Django: Managing Settings Files

Managing settings files in Django is critical for organizing configuration across different environments (e.g., development, testing, production) and ensuring security, scalability, and maintainability. Django’s settings module, typically settings.py, centralizes configuration, but splitting it into multiple files or using environment-specific settings enhances flexibility. This tutorial explores Django settings file management, covering best practices, modular setups, and practical applications.

---

01. Why Manage Settings Files?

Properly managed settings files allow developers to tailor configurations for different environments, secure sensitive data (e.g., API keys), and simplify maintenance. A single settings.py file can become unwieldy for large projects, making modular or environment-specific settings essential for applications like e-commerce platforms, APIs, or SPAs.

Example: Basic Settings Split

# myproject/settings/base.py
INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'myapp',
]

# myproject/settings/dev.py
from .base import *

DEBUG = True
DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': BASE_DIR / 'db.sqlite3',
    }
}

Output:

Django uses dev.py for development with SQLite

Explanation:

• base.py - Shared settings across environments.
• dev.py - Environment-specific settings for development.

---

02. Core Concepts for Managing Settings

Django’s settings module is a Python file (or module) that defines configuration variables like INSTALLED_APPS, DATABASES, and SECRET_KEY. Modularizing settings improves organization and security. Below is a summary of key concepts and their roles:

Concept	Description	Use Case
Base Settings	Shared configuration	Common apps, middleware
Environment Settings	Environment-specific configs	Dev, prod, testing databases
Environment Variables	Secure sensitive data	API keys, passwords
Settings Inheritance	Extend base settings	Reduce duplication

2.1 Modular Settings Structure

Example: Modular Settings Setup

# Project structure
myproject/
├── myproject/
│   ├── settings/
│   │   ├── __init__.py
│   │   ├── base.py
│   │   ├── dev.py
│   │   ├── prod.py
│   ├── __init__.py
│   ├── urls.py
│   ├── wsgi.py
├── myapp/
├── manage.py

# myproject/settings/base.py
from pathlib import Path

BASE_DIR = Path(__file__).resolve().parent.parent.parent

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'rest_framework',
    'corsheaders',
    'myapp',
]

MIDDLEWARE = [
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [BASE_DIR / 'templates'],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
            ],
        },
    },
]

STATIC_URL = '/static/'
STATIC_ROOT = BASE_DIR / 'static'

# myproject/settings/dev.py
from .base import *

DEBUG = True

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': BASE_DIR / 'db.sqlite3',
    }
}

CORS_ALLOWED_ORIGINS = [
    'http://localhost:3000',
]

# myproject/settings/prod.py
from .base import *
import os

DEBUG = False

SECRET_KEY = os.getenv('DJANGO_SECRET_KEY')

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': os.getenv('DB_NAME'),
        'USER': os.getenv('DB_USER'),
        'PASSWORD': os.getenv('DB_PASSWORD'),
        'HOST': os.getenv('DB_HOST'),
        'PORT': os.getenv('DB_PORT', '5432'),
    }
}

ALLOWED_HOSTS = ['example.com', 'www.example.com']

CORS_ALLOWED_ORIGINS = [
    'https://example.com',
]

# myproject/wsgi.py
import os
from django.core.wsgi import get_wsgi_application

os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'myproject.settings.dev')

application = get_wsgi_application()

# Run development server
export DJANGO_SETTINGS_MODULE=myproject.settings.dev
python manage.py runserver

Output:

Django runs with dev.py settings at http://127.0.0.1:8000/

Explanation:

• base.py - Common settings like INSTALLED_APPS.
• dev.py - Development settings with SQLite and DEBUG=True.
• prod.py - Production settings with PostgreSQL and environment variables.
• DJANGO_SETTINGS_MODULE - Specifies which settings file to use.

2.2 Using Environment Variables

Example: Environment Variables with python-dotenv

# Install python-dotenv
pip install python-dotenv

# .env
DJANGO_SECRET_KEY=your-secret-key
DB_NAME=prod_db
DB_USER=prod_user
DB_PASSWORD=prod_pass
DB_HOST=localhost
DB_PORT=5432

# myproject/settings/prod.py
from .base import *
from dotenv import load_dotenv
import os

load_dotenv()

DEBUG = False

SECRET_KEY = os.getenv('DJANGO_SECRET_KEY')

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': os.getenv('DB_NAME'),
        'USER': os.getenv('DB_USER'),
        'PASSWORD': os.getenv('DB_PASSWORD'),
        'HOST': os.getenv('DB_HOST'),
        'PORT': os.getenv('DB_PORT'),
    }
}

ALLOWED_HOSTS = ['example.com']

# Run with production settings
export DJANGO_SETTINGS_MODULE=myproject.settings.prod
python manage.py runserver

Output:

Django uses prod.py with secure environment variables

Explanation:

• python-dotenv - Loads variables from .env file.
• os.getenv - Retrieves sensitive data securely.
• Add .env to .gitignore to prevent exposing secrets.

2.3 Dynamic Settings with django-environ

Example: Using django-environ

# Install django-environ
pip install django-environ

# .env
SECRET_KEY=your-secret-key
DEBUG=True
DATABASE_URL=sqlite:///db.sqlite3
ALLOWED_HOSTS=localhost,127.0.0.1

# myproject/settings.py
import environ
from pathlib import Path

env = environ.Env(
    DEBUG=(bool, False),
    ALLOWED_HOSTS=(list, []),
)

BASE_DIR = Path(__file__).resolve().parent.parent
environ.Env.read_env(BASE_DIR / '.env')

SECRET_KEY = env('SECRET_KEY')
DEBUG = env('DEBUG')
ALLOWED_HOSTS = env('ALLOWED_HOSTS')

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'myapp',
]

MIDDLEWARE = [
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

DATABASES = {
    'default': env.db(),
}

STATIC_URL = '/static/'
STATIC_ROOT = BASE_DIR / 'static'

Output:

Single settings.py with environment-driven configuration

Explanation:

• django-environ - Simplifies environment variable parsing.
• env.db() - Parses DATABASE_URL for database settings.
• Suitable for projects preferring a single settings file.

2.4 Settings for Multiple Environments

Example: Testing Settings

# myproject/settings/test.py
from .base import *

DEBUG = False

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': BASE_DIR / 'test_db.sqlite3',
    }
}

EMAIL_BACKEND = 'django.core.mail.backends.locmem.EmailBackend'

# Run tests with test settings
export DJANGO_SETTINGS_MODULE=myproject.settings.test
python manage.py test

Output:

Tests run with in-memory email backend and test database

Explanation:

• test.py - Configures settings for testing (e.g., in-memory email).
• Isolated database prevents interference with development/production data.

2.5 Incorrect Settings Management

Example: Hardcoded Sensitive Data

# myproject/settings.py (Incorrect)
SECRET_KEY = 'your-secret-key'
DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': 'prod_db',
        'USER': 'prod_user',
        'PASSWORD': 'prod_pass',
        'HOST': 'localhost',
        'PORT': '5432',
    }
}

Output:

Security risk: sensitive data exposed in source code

Explanation:

• Hardcoding SECRET_KEY and database credentials risks exposure in version control.
• Solution: Use environment variables or django-environ.

---

03. Effective Usage

3.1 Recommended Practices

• Split settings into base.py and environment-specific files.

Example: Dynamic Settings Selection

# myproject/settings/__init__.py
import os

ENVIRONMENT = os.getenv('DJANGO_ENV', 'dev')

if ENVIRONMENT == 'prod':
    from .prod import *
else:
    from .dev import *

# Set environment variable
export DJANGO_ENV=prod
python manage.py runserver

Output:

Django automatically loads prod.py based on DJANGO_ENV

• Use .env files for sensitive data.
• Validate environment variables to prevent runtime errors.

3.2 Practices to Avoid

• Avoid using a single settings file for all environments.

Example: Single Settings File

# myproject/settings.py (Incorrect)
DEBUG = True
DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': 'db.sqlite3',
    }
}
# Production settings mixed in
if os.getenv('ENV') == 'prod':
    DEBUG = False
    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.postgresql',
            'NAME': 'prod_db',
            'USER': 'prod_user',
            'PASSWORD': 'prod_pass',
        }
    }

Output:

Confusing and error-prone configuration

• Solution: Split into base.py, dev.py, and prod.py.

---

04. Common Use Cases

4.1 Configuring Development and Production

Manage settings for local development and production deployment.

Example: Dev vs. Prod Settings

# myproject/settings/dev.py
from .base import *

DEBUG = True
SECRET_KEY = 'dev-secret-key'  # Safe for development
DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': BASE_DIR / 'db.sqlite3',
    }
}
EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'

# myproject/settings/prod.py
from .base import *
import os

DEBUG = False
SECRET_KEY = os.getenv('DJANGO_SECRET_KEY')
ALLOWED_HOSTS = os.getenv('ALLOWED_HOSTS', '').split(',')

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': os.getenv('DB_NAME'),
        'USER': os.getenv('DB_USER'),
        'PASSWORD': os.getenv('DB_PASSWORD'),
        'HOST': os.getenv('DB_HOST'),
        'PORT': os.getenv('DB_PORT'),
    }
}

EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
EMAIL_HOST = os.getenv('EMAIL_HOST')
EMAIL_PORT = 587
EMAIL_USE_TLS = True
EMAIL_HOST_USER = os.getenv('EMAIL_HOST_USER')
EMAIL_HOST_PASSWORD = os.getenv('EMAIL_HOST_PASSWORD')

Output:

Development uses console email; production uses SMTP

Explanation:

• dev.py - Lightweight setup for local development.
• prod.py - Secure, scalable setup with environment variables.

4.2 Managing API Settings

Configure settings for a Django REST Framework API.

Example: API Settings

# myproject/settings/base.py
INSTALLED_APPS = [
    ...
    'rest_framework',
    'corsheaders',
]

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework.authentication.SessionAuthentication',
        'rest_framework.authentication.BasicAuthentication',
    ],
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.AllowAny',
    ],
}

# myproject/settings/prod.py
from .base import *
import os

DEBUG = False
SECRET_KEY = os.getenv('DJANGO_SECRET_KEY')

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework_simplejwt.authentication.JWTAuthentication',
    ],
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticated',
    ],
    'DEFAULT_THROTTLE_CLASSES': [
        'rest_framework.throttling.AnonRateThrottle',
        'rest_framework.throttling.UserRateThrottle',
    ],
    'DEFAULT_THROTTLE_RATES': {
        'anon': '100/day',
        'user': '1000/day',
    },
}

CORS_ALLOWED_ORIGINS = os.getenv('CORS_ALLOWED_ORIGINS', '').split(',')

# .env
DJANGO_SECRET_KEY=your-secret-key
CORS_ALLOWED_ORIGINS=https://example.com

Output:

Production API uses JWT and rate limiting

Explanation:

• base.py - Common API settings like DRF defaults.
• prod.py - Secure API with JWT and throttling.

---

Conclusion

Managing Django settings files effectively ensures secure, scalable, and maintainable applications. By modularizing settings, using environment variables, and tailoring configurations for different environments, developers can streamline development and deployment. Key takeaways:

• Split settings into base.py and environment-specific files.
• Use python-dotenv or django-environ for secure variable management.
• Configure environment-specific settings for development, testing, and production.
• Avoid hardcoding sensitive data or using a single settings file.

With proper settings management, Django projects can adapt to any environment while maintaining security and clarity!