Configure frontend for Vercel deployment and backend for Hugging Face Spaces Docker

Dockerfile

@@ -0,0 +1,39 @@
+# Use python 3.11 slim image
+FROM python:3.11-slim
+
+# Set environment variables
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+ENV PORT=7860
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    libpq-dev \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create user with UID 1000 to match Hugging Face Spaces expectation
+RUN useradd -m -u 1000 user
+USER user
+ENV HOME=/home/user
+ENV PATH=/home/user/.local/bin:$PATH
+
+# Set working directory inside user's home
+WORKDIR $HOME/app
+
+# Copy requirements.txt and install dependencies
+COPY --chown=user requirements.txt .
+RUN pip install --no-cache-dir --user -r requirements.txt
+
+# Copy application files
+COPY --chown=user . .
+
+# Ensure start.sh has execute permissions
+RUN chmod +x start.sh
+
+# Expose port 7860
+EXPOSE 7860
+
+# Run start.sh to run migrations and launch gunicorn
+CMD ["./start.sh"]

aureon_backend/settings.py

@@ -122,9 +122,15 @@ CORS_ALLOW_METHODS = [
 ]
 
 # CSRF Settings
-CSRF_TRUSTED_ORIGINS = ['http://localhost:5173', 'http://127.0.0.1:5173']
-CSRF_COOKIE_SECURE = False
-CSRF_COOKIE_HTTPONLY = False
+CSRF_TRUSTED_ORIGINS = [
+    origin.strip() for origin in os.getenv(
+        'CSRF_TRUSTED_ORIGINS', 
+        'http://localhost:5173,http://127.0.0.1:5173'
+    ).split(',')
+    if origin.strip()
+]
+CSRF_COOKIE_SECURE = not DEBUG
+CSRF_COOKIE_HTTPONLY = True
 
 # Cache Configuration (required for JWKS key caching)
 CACHES = {

requirements.txt

@@ -1,3 +1,51 @@
-PyJWT[crypto]>=2.8.0
-requests>=2.31.0
-cryptography>=41.0.0
+aiohappyeyeballs==2.6.1
+aiohttp==3.13.3
+aiohttp-retry==2.9.1
+aiosignal==1.4.0
+annotated-types==0.7.0
+anyio==4.12.1
+asgiref==3.11.1
+attrs==25.4.0
+certifi==2026.1.4
+cffi==2.0.0
+charset-normalizer==3.4.4
+cryptography==46.0.5
+dataclasses==0.6
+dj-database-url==3.1.0
+Django==6.0.2
+django-cors-headers==4.9.0
+django-sendgrid-v5==1.3.1
+djangorestframework==3.16.1
+djongo==1.2.31
+dnspython==2.8.0
+frozenlist==1.8.0
+gotrue==2.12.4
+h11==0.16.0
+h2==4.3.0
+hpack==4.1.0
+httpcore==1.0.9
+httpx==0.28.1
+hyperframe==6.1.0
+idna==3.11
+MarkupSafe==3.0.3
+multidict==6.7.1
+propcache==0.4.1
+psycopg2-binary==2.9.11
+pycparser==3.0
+pydantic==2.12.5
+pydantic_core==2.41.5
+PyJWT==2.11.0
+pymongo==4.16.0
+pypdf==6.11.0
+python-dotenv==1.2.1
+python-http-client==3.3.7
+requests==2.32.5
+sendgrid==6.12.5
+sqlparse==0.5.5
+twilio==9.10.1
+typing-inspection==0.4.2
+typing_extensions==4.15.0
+urllib3==2.6.3
+Werkzeug==3.1.5
+yarl==1.22.0
+gunicorn==21.2.0

start.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Exit on error except for migrations
+set -e
+
+echo "Starting backend setup..."
+
+# Run database migrations
+if [ -n "$DATABASE_URL" ]; then
+    echo "DATABASE_URL is set, running migrations..."
+    python manage.py migrate --noinput || echo "Migration command failed, starting server anyway..."
+else
+    echo "DATABASE_URL is not set, skipping migrations..."
+fi
+
+# Start Gunicorn
+echo "Starting Gunicorn..."
+exec gunicorn --bind 0.0.0.0:7860 --workers 4 --timeout 120 aureon_backend.wsgi:application