Weblate website

Website and supporting services for Weblate, built with Django.

Part of Weblate --- a privacy-respecting localization platform built on open-source foundations.

Weblate

Find Weblate at https://github.com/WeblateOrg/weblate.

Running locally

Create a virtual environment and install dependencies:

uv sync --dev
source .venv/bin/activate

Create weblate_web/settings_local.py to adjust your settings:

# Use local password login instead of Hosted Weblate OIDC
LOGIN_URL = "/admin/login/"

# Required signing key shared with the hosted infrastructure
PAYMENT_SECRET = os.environ["PAYMENT_SECRET"]

# You can also configure API keys and other things, see weblate_web/settings.py

# Do not send real e-mails, log them to the console
EMAIL_BACKEND = "django.core.mail.backends.console.EmailBackend"

Create admin:

./manage.py createsuperuser --username admin --email [email protected]

Migrate the database:

./manage.py migrate

Import subscription packages to the database:

./manage.py sync_packages

Compile MO files so that translations can be used:

./manage.py compilemessages

Run the development server:

./manage.py runserver

Hosted Weblate OIDC login ------------------------

The website and admin use Hosted Weblate OIDC for authentication. The /oidc/ page automatically starts authentication using a CSRF-protected POST. It displays a sign-in button as a fallback when JavaScript is unavailable or forwarding does not complete. The development override LOGIN_URL = "/admin/login/" keeps Django\'s local password login available.

Install the released python-social-auth dependencies from the committed lockfile and run the OIDC integration tests:

uv sync --dev
uv run pytest weblate_web/test_oidc.py

Both staging and production websites authenticate against Hosted Weblate. Keep the committed SOCIAL_AUTH_WEBLATE_OIDC_ENDPOINT and HOSTED_IDENTITY_PROVIDER defaults. OIDC sub and account-sync external_id contain the same Hosted Weblate user primary key. The identity provider value https://hosted.weblate.org/idp/metadata is the stable namespace stored in existing identity records and sync payloads; it does not enable SAML or fetch its metadata.

On Hosted Weblate, enable the provider as described in Weblate\'s OIDC provider documentation and register separate confidential clients for the staging and production websites. Use authorization code flow and RSA with SHA-256. Register each website\'s exact HTTPS callback URL ending in /oidc/complete/weblate/; the production callback is https://weblate.org/oidc/complete/weblate/. The Weblate social-auth backend enables S256 PKCE and requests the scopes openid profile email.

Configure credentials in settings_local.py without committing secrets:

SOCIAL_AUTH_WEBLATE_KEY = os.environ["WEBLATE_OIDC_CLIENT_ID"]
SOCIAL_AUTH_WEBLATE_SECRET = os.environ["WEBLATE_OIDC_CLIENT_SECRET"]

Stop the old application processes, run uv run ./manage.py migrate, and then start the updated application. The migration renames SamlIdentity to HostedIdentity while preserving identity records, user associations, and permissions. Each first successful OIDC login adds a social-auth association to the same local user. New OIDC users receive both identity records atomically. Email addresses and usernames never establish account associations. A conflict rejects login without reassigning either identity.

The hosted account-sync payload already uses this stable identity, so push updates, sync_hosted_users, and CRM account linking retain their existing format. OIDC users remain available to all three paths. No identity backfill or cleanup of legacy unlinked accounts is needed for the switch.

Existing OIDC and local login sessions continue working. Existing SAML sessions require one OIDC sign-in after the switch. The local user ID, customer ownership, and permissions remain unchanged. Verify these after deployment and after hosted username/email changes and account synchronization. Also check new-user login, inactive users, logout, automatic forwarding, and the manual fallback. Investigate association conflicts rather than deleting or reassigning identities.