How can I handle the security of web frameworks like django on github or any other public domain version control site.
The settings.py can and will often contain sensitive database information, passwords and secret keys, which must not be uploaded on the repository and in plain view.
What is the common practice and least hassle way of handling that?
As @Selcuk mentions, the 12 Factor App provides a nice guideline on how to protect and isolate your sensitive info.
In another answer here: Django settings: raise KeyError, raise ImproperlyConfigured or use defaults?
I explain the method I tend to use in order to be as close as possible to the 12 Factor guidelines.
In sort:
Create a .env or .ini file with your project variables in it:
DB_USERNAME=myDB
DB_PASSWORD=for_your_eyes_only
DEBUG=False
MY_DJANGO_KEY=no_peeking_this_is_secret
...
.env and .env.* or .ini and .ini.* on your .gitignore file, thus protecting your sensitive info from been uploaded to github.env.example (be careful not to name it with a . in the beginning, because it will get ignored). In that file you can put an example of the expected configuration in order to be re-producible by simply copy, paste, rename to .ini or .env.Use decouple.config to read your config file:
on settings.py
from decouple import Csv, config
DEBUG = config('DEBUG', cast=bool, default=True)
SECRET_KEY = config('MY_DJANGO_KEY')
...
I generally use different settings.py for each stage (development, testing and prodcution). The only one that I keep on a version control is the one corresponding to development. The other settings.py are internal and, when required, they are copied to each instance of the server (testing and production).
Hope this helps.
Easy answer: Add it to your .gitignore. That said, if you're intending to share your Django app, you'll want to provide at least the parts you edited for your app .
Password and sensitive infos are stored in my case in individual settings dev_settings.py and prod_settings.py both files are in .gitignore. In settings.py I can switch between them via Environment like this :
DEV_SETTINGS = '_XXXXX_'
if os.environ.get('PROJECT_NAME_PROD', 'NO') == 'YES':
from project.prod_settings import *
else:
from project.dev_settings import *
With this you can still have your settings.py in the repository.
