JakeBreath
16907c39ca
- django-cors-headers with env-driven CORS_ALLOWED_ORIGINS, CORS_ALLOW_ALL_ORIGINS, CORS_ALLOW_CREDENTIALS and CSRF_TRUSTED_ORIGINS; same-origin traffic is unaffected and a disallowed origin gets no CORS headers. Token auth needs no cookies, so credentials stay off by default. - TRUST_PROXY_HEADERS=true lets a TLS-terminating proxy supply X-Forwarded-Proto/Host for correct absolute URLs. - API media URLs (raw/thumbnail/upload/similarity/staged previews) are now absolute, built from the request host, so <img>/<video>/fetch() keep working when the SPA is served from another origin. Signed URLs are still per-user; nothing is stored in the DB. - The SPA gains VITE_API_BASE (build-time, empty = same-origin) applied by a small apiUrl() helper used for XHR/fetch and the few URL fallbacks. Verified with a throwaway instance: preflight and GET responses carry the allowed origin, foreign origins get nothing, media GETs include CORS for cross-origin fetch(), and payload URLs use the request host (dev :8000 unchanged).
J621
Self-hosted media library and e621 archive manager, rebuilt as a React SPA + Django REST API.
Structure
backend/ Django 6 + DRF API (SQLite in dev, MariaDB in production)
frontend/ Vite + React + TypeScript SPA
Development
Backend
cd backend
source venv/bin/activate
python manage.py migrate
python manage.py scan_files # index the watched folder
python manage.py runserver
Copy .env.example to .env and set WATCHED_FOLDER before scanning.
Frontend
cd frontend
npm install
npm run dev # http://localhost:5173, proxies /api to :8000
Production
Not wired up yet — planned: Nginx serving the SPA build, /media and /library media
directly, and proxying /api to Waitress/Django. See frontend/ design docs for the UI
specification.
Licence
Source-available, non-commercial: personal and other non-commercial use is welcome under the Jake Labs Non-Commercial Software Licence, which requires attribution and keeps derivative works under the same licence. Commercial use is not permitted. Third-party dependencies keep their own licences (all permissive: MIT, BSD, Apache-2.0, ISC).