yaml:/etc/loki/local-config.yaml:ro
+      - ./loki-data:/loki
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:3100/ready || exit 1"]
+      interval: 5s
+      timeout: 3s
+      retries: 6
+
+  promtail:
+    image: grafana/promtail:2.8.2
+    volumes:
+      - ../logs:/var/log/rad:ro
+      - ./promtail-config.yml:/etc/promtail/promtail-config.yml:ro
+    command: -config.file=/etc/promtail/promtail-config.yml
+    depends_on:
+      - loki
+    restart: unless-stopped
+
+  grafana:
+    image: grafana/grafana:10.2.0
+    ports:
+      - "3000:3000"
+    environment:
+      - GF_SECURITY_ADMIN_PASSWORD=admin
+    volumes:
+      - grafana-data:/var/lib/grafana
+    depends_on:
+      loki:
+        condition: service_healthy
+    restart: unless-stopped
+
+volumes:
+  grafana-data:
+  loki-data:
+

docker/docker-compose.local.yml

@@ -29,7 +29,7 @@ services:
       - 8000:8000
       - 3459:3459
     env_file:
-      - ./.env.dev
+      - ./.env.dev.local
   db:
     image: postgres:14.2-alpine
     volumes:

docker/docker-compose.prod.yml

@@ -0,0 +1,119 @@
+services:
+  redis:
+    image: redis:7.4.2-alpine
+    restart: always
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD","redis-cli","ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  web:
+    build:
+      # build context is the repository root (one level up from this file)
+      context: ..
+      dockerfile: rad/Dockerfile.prod
+    restart: always
+    # Use COMPOSE_ENV to select which env file to load (defaults to 'prod').
+    # Example: COMPOSE_ENV=dev docker compose -f rad/docker/docker-compose.prod.yml -f rad/docker/docker-compose.dev.yml up -d
+    env_file:
+      - ../.env.${COMPOSE_ENV:-prod}
+    environment:
+      - DJANGO_SETTINGS_MODULE=rad.settings
+    depends_on:
+      redis:
+        condition: service_healthy
+    volumes:
+      - static_volume:/usr/src/app/static
+      - media_volume:/usr/src/app/media
+      # Mount the server-specific local settings if present (DO NOT commit secrets).
+      # On the server create: rad/deploy/settings_local.py and it will be mounted into the container.
+      - ../deploy/settings_local.py:/usr/src/app/rad/settings_local.py:ro
+    expose:
+      - "8000"
+    command: ["/usr/src/app/entrypoint.sh"]
+
+  nginx:
+    image: nginx:stable-alpine
+    restart: always
+    ports:
+      - "${NGINX_HTTP_PORT:-80}:80"
+      - "${NGINX_HTTPS_PORT:-443}:443"
+    depends_on:
+      - web
+    volumes:
+      - ../deploy/nginx/prod.conf:/etc/nginx/conf.d/default.conf:ro
+      - static_volume:/usr/src/app/static:ro
+      - media_volume:/usr/src/app/media:ro
+      - ../deploy/nginx/certs:/etc/letsencrypt:ro
+      # Host-provided front-end bundles and static folders. Populate these under rad/deploy on the server
+      - ../deploy/www/viewer:/srv/www/viewer:ro
+      - ../deploy/www/ohif:/srv/www/ohif:ro
+      - ../deploy/www/rts:/srv/www/rts:ro
+      - ../deploy/nicereporter:/srv/nicereporter:rw
+      - ../deploy/proc-rota:/srv/proc/rota:ro
+      - ../deploy/uploader:/srv/uploader:ro
+    healthcheck:
+      test: ["CMD-SHELL","nginx -t" ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  # Optional local observability stack (can be enabled on servers that
+  # should run Loki/Grafana). These services use configs found under
+  # the repository `docker/` directory so the same config works in dev.
+  loki:
+    image: grafana/loki:2.8.2
+    command: -config.file=/etc/loki/local-config.yaml
+    ports:
+      - "3100:3100"
+    volumes:
+      - ./loki-config/local-config.yaml:/etc/loki/local-config.yaml:ro
+      - ../docker/loki-data:/loki
+      # WAL directory: map a host folder so Loki (running as UID 10001)
+      # can create the write-ahead log. Host folder created under
+      # `docker/loki-wal` and owned by UID 10001.
+      - ../docker/loki-wal:/wal
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:3100/ready || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+
+  promtail:
+    image: grafana/promtail:2.8.2
+    volumes:
+      # In prod you may want to point this at the host system log directory.
+      - ../logs:/var/log/rad:ro
+      - ./promtail-config.yml:/etc/promtail/promtail-config.yml:ro
+    command: -config.file=/etc/promtail/promtail-config.yml
+    depends_on:
+      - loki
+    restart: unless-stopped
+
+  grafana:
+    image: grafana/grafana:10.2.0
+    ports:
+      - "3000:3000"
+    environment:
+      - GF_SECURITY_ADMIN_PASSWORD=admin
+    volumes:
+      - grafana-data:/var/lib/grafana
+    depends_on:
+      loki:
+        condition: service_healthy
+    restart: unless-stopped
+
+volumes:
+  postgres_data:
+  redis_data:
+  static_volume:
+  media_volume:
+  grafana-data:
+
+networks:
+  default:
+    driver: bridge

docker/docker-compose.test.yml

@@ -0,0 +1,26 @@
+version: "3.8"
+
+# Local test compose overlay — adds a Postgres service so you can run the
+# full stack locally without an external DB. Use it together with
+# docker-compose.prod.yml:
+#
+# docker compose -f rad/docker/docker-compose.prod.yml -f rad/docker/docker-compose.test.yml up -d --build
+
+services:
+  db:
+    image: postgres:14-alpine
+    restart: always
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-django}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
+      POSTGRES_DB: ${POSTGRES_DB:-rad}
+    volumes:
+      - postgres_test_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL","pg_isready -U ${POSTGRES_USER:-django}" ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  postgres_test_data:

docker/loki-config/local-config.yaml

@@ -0,0 +1,43 @@
+server:
+  http_listen_port: 3100
+  grpc_listen_port: 9095
+
+ingester:
+  lifecycler:
+    address: 127.0.0.1
+    ring:
+      kvstore:
+        store: inmemory
+      replication_factor: 1
+  chunk_idle_period: 5m
+  chunk_retain_period: 30s
+  max_transfer_retries: 0
+
+schema_config:
+  configs:
+    - from: 2020-10-24
+      store: boltdb-shipper
+      object_store: filesystem
+      schema: v11
+      index:
+        prefix: index_
+        period: 24h
+
+storage_config:
+  boltdb_shipper:
+    active_index_directory: /loki/index
+    cache_location: /loki/cache
+    shared_store: filesystem
+  filesystem:
+    directory: /loki/chunks
+
+# Compactor settings: ensure compactor working directory is inside the mounted
+# `/loki` path so the process (running as UID 10001) can create files.
+compactor:
+  working_directory: /loki/compactor
+  shared_store: filesystem
+
+limits_config:
+  enforce_metric_name: false
+
+auth_enabled: false

docker/loki-data/chunks/loki_cluster_seed.json

@@ -0,0 +1 @@
+{"UID":"f8cade59-3cf9-4ae3-965d-8b0a57007d58","created_at":"2025-12-01T17:14:05.101735276Z","version":{"version":"2.8.2","revision":"9f809eda7","branch":"HEAD","buildUser":"root@e401cfcb874f","buildDate":"2023-05-03T11:07:54Z","goVersion":"go1.20.4"}}

docker/promtail-config.yml

@@ -0,0 +1,18 @@
+server:
+  http_listen_port: 9080
+  grpc_listen_port: 0
+
+positions:
+  filename: /tmp/positions.yaml
+
+clients:
+  - url: http://loki:3100/loki/api/v1/push
+
+scrape_configs:
+  - job_name: rad_app_logs
+    static_configs:
+      - targets:
+          - localhost
+        labels:
+          job: rad_app
+          __path__: /var/log/rad/*.log

entrypoint.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+set -e
+
+# Lightweight wait-for-postgres using nc (expects DATABASE_HOST and DATABASE_PORT env vars)
+if [ -n "${DATABASE_HOST}" ]; then
+  host="$DATABASE_HOST"
+  port="${DATABASE_PORT:-5432}"
+  echo "Waiting for database at ${host}:${port}..."
+  while ! nc -z "$host" "$port"; do
+    sleep 1
+  done
+fi
+
+echo "Applying database migrations..."
+python manage.py migrate --noinput
+
+echo "Collecting static files..."
+python manage.py collectstatic --noinput
+
+echo "Starting gunicorn..."
+exec gunicorn rad.wsgi:application \
+    --name rad_gunicorn \
+    --bind 0.0.0.0:8000 \
+    --workers ${GUNICORN_WORKERS:-3} \
+    --log-level ${GUNICORN_LOGLEVEL:-info}

longs/api.py

@@ -14,19 +14,20 @@ router = Router()
 
 
 class QuestionSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Question
 
-        #model_fields = ["question", "history", "feedback", "normal", "laterality"]
-        model_fields = "__all__"
+        # Use `fields` per newer ninja ModelSchema API
+        #fields = ["question", "history", "feedback", "normal", "laterality"]
+        fields = "__all__"
 
-        #model_exclude = ["answers"]
+        #exclude = ["answers"]
 
 class ExamSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Exam
 
-        model_fields = ["id", "name", "active", "publish_results"]
+        fields = ["id", "name", "active", "publish_results"]
 
 @router.get('/')
 def list_questions(request):

physics/api.py

@@ -15,19 +15,19 @@ router = Router()
 
 
 class QuestionSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Question
 
-        #model_fields = ["question", "history", "feedback", "normal", "laterality"]
-        model_fields = "__all__"
+        # Use `fields` per newer ninja ModelSchema API
+        fields = "__all__"
 
-        #model_exclude = ["answers"]
+        #exclude = ["answers"]
 
 class ExamSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Exam
 
-        model_fields = ["id", "name", "active", "publish_results"]
+        fields = ["id", "name", "active", "publish_results"]
 
 @router.get('/')
 def list_questions(request):

rad.code-workspace

@@ -0,0 +1,15 @@
+{
+	"folders": [
+		{
+			"name": "rad",
+			"path": "."
+		}
+	],
+	"settings": {
+		"python.testing.pytestArgs": [
+			"."
+		],
+		"python.testing.unittestEnabled": false,
+		"python.testing.pytestEnabled": true
+	}
+}

rad/Dockerfile.prod

@@ -0,0 +1,79 @@
+FROM python:3.14-slim
+
+# Copy uv helper binary from the uv image so we can manage venvs and pip
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+
+# Install build deps required for common Python packages and netcat for health wait
+RUN apt-get update \
+     && apt-get install -y --no-install-recommends \
+         build-essential \
+         gcc \
+         git \
+         libpq-dev \
+         pkg-config \
+         libcairo2-dev \
+         # some distributions provide libgdk-pixbuf under the xlib name
+         libgdk-pixbuf-xlib-2.0-0 \
+         libgdk-pixbuf-xlib-2.0-dev \
+         libjpeg-dev \
+         zlib1g-dev \
+         wget \
+         ca-certificates \
+         netcat-openbsd \
+     && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /usr/src/app
+
+# Install python deps into a uv-managed venv for reproducible builds
+COPY requirements.txt /usr/src/app/
+# Prebuild wheels into /wheels so compiled artifacts are cached in a layer.
+# This speeds rebuilds when `requirements.txt` hasn't changed. The first build
+# still needs to compile any packages without prebuilt wheels.
+RUN mkdir -p /wheels \
+    && python -m venv /tmp/venvbuild \
+    && /tmp/venvbuild/bin/pip install --upgrade pip setuptools wheel \
+    && /tmp/venvbuild/bin/pip wheel --wheel-dir=/wheels -r requirements.txt \
+    && rm -rf /tmp/venvbuild
+
+# Create the final uv-managed venv and install from the cached wheels where
+# possible. Using `--no-index --find-links=/wheels` makes pip prefer the
+# prebuilt wheels, avoiding recompilation.
+RUN uv venv /opt/venv \
+    && export VIRTUAL_ENV=/opt/venv \
+    && export PATH="/opt/venv/bin:$PATH" \
+    && uv pip install --upgrade pip setuptools wheel \
+    && uv pip install --no-index --find-links=/wheels -r requirements.txt
+
+# Ensure the runtime environment uses the uv-managed venv by default.
+# This persists the venv into image ENV so `python` and `gunicorn` point
+# to the venv-installed binaries at container start.
+ENV VIRTUAL_ENV=/opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Create non-root user before copying files so we can use Docker's
+# `--chown` flag during COPY and avoid an expensive recursive `chown -R`.
+RUN useradd -m appuser
+
+# Create directory for application logs and ensure ownership is correct.
+# Do this as root before switching to `appuser` so the directory exists
+# and can be mounted by the dev compose override.
+RUN mkdir -p /var/log/rad \
+    && chown -R appuser:appuser /var/log/rad
+
+# Copy project files into image and set ownership during copy (faster than
+# a separate `chown -R` step). This keeps layer reuse efficient.
+COPY --chown=appuser:appuser . /usr/src/app
+
+# Ensure the venv is usable by the non-root user; chown only the venv path
+# (much smaller than the whole project tree) to avoid a long recursive chown.
+RUN chown -R appuser:appuser /opt/venv
+
+# Make the entrypoint executable (some files in the repo may not have the
+# executable bit set). Do this as root before switching to the app user.
+RUN [ -f /usr/src/app/entrypoint.sh ] && chmod +x /usr/src/app/entrypoint.sh || true
+USER appuser
+
+ENTRYPOINT ["/usr/src/app/entrypoint.sh"]

rad/wsgi.py

@@ -10,6 +10,36 @@ https://docs.djangoproject.com/en/1.11/howto/deployment/wsgi/
 import os
 
 from django.core.wsgi import get_wsgi_application
+from loguru import logger
+import sys
+from pathlib import Path
+
+# Configure Loguru sinks early so app imports see consistent logging.
+# Log to stdout (so `docker logs` shows messages) and to a file at
+# `/var/log/rad/app.log` for persistent collection / host tailing.
+try:
+	# ensure directory exists
+	log_dir = Path("/var/log/rad")
+	log_dir.mkdir(parents=True, exist_ok=True)
+	# Add stdout sink (if not already added by other code)
+	logger.remove()  # remove default handlers to avoid duplicate lines
+	logger.add(sys.stdout, level="INFO", enqueue=True, backtrace=False, diagnose=False)
+	# Add rotating file sink for persistence in container. Use JSON lines
+	# (serialize=True) to make logs easy to query in Loki/Grafana.
+	logger.add(
+		str(log_dir / "app.log"),
+		rotation="10 MB",
+		retention="10 days",
+		level="DEBUG",
+		enqueue=True,
+		serialize=True,
+	)
+except Exception:
+	# Best-effort only — don't crash WSGI startup if logging can't be configured
+	try:
+		logger.add(sys.stderr)
+	except Exception:
+		pass
 
 os.environ.setdefault("DJANGO_SETTINGS_MODULE", "rad.settings")
 

rapids/api.py

@@ -15,19 +15,19 @@ router = Router()
 
 
 class RapidSchema(ModelSchema):
-    class Config:
+    # `ninja` newer versions require an inner `Meta` class instead of `Config`
+    # for ModelSchema. Replace `Config` with `Meta` to be compatible.
+    class Meta:
         model = Rapid
-
-        #model_fields = ["question", "history", "feedback", "normal", "laterality"]
-        model_fields = "__all__"
-
-        #model_exclude = ["answers"]
+        #model_fields (old API) -> use `fields` per newer ninja ModelSchema API
+        #fields can be a list of field names or the string "__all__".
+        #fields = ["question", "history", "feedback", "normal", "laterality"]
+        fields = "__all__"
 
 class ExamSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Exam
-
-        model_fields = ["id", "name", "active", "publish_results"]
+        fields = ["id", "name", "active", "publish_results"]
 
 @router.get('/')
 def list_rapids(request):

sbas/api.py

@@ -15,19 +15,18 @@ router = Router()
 
 
 class QuestionSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Question
 
-        #model_fields = ["question", "history", "feedback", "normal", "laterality"]
-        model_fields = "__all__"
+        fields = "__all__"
 
-        #model_exclude = ["answers"]
+        #exclude = ["answers"]
 
 class ExamSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Exam
 
-        model_fields = ["id", "name", "active", "publish_results"]
+        fields = ["id", "name", "active", "publish_results"]
 
 @router.get('/')
 def list_questions(request):

scripts/local-down.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+set -e
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+docker compose -f docker/docker-compose.prod.yml -f docker/docker-compose.test.yml -f docker/docker-compose.dev.yml down --volumes --remove-orphans

scripts/local-up.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+set -e
+
+# Simple local bring-up helper. Usage:
+#   ./rad/scripts/local-up.sh
+# It requires rad/.env.dev to exist (do NOT auto-create from examples) and then
+# runs the prod+dev compose stack using COMPOSE_ENV to select the env file.
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+if [ ! -f .env.dev ]; then
+  echo ".env.dev not found. Create .env.dev with your development values (pointing to the external dev DB) and re-run."
+  echo "You can copy .env.prod.example to start from a template, but DO NOT commit secrets."
+  exit 1
+fi
+
+# Default to 'dev' but allow overriding with COMPOSE_ENV environment variable
+COMPOSE_ENV=${COMPOSE_ENV:-dev}
+
+echo "Starting compose with COMPOSE_ENV=$COMPOSE_ENV (using .env.$COMPOSE_ENV)"
+# Load variables from .env.<env> into the environment so Compose variable
+# substitution (e.g. ${NGINX_HTTP_PORT}) works. We export all variables from
+# the file for the duration of the command.
+ENV_FILE="$REPO_ROOT/.env.$COMPOSE_ENV"
+if [ -f "$ENV_FILE" ]; then
+  # Export variables from the .env file safely without sourcing it. Some
+  # values include characters (parentheses, ampersands) that break POSIX
+  # shell parsing if the file is sourced directly. Read line-by-line,
+  # ignore comments/empty lines and export KEY=VALUE pairs.
+  while IFS= read -r _line || [ -n "$_line" ]; do
+    line="$_line"
+    case "$line" in
+      ''|\#*) continue ;;
+    esac
+    # Split on first '=' into key and value
+    key=${line%%=*}
+    val=${line#*=}
+    # Export directly (preserves special characters in the value)
+    export "$key=$val"
+  done < "$ENV_FILE"
+fi
+
+COMPOSE_ENV=$COMPOSE_ENV docker compose -f docker/docker-compose.prod.yml -f docker/docker-compose.dev.yml up --build

shorts/api.py

@@ -15,19 +15,19 @@ router = Router()
 
 
 class QuestionSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Question
 
-        #model_fields = ["question", "history", "feedback", "normal", "laterality"]
-        model_fields = "__all__"
+        # Use `fields` per newer ninja ModelSchema API
+        fields = "__all__"
 
-        #model_exclude = ["answers"]
+        #exclude = ["answers"]
 
 class ExamSchema(ModelSchema):
-    class Config:
+    class Meta:
         model = Exam
 
-        model_fields = ["id", "name", "active", "publish_results"]
+        fields = ["id", "name", "active", "publish_results"]
 
 @router.get('/')
 def list_questions(request):

temp1/default

@@ -0,0 +1,402 @@
+upstream app_server {
+	server unix:/run/gunicorn.sock fail_timeout=0;
+}
+
+server {
+	#listen 80;
+
+	root /home/ross/web/viewer;
+	#index index.html index.htm;
+
+
+	server_name viewer.penracourses.org.uk;
+
+	location / {
+
+
+		#if ($request_method = 'OPTIONS') {
+		#	add_header 'Access-Control-Allow-Origin' * always;
+		#	add_header 'Access-Control-Allow-Credentials' 'true' always;
+		#	add_header 'Access-Control-Allow-Headers' "Origin, X-Requested-With, Content-Type, Accept" always;
+		#	add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+		#	add_header 'Access-Control-Max-Age' 1728000;
+		#	add_header 'Content-Type' 'text/plain; charset=utf-8';
+		#	add_header 'Content-Length' 0;
+		#	return 204;
+		#}
+
+		#alias /home/ross/web/viewer;
+
+		#add_header Cross-Origin-Opener-Policy same-origin;
+		#add_header Cross-Origin-Embedder-Policy require-corp;
+
+		#add_header 'Cross-Origin-Opener-Policy' 'cross-origin' always;
+		#add_header 'Cross-Origin-Embedder-Policy' 'credentialless' always;
+
+		index index.html;
+
+		try_files $uri $uri/ /index.html;
+		add_header Cache-Control "no-store, no-cache, must-revalidate";
+		add_header 'Cross-Origin-Resource-Policy' 'cross-origin';
+	}
+
+
+
+	listen 443 ssl; # managed by Certbot
+		ssl_certificate /etc/letsencrypt/live/viewer.penracourses.org.uk/fullchain.pem; # managed by Certbot
+		ssl_certificate_key /etc/letsencrypt/live/viewer.penracourses.org.uk/privkey.pem; # managed by Certbot
+		include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+		ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+
+server {
+	listen 80;
+	server_name penracourses.org.uk;
+
+	return 301 https://www.penracourses.org.uk$request_uri;
+}
+
+server {
+	listen [::]:443 ssl; # managed by Certbot
+		server_name penracourses.org.uk;
+	listen 443 ssl; # managed by Certbot
+		ssl_certificate /etc/letsencrypt/live/penracourses.org.uk/fullchain.pem; # managed by Certbot
+		ssl_certificate_key /etc/letsencrypt/live/penracourses.org.uk/privkey.pem; # managed by Certbot
+		include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+		ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+		return 301 https://www.penracourses.org.uk$request_uri;
+}
+
+
+server {
+	#listen 80;
+
+	root /usr/share/nginx/html;
+	index index.html index.htm;
+
+	client_max_body_size 4G;
+	#server_name _;
+	server_name www.penracourses.org.uk;
+	resolver 127.0.0.11;
+
+	keepalive_timeout 20;
+
+	set $cors "";
+if ($http_origin ~* (https?://(localhost:5173|viewer\.penracourses\.org\.uk))) {
+    set $cors $http_origin;
+}
+
+
+	# Your Django project's media files - amend as required
+	location /media  {
+		if ($request_method = OPTIONS ) {
+        add_header 'Access-Control-Allow-Origin' $cors always;
+			#add_header 'Access-Control-Allow-Origin' 'https://viewer.penracourses.org.uk' always;
+			add_header 'Access-Control-Allow-Credentials' 'true' always;
+			add_header 'Access-Control-Allow-Headers' "Origin, X-Requested-With, Content-Type, Accept" always;
+			add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+			add_header 'Access-Control-Max-Age' 1728000;
+			add_header 'Content-Type' 'text/plain; charset=utf-8';
+			add_header 'Content-Length' 0;
+			return 200;
+		}
+		#add_header 'Access-Control-Allow-Origin' 'https://viewer.penracourses.org.uk' always;
+        add_header 'Access-Control-Allow-Origin' $cors always;
+
+
+		alias /home/ross/web/rad/media;
+		#add_header Access-Control-Allow-Origin *;
+		#add_header Access-Control-Allow-Origin http://localhost:8000;
+		#add_header Vary Origin;
+	}
+
+	# your Django project's static files - amend as required
+	location /static {
+		alias /home/ross/web/static;
+	}
+
+	# rts
+	location /rts {
+		alias /home/ross/web/rts;
+	}
+	# OHIF
+	location /viewer {
+		#add_header 'Cross-Origin-Opener-Policy' 'cross-origin' always;
+		#add_header 'Cross-Origin-Embedder-Policy' 'credentialless' always;
+		#add_header 'Cross-Origin-Resource-Policy' 'cross-origin' always;
+		alias /home/ross/web/viewer;
+	}
+	location /ohif {
+		add_header 'Cross-Origin-Opener-Policy' 'same-origin' always;
+		add_header 'Cross-Origin-Embedder-Policy' 'require-corp' always;
+		add_header 'Cross-Origin-Resource-Policy' 'same-site' always;
+		alias /home/ross/web/ohif;
+		try_files $uri /ohif/index.html;
+		#autoindex on;
+	}
+
+
+	# # Proxy the static assests for the Django Admin panel
+	# location /static/admin {
+		#    alias /usr/lib/python3/dist-packages/django/contrib/admin/static/admin/;
+		# }
+	location /rota {
+		alias /home/ross/proc/proc-rota;
+		autoindex on;
+	}
+
+	location /uploader {
+		alias /home/ross/uploader;
+		autoindex on;
+	}
+
+	location ~ ^/reporter/(.*)$ {
+		alias /home/ross/web/nicereporter;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Authorization $http_authorization;
+            proxy_pass_header Authorization;
+
+            proxy_pass http://127.0.0.1:5129/$1?$args;
+            proxy_set_header X-Forwarded-Prefix /reporter;
+            proxy_redirect http://127.0.0.1:5129/ /reporter/;
+        }
+
+	location / {
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header Host $host;
+		proxy_redirect off;
+		proxy_buffering off;
+		#add_header 'Cross-Origin-Opener-Policy' 'single-origin' always;
+		#add_header 'Cross-Origin-Embedder-Policy' 'require-corp' always;
+		#add_header 'Cross-Origin-Resource-Policy' 'same-site' always;
+		#add_header 'Cross-Origin-Opener-Policy' 'same-origin' always;
+		add_header 'Cross-Origin-Embedder-Policy' 'require-corp' always;
+		add_header 'Cross-Origin-Resource-Policy' 'same-site' always;
+		#add_header 'Access-Control-Allow-Origin' $cors always;
+
+		proxy_pass http://app_server;
+		#add_header Access-Control-Allow-Origin *;
+		#add_header Vary Origin;
+	}
+
+	#location ~* \.(jpg|jpeg|png|dicom)$ {
+		#    add_header Access-Control-Allow-Origin *;
+		#}
+	# rota
+
+
+	listen [::]:443 ssl; # managed by Certbot
+		listen 443 ssl; # managed by Certbot
+		ssl_certificate /etc/letsencrypt/live/penracourses.org.uk/fullchain.pem; # managed by Certbot
+		ssl_certificate_key /etc/letsencrypt/live/penracourses.org.uk/privkey.pem; # managed by Certbot
+		include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+		ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+#server {
+#server_name 161.35.163.87;
+#add_header X-Frame-Options "SAMEORIGIN";
+#
+#return 301 $scheme://penracourses.org.uk$request_uri;
+#}
+
+
+#server {
+#    #listen 80;
+#    #server_name penracoureses.org.uk www.penracourses.org.uk;
+#
+#    root /usr/share/nginx/html;
+#    index index.html index.htm;
+#
+#    client_max_body_size 4G;
+#    #server_name _;
+#    server_name penracourses.org.uk; # managed by Certbot
+#
+#    keepalive_timeout 5;
+#
+#    # Your Django project's media files - amend as required
+#    location /media  {
+#        alias /home/ross/web/rad/media;
+#        #add_header Access-Control-Allow-Origin *;
+#        #add_header Access-Control-Allow-Origin http://localhost:8000;
+#	#add_header Vary Origin;
+#    }
+#
+#    # your Django project's static files - amend as required
+#    location /static {
+#        alias /home/ross/web/rad/static;
+#    }
+#
+#    # rts
+#    location /rts {
+#        alias /home/ross/web/rts;
+#    }
+#
+#   # # Proxy the static assests for the Django Admin panel
+#   # location /static/admin {
+#   #    alias /usr/lib/python3/dist-packages/django/contrib/admin/static/admin/;
+#   # }
+#
+#    location / {
+#            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#            proxy_set_header Host $host;
+#            proxy_redirect off;
+#            proxy_buffering off;
+#
+#            proxy_pass http://app_server;
+#    }
+#
+#    #location ~* \.(jpg|jpeg|png|dicom)$ {
+#    #    add_header Access-Control-Allow-Origin *;
+#    #}
+#
+#    # rota
+#    location /rota {
+#        alias /home/ross/proc-rota;
+#    }
+#
+#    location /rota2 {
+#        alias /home/ross/neos;
+#    }
+#
+#
+#
+#
+#
+#    listen [::]:443 ssl ipv6only=on; # managed by Certbot
+#    listen 443 ssl; # managed by Certbot
+#    ssl_certificate /etc/letsencrypt/live/penracourses.org.uk/fullchain.pem; # managed by Certbot
+#    ssl_certificate_key /etc/letsencrypt/live/penracourses.org.uk/privkey.pem; # managed by Certbot
+#    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+#    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+#
+#}
+
+
+
+server {
+	root /home/ross/web/rts;
+	index index.html index.htm;
+
+	client_max_body_size 4G;
+	#server_name _;
+	server_name dev.penracourses.org.uk www.dev.penracourses.org.uk;
+
+	keepalive_timeout 5;
+
+	# Your Django project's media files - amend as required
+	location /media  {
+		# Simple requests
+		if ($request_method ~* "(GET|POST)") {
+			add_header "Access-Control-Allow-Origin"  *;
+		}
+
+		# Preflighted requests
+		if ($request_method = OPTIONS ) {
+			add_header "Access-Control-Allow-Origin"  *;
+			add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS, HEAD";
+			add_header "Access-Control-Allow-Headers" "Authorization, Origin, X-Requested-With, Content-Type, Accept";
+			return 200;
+		}
+		alias /home/ross/web/rad/media;
+		#add_header Access-Control-Allow-Origin *;
+		#add_header Access-Control-Allow-Origin http://localhost:8000;
+		#add_header Vary Origin;
+	}
+
+	# your Django project's static files - amend as required
+	location /static {
+		alias /home/ross/web/rad/static;
+	}
+
+	# rts
+	location /rts {
+		alias /home/ross/web/rts;
+	}
+
+	# # Proxy the static assests for the Django Admin panel
+	# location /static/admin {
+		#    alias /usr/lib/python3/dist-packages/django/contrib/admin/static/admin/;
+		# }
+
+	location / {
+		add_header 'Access-Control-Allow-Origin' '*' always;
+		try_files $uri $uri/ =404;
+		#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		#proxy_set_header X-Forwarded-Proto $scheme;
+		#proxy_set_header Host $host;
+		#proxy_redirect off;
+		#proxy_buffering off;
+
+		#proxy_pass http://app_server;
+		#add_header Access-Control-Allow-Origin *;
+		#add_header Vary Origin;
+	}
+
+	#location ~* \.(jpg|jpeg|png|dicom)$ {
+		#    add_header Access-Control-Allow-Origin *;
+		#}
+
+
+
+
+	#listen [::]:443 ssl; # managed by Certbot
+	#listen 443 ssl; # managed by Certbot
+	#ssl_certificate /etc/letsencrypt/live/penracourses.org.uk/fullchain.pem; # managed by Certbot
+	#ssl_certificate_key /etc/letsencrypt/live/penracourses.org.uk/privkey.pem; # managed by Certbot
+	#include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+	#ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+
+server {
+	if ($host = penracourses.org.uk) {
+		return 301 https://www.$host$request_uri;
+	} # managed by Certbot
+
+
+	listen 80 ;
+	listen [::]:80  ;
+	server_name penracourses.org.uk;
+	return 404; # managed by Certbot
+
+
+}
+
+server {
+	if ($host = www.penracourses.org.uk) {
+		return 301 https://$host$request_uri;
+	} # managed by Certbot
+
+
+	listen 80 default_server;
+	listen [::]:80 default_server ipv6only=on;
+	server_name www.penracourses.org.uk;
+	return 404; # managed by Certbot
+
+
+}
+
+
+
+server {
+	if ($host = viewer.penracourses.org.uk) {
+		return 301 https://$host$request_uri;
+	} # managed by Certbot
+
+
+
+	server_name viewer.penracourses.org.uk;
+	listen 80;
+	return 404; # managed by Certbot
+
+
+}

temp1/settings_local.py

@@ -0,0 +1,54 @@
+DEBUG = False
+INTERNAL_IPS = ["82.69.88.125", "217.155.198.96"]
+#SECURE_SSL_REDIRECT = False
+#SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'http')
+#REMOTE_URL = "http://46.101.13.46:8123"
+#
+#MEDIA_ROOT = '/home/django/rad/media/'
+STATIC_ROOT = '/home/ross/web/static/'
+
+#EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
+EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
+
+if not DEBUG:
+  LOGGING = {
+      'version': 1,
+      'disable_existing_loggers': False,
+      'formatters': {
+          'verbose': {
+              'format' : "[%(asctime)s] %(levelname)s [%(name)s:%(lineno)s] %(message)s",
+              'datefmt' : "%d/%b/%Y %H:%M:%S"
+          },
+          'simple': {
+              'format': '%(levelname)s %(message)s'
+          },
+      },
+      'handlers': {
+          'file': {
+              'level': 'DEBUG',
+              'class': 'logging.FileHandler',
+              'filename': 'log.txt',
+              'formatter': 'verbose'
+          },
+      },
+      'loggers': {
+          'django': {
+              'handlers':['file'],
+              'propagate': True,
+              'level':'DEBUG',
+          },
+          'atlas': {
+              'handlers': ['file'],
+              'level': 'DEBUG',
+          },
+        #"django.core.mail": {"handlers": ["console"], "level": "DEBUG", "propagate": False},
+        #"smtplib": {"handlers": ["console"], "level": "DEBUG", "propagate": False},
+      }
+  }
+
+CIMAR_USERNAME = "ross.kruger@nhs.net"
+CIMAR_PASSWORD = "[prdr32@cimar]"
+
+# Celery settings
+CELERY_BROKER_URL = "redis://localhost:6379"
+CELERY_RESULT_BACKEND = "redis://localhost:6379"