43 lines
1.7 KiB
Python
43 lines
1.7 KiB
Python
|
"""
|
||
|
|
Production settings.
|
||
|
|
|
||
|
|
Everything that can be hardened is hardened here; the module intentionally
|
||
|
|
fails loudly on start-up when a required secret is missing rather than falling
|
||
|
|
back to an insecure default.
|
||
|
|
"""
|
||
|
|
|
||
|
|
from .base import * # noqa: F403
|
||
|
|
from .base import DEBUG, SECRET_KEY, env
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Fail fast on unsafe configuration
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
if DEBUG: # pragma: no cover - configuration guard
|
||
|
|
raise RuntimeError("DJANGO_DEBUG must be false when using production settings.")
|
||
|
|
|
||
|
|
if len(SECRET_KEY) < 50: # pragma: no cover - configuration guard
|
||
|
|
raise RuntimeError("DJANGO_SECRET_KEY must be at least 50 characters in production.")
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Transport security
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
SECURE_SSL_REDIRECT = env.bool("SECURE_SSL_REDIRECT", default=True)
|
||
|
|
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
|
||
|
|
SECURE_HSTS_SECONDS = 31_536_000 # one year
|
||
|
|
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
|
||
|
|
SECURE_HSTS_PRELOAD = True
|
||
|
|
|
||
|
|
SESSION_COOKIE_SECURE = True
|
||
|
|
CSRF_COOKIE_SECURE = True
|
||
|
|
SESSION_COOKIE_SAMESITE = "Strict"
|
||
|
|
CSRF_COOKIE_SAMESITE = "Strict"
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Misc hardening
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Admin lives behind an unguessable prefix so credential stuffing bots miss it.
|
||
|
|
ADMIN_URL = env("DJANGO_ADMIN_URL", default="admin/")
|
||
|
|
|
||
|
|
# Deny by default; CORS_ALLOWED_ORIGINS must be set explicitly.
|
||
|
|
CORS_ALLOW_ALL_ORIGINS = False
|