potatolondon / old-djangae-scaffold

Barebones Djangae application for those who want to hit the ground running!

{% if False %}

The Djangae Project Template

This is a barebones Django project template configured for use on App Engine using Djangae

How to use this to create your project

To get started:

• Install any supported Django version ($ pip install Django==1.11)
• Run this command replacing projectname with your desired project name:

$ django-admin.py startproject  --template https://github.com/potatolondon/djangae-scaffold/zipball/master  --extension py,yaml,md  projectname

• Run cd projectname && ./install_deps to install dependencies into a 'sitepackages' folder which is added to the path.
• Run python manage.py check --deploy --settings=projectname.settings_live to run all security checks. Replace projectname with your new app name.
• Run python manage.py runserver

Each time you run the install_deps script helper your sitepackages will be wiped out and reinstalled with pip. The SDK will only be downloaded the first time (as it's a large download).

Deployment

Create a Google App Engine project. Edit app.yaml and change application: djangae-scaffold to application: your-app-id. Then, if you're in the djangae-scaffold directory, run:

$ appcfg.py update ./

If you have two-factor authentication enabled in your Google account, run:

$ appcfg.py --oauth2 update ./

Custom Domains

There is currently a bug in App Engine which means that HSTS headers are stripped from responses served from a custom domain. If you're using HTTPS on a custom domain then you should make a request to Google to get your domain whitelisted for HSTS.

Troubleshooting

If you are on OS X and using Homebrew-ed Python, you might get the following error when running ./install_deps:

error: must supply either home or prefix/exec-prefix -- not both

This is a known issue and a possible workaround is to make an "empty prefix" by default by adding a ~/.pydistutils.cfg file with the following contents:

[install]
prefix=

License

Copyright 2014–2017 Potato London Ltd.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

{% endif %}

{{ project_name }} project

old-djangae-scaffold's Issues

Recommendation for installing PIL

How would one install PIL to be used for development?

requirements.txt

git+https://github.com/potatolondon/djangae.git#egg=djangae
django>=1.7,<1.8
django-secure
django-csp
git+https://github.com/adamalton/django-csp-reports.git#egg=cspreports
django-session-csrf
nose
six

# ---
django-stdimage
django-admin-sortable2
pillow

install deps

sudo ./install_deps

I get the following error when uploading an image.

Neither Pillow nor PIL could be imported: No module named Image

Migrate from django-secure to the same features in Django

As Djangae is now supporting 1.8 and 1.9 only, we can remove django-secure and add relevant checks that are now in Django. Django-secure is not supporting 1.9, so djangae-scaffold breaks when installed with Django 1.9 :(

rename_scaffold_app syntax error on Linux

Had to update the find/sed call to the following on Linux:

find . -path ./sitepackages -prune -o \( -name '*.py' -o -name 'app.yaml' \) -print -exec sed -i "s/scaffold/$1/g" {} +;

Use vendor.add inside fix_path instead of manual sys.path manipulation

Note: Originally posted this on https://github.com/potatolondon/djangae/issues/956

Hey,

I've tried using the new google-cloud-storage libraries with djangae, but they don't work out of the box because they use the new module namespace format (https://www.python.org/dev/peps/pep-0420/).

If the following was used within boot then this would solve this issue going forward.

# appengine_config.py
from google.appengine.ext import vendor

# Add any libraries install in the "lib" folder.
vendor.add(PROD_SITEPACKAGES_DIR)

ImportError: No module named msvcrt

This is a bug that may not be relevant, but I am getting ImportError: No module named msvcrt when running djangae scaffold locally on Windows 10.

I've found this url that seems related, but their solution seems hacky. Maybe someone else has a suggestion of how this is run on Windows? Something that could be added to the docs?

Django 1.9 needed

I tried to use Django 1.8 but got errors

File "djangae-scaffold/apptgae/apptgae/boot.py", line 56, in register_custom_checks
register(checks.check_cached_template_loader_used, Tags.caches, deploy=True)
AttributeError: type object 'Tags' has no attribute 'caches'

Error in csp/utils.py?

Is this me? Or something else?
Platform is Ubuntu 14.04 desktop
Thanks!

TypeError at /
sequence item 0: expected string, proxy found
Request Method: GET
Request URL: http://127.0.0.1:8000/
Django Version: 1.9.8
Exception Type: TypeError
Exception Value:
sequence item 0: expected string, proxy found
Exception Location: /home/username/Documents/Workspace/djangae-scaffold/ParkingBeater/sitepackages/csp/utils.py in build_policy, line 58
Python Executable: /usr/bin/python
Python Version: 2.7.6
Python Path:
['/home/username/Documents/Workspace/djangae-scaffold/ParkingBeater',
'/home/username/Documents/Workspace/djangae-scaffold/ParkingBeater/sitepackages/djangae/lib',
'/home/username/Documents/Workspace/djangae-scaffold/ParkingBeater/sitepackages',
'/home/username/Documents/Workspace/djangae-scaffold/ParkingBeater/sitepackages/google_appengine',
'/home/username/Documents/Workspace/djangae-scaffold/ParkingBeater/sitepackages/google_appengine',
'/usr/lib/python2.7',
'/usr/lib/python2.7/lib-dynload',
'/home/username/Documents/Workspace/djangae-scaffold/ParkingBeater/sitepackages/google_appengine/lib/protorpc-1.0',
'/home/username/Documents/Workspace/djangae-scaffold/ParkingBeater/sitepackages/google_appengine/lib/webapp2-2.3',
'/home/username/Documents/Workspace/djangae-scaffold/ParkingBeater/sitepackages/google_appengine/lib/webob-1.1.1',
'/home/username/Documents/Workspace/djangae-scaffold/ParkingBeater/sitepackages/google_appengine/lib/yaml-3.10']
Server time: Sun, 24 Jul 2016 02:05:57 +0000

`./install_deps` error

Hi,

After clone. start command ./install_deps.

error is

Installing collected packages: djangae, django-secure, django-csp, nose, Django
  Running setup.py install for djangae
    error: must supply either home or prefix/exec-prefix -- not both
    Complete output from command /usr/local/opt/python/bin/python2.7 -c "import setuptools, tokenize;__file__='/private/var/folders/h2/k2mk1nvj2fq7nj78krknwr500000gq/T/pip_build_SUNGJINKANG/djangae/setup.py';exec(compile(getattr(tokenize, 'open', open)(__file__).read().replace('\r\n', '\n'), __file__, 'exec'))" install --record /var/folders/h2/k2mk1nvj2fq7nj78krknwr500000gq/T/pip-HJ65gP-record/install-record.txt --single-version-externally-managed --no-compile --home=/var/folders/h2/k2mk1nvj2fq7nj78krknwr500000gq/T/tmp9oi9jm:
    running install

error: must supply either home or prefix/exec-prefix -- not both

I find solution is.

Add ~/.pydistutils.cfg

[install]
prefix=

Other solution??

Thanks.

/_ah/queue/deferred getting 301 redirect

It seems that the /_ah/queue/deferred URL is returning a 301 redirect. My initial thought was that this is because Django doesn't handle ? in URL regexes as you would expect, and so it redirects /_ah/queue/deferred to /_ah/queue/deferred/.

However (I saw this issue in a workshop with a group of people deploying an app), and after getting them to change that and redeploy it appeared to still have the same issue.

Remove session-csrf

This is now included as part of Django (from 1.10 I think), so we don't need to use the separate repo.

ImportError: No module named mapreduce.mapper_pipeline

Following the install docs, error on step three:

python manage.py checksecure --settings=portal.settings_live

WARNING  2015-07-22 20:48:06,376 simple_search_stub.py:1126] Could not read search indexes from /apps/djangae-scaffold/.storage/search_indexes
INFO     2015-07-22 20:48:06,484 blobstore_service.py:57] Starting blobstore service on localhost:8080
Traceback (most recent call last):
  File "manage.py", line 13, in <module>
    execute_from_command_line(sys.argv)
  File "/apps/djangae-scaffold/sitepackages/djangae/core/management/__init__.py", line 56, in execute_from_command_line
    return _execute_from_command_line(namespace.sandbox, ['manage.py'] + namespace.args, **overrides)
  File "/apps/djangae-scaffold/sitepackages/djangae/core/management/__init__.py", line 36, in _execute_from_command_line
    return django_management.execute_from_command_line(argv)
  File "/apps/djangae-scaffold/sitepackages/django/core/management/__init__.py", line 385, in execute_from_command_line
    utility.execute()
  File "/apps/djangae-scaffold/sitepackages/django/core/management/__init__.py", line 354, in execute
    django.setup()
  File "/apps/djangae-scaffold/sitepackages/django/__init__.py", line 21, in setup
    apps.populate(settings.INSTALLED_APPS)
  File "/apps/djangae-scaffold/sitepackages/django/apps/registry.py", line 108, in populate
    app_config.import_models(all_models)
  File "/apps/djangae-scaffold/sitepackages/django/apps/config.py", line 202, in import_models
    self.models_module = import_module(models_module_name)
  File "/usr/lib64/python2.7/importlib/__init__.py", line 37, in import_module
    __import__(name)
  File "/apps/djangae-scaffold/sitepackages/djangae/contrib/uniquetool/models.py", line 14, in <module>
    from djangae.contrib.mappers.pipes import MapReduceTask, DjangaeMapperPipeline, PIPELINE_BASE_PATH
  File "/apps/djangae-scaffold/sitepackages/djangae/contrib/mappers/pipes.py", line 1, in <module>
    from mapreduce.mapper_pipeline import MapperPipeline
ImportError: No module named mapreduce.mapper_pipeline

Get started instructions don't work on Windows

Instructions say:

• Clone this repo (don't forget to change the origin to your own repo!)
• Run ./install_deps (this will pip install requirements, and download the App Engine SDK)
• Run ./rename_scaffold_app.sh my_new_app_name to rename the 'scaffold' app (and all references to it)
• Run python manage.py checksecure --settings=my_new_app_name.settings_live to run all security checks. Replace my_new_app_name with your new app name.
• python manage.py runserver

Step 2 should say "Run python ./install_deps"
Step 3 - Windows can't run .sh directly. Using Git Bash.vbs runs but generates errors.
Step 4 - there is no manage.py in the base directory. I presume you have to run the one in djangae-scaffold? This fails.
Traceback (most recent call last):
File "manage.py", line 11, in
from djangae.core.management import execute_from_command_line
ImportError: No module named djangae.core.management

Make a Django project template out of djangae-scaffold

This was a conclusion from #26. Relevant docs.

Remove the safe pickle patch

Although it's nice to have a safe pickle, this breaks defer, and we can't have that.

If you are trying to unpickle strings that you haven't pickled yourself then you're doing it wrong. Don't do that. But a whitelist is too strict.

Use SDK from GCloud

It seems that Google are pushing GCloud, rather than the standalone App Engine SDK, so we should probably change Djangae Scaffold to do things that way.

@farridav has tested this and got it to work (see thread) so hopefully it shouldn't be a huge amount of effort.

error python manage.py checksecure --settings=scaffold.settings_live

This is very simple but a bit confusing for beginners like me. I think in the getting started steps, it should be

python manage.py checksecure --settings=scaffold.settings_live

should be

python manage.py checksecure --settings=<my_new_app_name>.settings_live

Use test_execute_from_command_line

The test sandbox should be used when running tests. We need to follow the example in the Djangae docs.

KeyError: 'loaders' when running scaffold based application on GAE

I'm seeing the following error when trying to deploy a djangae-scaffold based application to GAE.

File "/base/data/home/apps/s~APP/20190316t120751.416813848522013508/APP/settings_live.py", line 36, in ('django.template.loaders.cached.Loader', template['OPTIONS']['loaders']) KeyError: 'loaders'

I was able to work around the error by first checking for the presence of the loaders key before doing the reassignment.

has_loaders = template['OPTIONS'].get('loaders', False)
if has_loaders:
    template['OPTIONS']['loaders'] = [
        ('django.template.loaders.cached.Loader', template['OPTIONS']['loaders'])
    ]

I don't think I've done anything that would affect the default behavior, but it's very possible that it's on me. Either way, perhaps the conditional should be included? I'm happy to submit a PR.

How to use @login_required with Gauth?

When I try to add the @login_required decorator to a view, this exception happens:

NoReverseMatch: Reverse for 'djangae_login_redirect' with arguments '()' and keyword arguments '{}' not found. 0 pattern(s) tried: [] 

How do I enable users to log in with their Google accounts?

python manage.py test with database

Hello :)

I'm currently trying to setup djangae and I got some problem with testing.

I setup mysql, manage.py migrate working well. But manage test give that :

django.db.utils.ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'list NULL)' at line 1")

Add a checksecure check for CSP headers

We should add a check which checksecure will run to ensure that a project has got a sensible Content Security Policy setup and is outputting the headers correctly.

Is the HSTS for Custom Domain still a problem?

I saw on the referral link that the HSTS for Custom Domain on App Engine is not a problem anymore.
Does anyone confirm about this?
If there's no more problem then someone should edit and update the README.md

thank you.

Installation error

Running installation $ ./install_deps gives this traceback error:

Installing collected packages: djangae, django, django-secure, django-csp, django-csp-reports, django-session-csrf, nose, six
  Running setup.py install for djangae ... error
    Complete output from command /usr/local/opt/python/bin/python2.7 -u -c "import setuptools, tokenize;__file__='/private/var/folders/lj/4shjyz0s4nd6fjbj6_9p6z4r0000gn/T/pip-build-lSb0po/djangae/setup.py';exec(compile(getattr(tokenize, 'open', open)(__file__).read().replace('\r\n', '\n'), __file__, 'exec'))" install --record /var/folders/lj/4shjyz0s4nd6fjbj6_9p6z4r0000gn/T/pip-bD76sv-record/install-record.txt --single-version-externally-managed --compile --home=/var/folders/lj/4shjyz0s4nd6fjbj6_9p6z4r0000gn/T/tmp3nWd6a:
    running install
    error: must supply either home or prefix/exec-prefix -- not both

    ----------------------------------------
Command "/usr/local/opt/python/bin/python2.7 -u -c "import setuptools, tokenize;__file__='/private/var/folders/lj/4shjyz0s4nd6fjbj6_9p6z4r0000gn/T/pip-build-lSb0po/djangae/setup.py';exec(compile(getattr(tokenize, 'open', open)(__file__).read().replace('\r\n', '\n'), __file__, 'exec'))" install --record /var/folders/lj/4shjyz0s4nd6fjbj6_9p6z4r0000gn/T/pip-bD76sv-record/install-record.txt --single-version-externally-managed --compile --home=/var/folders/lj/4shjyz0s4nd6fjbj6_9p6z4r0000gn/T/tmp3nWd6a" failed with error code 1 in /private/var/folders/lj/4shjyz0s4nd6fjbj6_9p6z4r0000gn/T/pip-build-lSb0po/djangae

Remove SECRET_KEY from settings, or generate it in the datastore

Ronseal

a few improvements

I was looking forward of using this project. Here a few points I had trouble with:

1. executing the rename script: ‘-‘ in the name is not allowed (noone told me)
2. import error when executing: python manage.py checksecure --settings=my_new_app_name.settings_live
   a possible solution which worked for me was:
   http://stackoverflow.com/questions/32761566/django-1-9-importerror-for-import-module
3. after deployment:
   in the django admin, I couldn't access auth->Groups, neither djangae->groups | users. Returning HTTP 500

locally this works fine.
any idea what to do?

Add AMP CDN domain(s) to CSP

As per ampproject/amphtml#1316, when it's done.

Could not import settings 'scaffold.settings_live'

I get the following error, any suggestions how to fix it? Trying to see if im supposed to have the path stored somewhere for the app/settings_live.py but getting nowhere.

ImportError: Could not import settings 'scaffold.settings_live' (Is it on sys.path? Is there an import error in the settings file?): No module named scaffold.settings_live

Add a command to output a map of URLs and their views

This will be useful for reviewing projects, as it will give a summary of all the project's URLs and which views they point to.

It should also include the filename and line number of each view.

Something similar to http://django-extensions.readthedocs.org/en/latest/ but with line numbers.

Google Analytics doesn't load because of image CSP

foobar.p.ota.to/:1 Refused to load the image 'https://www.google-analytics.com/collect?VARS_WERE_HERE' because it violates the following Content Security Policy directive: "img-src 'self' data: s.ytimg.com *.googleusercontent.com *.gstatic.com *.ggpht.com".

I'm not able to run collectstatic command

giving me an error on google.appengine imports.

the project structure is as described in the following image.

[Help] djangae without google authentication?!

I am pretty new to django (and app engine too) and I'ld like to as you for help.

I have my django project running already on openshift but I want to try it on gae too, but with a username/password login (as it is django default) third party logins, I want to add with allauth (or smth similar). What do I have to change in (renamed) scaffold project?

readme file is wrong (at least on Windows)

The line:
Run cd projectname && ./install_deps to install dependencies into a 'sitepackages' folder which is added to the path.
is wrong, at least on Windows. Should be
cd projectname
python ../install_deps

DJANGAE_SIMULATE_CONTENTTYPES isn't enabled by default

Given that scaffold is supposed to be a starting point (and so normally there is no pre-existing data) we should probably enable this setting by default. It makes tests faster, and avoids consistency issues.

ImportError: No module named importlib

When I tried to run python manage.py checksecure --settings=myapp.settings_live I got the following error:

WARNING  2016-03-24 15:37:02,269 simple_search_stub.py:1126] Could not read search indexes from /home/user/projects/myapp/djangae-scaffold/.storage/search_indexes
INFO     2016-03-24 15:37:02,287 blobstore_service.py:73] Starting blobstore service on localhost:8080
WARNING  2016-03-24 15:37:02,287 blobstore_service.py:77] Not starting blobstore service, it may already be running
Traceback (most recent call last):
  File "manage.py", line 13, in <module>
    execute_from_command_line(sys.argv)
  File "/home/user/projects/myapp/djangae-scaffold/sitepackages/djangae/core/management/__init__.py", line 65, in execute_from_command_line
    return _execute_from_command_line(namespace.sandbox, ['manage.py'] + namespace.args, **overrides)
  File "/home/user/projects/myapp/djangae-scaffold/sitepackages/djangae/core/management/__init__.py", line 45, in _execute_from_command_line
    return django_management.execute_from_command_line(argv)
  File "/home/user/projects/myapp/djangae-scaffold/sitepackages/django/core/management/__init__.py", line 353, in execute_from_command_line
    utility.execute()
  File "/home/user/projects/myapp/djangae-scaffold/sitepackages/django/core/management/__init__.py", line 345, in execute
    self.fetch_command(subcommand).run_from_argv(self.argv)
  File "/home/user/projects/myapp/djangae-scaffold/sitepackages/django/core/management/__init__.py", line 195, in fetch_command
    klass = load_command_class(app_name, subcommand)
  File "/home/user/projects/myapp/djangae-scaffold/sitepackages/django/core/management/__init__.py", line 39, in load_command_class
    module = import_module('%s.management.commands.%s' % (app_name, name))
  File "/usr/lib/python2.7/importlib/__init__.py", line 37, in import_module
    __import__(name)
  File "/home/user/projects/myapp/djangae-scaffold/sitepackages/djangosecure/management/commands/checksecure.py", line 6, in <module>
    from ...check import get_check
  File "/home/user/projects/myapp/djangae-scaffold/sitepackages/djangosecure/check/__init__.py", line 1, in <module>
    from .run import get_check, run_checks
  File "/home/user/projects/myapp/djangae-scaffold/sitepackages/djangosecure/check/run.py", line 1, in <module>
    from django.utils.importlib import import_module
ImportError: No module named importlib

Apparently Django 1.9 is not supported?

Add django-csp-reports to the requirements and set it up

See https://github.com/potatolondon/djangae/issues/272 for history.

We need to:

• Add the [django-csp-reports[(https://github.com/adamalton/django-csp-reports) library to the requirements.
• Set up the necessary things in settings.py to make it get used by default.

Dev libs are not added to sys.path for local server

When running the local server with the SDK, libraries in sitepackages/dev aren't importable. After some investigation it turns out that what's happening is this:

In manage.py we call fix_paths(include_dev_libs_path=True), which sets up the local paths so that the GAE SDK, djangae and other packages can be imported.

Then it calls execute_from_command_line(sys.argv) which fires up the runserver command, which fires up the SDK, which then manipulates the paths again.
Then when the first request comes in, the dev server routes it through wsgi.py, which calls fix_paths() again, but this time it doesn't pass include_dev_libs_path=True (which defaults to False).

So the result is that the paths are now not set up correctly, and so the packages in sitepackages/dev are not importable.

In tests, there's no dev server, and so the SDK doesn't manipulate the paths after the call to fix_paths in manage.py, so it's all fine. And hence all the packages in sitepackages/dev are importable in tests, just not when running the local server.

ImportError: No module named wrapper_util

while running the command
"python manage.py runserver" the following error is raised.

ImportError: No module named wrapper_util

Convert project to use `gcloud app deploy` instead of `appcfg.py`

As per Djangae Issue 966 we should be using gcloud app deploy instead of appcfg.py for all deployment activities. This involves updating app.yaml to remove deprecated options.

djangosecure.check.csrf.check_csrf_middleware FAIL after commit 40d625ac

Commit 40d625c removes django.middleware.csrf.CsrfViewMiddleware from settings.py and adds session_csrf.CsrfMiddleware instead.

As a result python manage.py checksecure --settings=scaffold.settings_live fails on the djangosecure.check.csrf.check_csrf_middleware check.

Here's the output:

Running djangosecure.check.csrf.check_csrf_middleware...
FAIL

You don't appear to be using Django's built-in cross-site request
forgery protection via the middleware
('django.middleware.csrf.CsrfViewMiddleware' is not in your
MIDDLEWARE_CLASSES). Enabling the middleware is the safest approach to
ensure you don't leave any holes; see
https://docs.djangoproject.com/en/dev/ref/contrib/csrf/.

why not use latest version of django ?

This script shows pip should not download django version 1.10 or greater. Why?

https://github.com/potatolondon/djangae-scaffold/blob/master/requirements/prod.txt#L2

Admin Static files not serving

The path here is now wrong, since introducing the separation of split dev/prod vendor libs here.

I was going to put up a PR for fixing that to use the prod path, then I thought about removing it, so that I can use my:

if settings.DEBUG:
    urlpatterns += static(settings.STATIC_URL, view=serve, show_indexes=True)

in development, but then I started questioning how static files are served in production? Normally you would put a route in your app.yaml that bypasses django like here

But that's not done here at all, so my question/Issue is.. what's the best practice for static file serving in Djangae? Once i know this, I'm happy to make a pull request..

I can make a static entry in app.yaml and run collectstatic in development, although id rather use the staticfiles finder and django.contrib.staticfiles.view.static .. but obviously not in production..

Keen to get some feedback on this

Add a cron job to clear old session data

When ticket #549 in Djangae is done we should add a cron job into the scaffold set up to regularly call that view.

Problem running the example

When I am executing

python manage.py checksecure --settings=scaffold.settings_live

I get an error. Here the full stacktrace:

INFO     2015-12-10 16:40:53,200 blobstore_service.py:70] Starting blobstore service on localhost:8080
    Traceback (most recent call last):
    File "manage.py", line 13, in <module>
execute_from_command_line(sys.argv)
    File "/Users/a.tietz/djangogae/djangae-scaffold/sitepackages/djangae/core/management/__init__.py", line 65, in execute_from_command_line
    return _execute_from_command_line(namespace.sandbox, ['manage.py'] + namespace.args, **overrides)
    File "/Users/a.tietz/djangogae/djangae-scaffold/sitepackages/djangae/core/management/__init__.py", line 45, in _execute_from_command_line
    return django_management.execute_from_command_line(argv)
    File "/Users/a.tietz/djangogae/djangae-scaffold/sitepackages/django/core/management/__init__.py", line 354, in execute_from_command_line
    utility.execute()
    File "/Users/a.tietz/djangogae/djangae-scaffold/sitepackages/django/core/management/__init__.py", line 303, in execute
    settings.INSTALLED_APPS
    File "/Users/a.tietz/djangogae/djangae-scaffold/sitepackages/django/conf/__init__.py", line 48, in __getattr__
    self._setup(name)
    File "/Users/a.tietz/djangogae/djangae-scaffold/sitepackages/django/conf/__init__.py", line 44, in _setup
    self._wrapped = Settings(settings_module)
    File "/Users/a.tietz/djangogae/djangae-scaffold/sitepackages/django/conf/__init__.py", line 92, in __init__
    mod = importlib.import_module(self.SETTINGS_MODULE)
    File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/importlib/__init__.py", line 37, in import_module
    __import__(name)
    ImportError: No module named scaffold.settings_live

Any clue what I do wrong there?

It's running on Django 1.8.7 everything else comes with your project (thx btw for this!)

Add a better default CSP set up

Having 'self' as the default-src for CSP is secure, but it might just provoke people into "my site doesn't work, I'll just turn off this CSP thing".

So we should consider having a slightly better default set up, which will not only allow common things (e.g. Google Fonts), but will also be a good example/starting point which people can work from (rather than having to go and read the django-csp documentation to find out what the available settings are.

Possibly it could just be added in a commented block, as an example set up.

Most of the things in gae-secure-scaffold-python are probably generally useful.

Duplicate X-Frame-Options middleware?

Djangae-scaffold incorporates both:
'django.middleware.clickjacking.XFrameOptionsMiddleware',
and
'djangosecure.middleware.SecurityMiddleware',

Are both of these necessary?

http://django-secure.readthedocs.org/en/v0.1.2/middleware.html implies that it's not.