Coverage for config/settings/production.py: 0%

1"""Production settings (AWS RDS, S3, AWS Cognito, SSL enforcement). 

2 

3Every secret and host comes from the environment; nothing sensitive is hard-coded. 

4""" 

5 

6import os 

7 

8from .base import * # noqa: F401,F403 

9 

10DEBUG = False 

11 

12# SECRET_KEY and ALLOWED_HOSTS MUST be provided via the environment in production. 

13# DATABASES already reads POSTGRES_* env vars from base.py (point these at RDS). 

14 

15SECURE_SSL_REDIRECT = True 

16SESSION_COOKIE_SECURE = True 

17CSRF_COOKIE_SECURE = True 

18SECURE_HSTS_SECONDS = 60 * 60 * 24 * 365 

19SECURE_HSTS_INCLUDE_SUBDOMAINS = True 

20SECURE_HSTS_PRELOAD = True 

21SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https") 

22 

23CORS_ALLOWED_ORIGINS = [o for o in os.environ.get("CORS_ALLOWED_ORIGINS", "").split(",") if o] 

24 

25# --- Static files via WhiteNoise ----------------------------------------------- 

26# Serves Django admin + Ninja docs assets straight from the container (no S3/CloudFront). 

27# Installed in the image only (see backend Dockerfile); local dev keeps the plain settings. 

28# MIDDLEWARE comes from `from .base import *`; insert whitenoise right after SecurityMiddleware. 

29MIDDLEWARE.insert(2, "whitenoise.middleware.WhiteNoiseMiddleware") # noqa: F405 

30 

31STORAGES = { 

32 "default": {"BACKEND": "django.core.files.storage.FileSystemStorage"}, 

33 "staticfiles": {"BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage"}, 

34}