feat(api): set User.limit_domains to zero by default

api/api/settings.py

@@ -217,11 +217,16 @@
 MINIMUM_TTL_DEFAULT = int(os.environ["DESECSTACK_MINIMUM_TTL_DEFAULT"])
 MAXIMUM_TTL = 86400
 AUTH_USER_MODEL = "desecapi.User"
-LIMIT_USER_DOMAIN_COUNT_DEFAULT = 15
+LIMIT_USER_DOMAIN_COUNT_DEFAULT = int(
+    os.environ.get("DESECSTACK_API_LIMIT_USER_DOMAIN_COUNT_DEFAULT", "1")
+)
 USER_ACTIVATION_REQUIRED = True
 VALIDITY_PERIOD_VERIFICATION_SIGNATURE = timedelta(
     hours=int(os.environ.get("DESECSTACK_API_AUTHACTION_VALIDITY", "0"))
 )
+REGISTER_LPS_ON_SIGNUP = bool(
+    int(os.environ.get("DESECSTACK_API_REGISTER_LPS_ON_SIGNUP", "1"))
+)
 
 # CAPTCHA
 CAPTCHA_VALIDITY_PERIOD = timedelta(hours=24)

api/api/settings_quick_test.py

@@ -36,4 +36,6 @@
 # Carry email backend connection over to test mail outbox
 CELERY_EMAIL_MESSAGE_EXTRA_ATTRIBUTES = ["connection"]
 
+LIMIT_USER_DOMAIN_COUNT_DEFAULT = 15
+
 PCH_API = "http://api.invalid"

api/desecapi/management/commands/limit.py

@@ -1,9 +1,6 @@
 from django.core.management import BaseCommand, CommandError
-from django.db.models import Q
 
-from api import settings
-from desecapi.models import RRset, Domain, User
-from desecapi.pdns_change_tracker import PDNSChangeTracker
+from desecapi.models import Domain, User
 
 
 class Command(BaseCommand):

api/desecapi/management/commands/stop-abuse.py

@@ -1,8 +1,8 @@
 import dns.resolver
+from django.conf import settings
 from django.core.management import BaseCommand
 from django.db.models import Q
 
-from api import settings
 from desecapi.models import BlockedSubnet, Domain, RR, RRset, User
 from desecapi.pdns_change_tracker import PDNSChangeTracker
 

api/desecapi/serializers/authenticated_actions.py

@@ -2,11 +2,11 @@
 import json
 from datetime import timedelta
 
+from django.conf import settings
 from rest_framework import fields, serializers
 from rest_framework.settings import api_settings
 from rest_framework.validators import UniqueValidator, qs_filter
 
-from api import settings
 from desecapi import crypto, models
 
 from .captcha import CaptchaSolutionSerializer

api/desecapi/serializers/captcha.py

@@ -2,9 +2,9 @@
 
 from captcha.audio import AudioCaptcha
 from captcha.image import ImageCaptcha
+from django.conf import settings
 from rest_framework import serializers
 
-from api import settings
 from desecapi.models import Captcha
 
 

api/desecapi/serializers/domains.py

@@ -1,8 +1,8 @@
 import dns.name
 import dns.zone
+from django.conf import settings
 from rest_framework import serializers
 
-from api import settings
 from desecapi.models import Domain, RR_SET_TYPES_AUTOMATIC
 from desecapi.validators import ReadOnlyOnUpdateValidator
 

api/desecapi/serializers/records.py

@@ -3,6 +3,7 @@
 import django.core.exceptions
 import dns.name
 import dns.zone
+from django.conf import settings
 from django.core.validators import MinValueValidator
 from django.db.models import F, Q
 from django.utils import timezone
@@ -11,7 +12,6 @@
 from rest_framework.settings import api_settings
 from rest_framework.validators import UniqueTogetherValidator
 
-from api import settings
 from desecapi import metrics, models, validators
 
 

api/desecapi/serializers/users.py

@@ -1,3 +1,4 @@
+from django.conf import settings
 from django.contrib.auth.password_validation import validate_password
 from rest_framework import serializers
 
@@ -83,6 +84,13 @@ def validate_domain(self, value):
                 serializer.default_error_messages["name_unavailable"],
                 code="name_unavailable",
             )
+        if (
+            not settings.REGISTER_LPS_ON_SIGNUP
+            and DomainSerializer.Meta.model(name=value).is_locally_registrable
+        ):
+            raise serializers.ValidationError(
+                "Registration during sign-up disabled; please create account without a domain name.",
+            )
         return value
 
     def create(self, validated_data):

api/desecapi/tests/test_captcha.py

@@ -3,13 +3,13 @@
 from unittest import mock
 
 from PIL import Image
+from django.conf import settings
 from django.test import TestCase
 from django.utils import timezone
 from rest_framework import status
 from rest_framework.reverse import reverse
 from rest_framework.test import APIClient
 
-from api import settings
 from desecapi.models import Captcha
 from desecapi.serializers import CaptchaSolutionSerializer
 from desecapi.tests.base import DesecTestCase

api/desecapi/tests/test_stop_abuse.py

@@ -1,6 +1,6 @@
+from django.conf import settings
 from django.core import management
 
-from api import settings
 from desecapi import models
 from desecapi.tests.base import DomainOwnerTestCase
 

api/desecapi/tests/test_user_management.py

@@ -21,6 +21,7 @@
 from urllib.parse import urlparse
 
 from django.contrib.auth.hashers import is_password_usable
+from django.conf import settings
 from django.core import mail
 from django.core.management import call_command
 from django.urls import resolve
@@ -29,7 +30,6 @@
 from rest_framework.reverse import reverse
 from rest_framework.test import APIClient
 
-from api import settings
 from desecapi.models import Domain, User, Captcha
 from desecapi.tests.base import (
     DesecTestCase,

api/requirements.txt

@@ -1,8 +1,8 @@
 captcha~=0.5.0
 celery~=5.3.6
-coverage~=7.3.2
+coverage~=7.4.0
 cryptography~=41.0.7
-Django~=5.0.0
+Django~=5.0.1
 django-cors-headers~=4.3.1
 djangorestframework~=3.14.0
 django-celery-email~=3.0.0
@@ -12,7 +12,7 @@ django-prometheus~=2.3.1
 dnspython~=2.4.2
 httpretty~=1.0.5  # 1.1 breaks tests. Does not run in production, so stick to it.
 pyotp~=2.9.0
-psycopg~=3.1.14
+psycopg~=3.1.17
 psl-dns~=1.1.0
 pylibmc~=1.6.3
 pyyaml~=6.0.1

www/webapp/src/views/HomePage.vue

@@ -487,6 +487,14 @@ export default {
             "have not expired in the meantime are now working when opened. Direct login to the web interface and " +
             "deSEC DNS operations were not affected.",
       },
+      {
+        id: 'news-20231226001',
+        start: new Date(Date.UTC(2023, 12 - 1, 26)),  // first day of showing
+        end: new Date(Date.UTC(2024, 1 - 1, 8)),  // first day of not showing
+        icon: 'mdi-heart-broken',
+        teaser: "Due to a recent spike in abusive domain registrations, new accounts need manual verification before " +
+            "domains can be created. Please contact support explaining your use case to enable domain creation.",
+      },
     ],
   })
 }

www/webapp/src/views/PrivacyPolicy.vue

@@ -5,6 +5,10 @@
         <v-row class="pt-8">
           <v-col class="text-center">
             <h1>Privacy Policy</h1>
+            <p>
+              This privacy policy applies to web content at desec.io. Our forum has a
+              <a href="https://talk.desec.io/privacy">separate privacy policy</a>.
+            </p>
           </v-col>
         </v-row>
         <v-row class="pb-8">