장고 고급 #7 배포 보안 — settings 분리, ALLOWED_HOSTS, CSRF, secret 관리

myproject/
├── settings/
│   ├── __init__.py
│   ├── base.py        # 공통
│   ├── dev.py         # 개발
│   ├── test.py        # 테스트
│   └── prod.py        # 운영

import os
from pathlib import Path

BASE_DIR = Path(__file__).resolve().parent.parent.parent

INSTALLED_APPS = [
    "django.contrib.admin",
    "django.contrib.auth",
    ...
    "myapp",
]

MIDDLEWARE = [...]

DATABASES = {
    "default": {
        "ENGINE": "django.db.backends.postgresql",
        "NAME": os.environ.get("DB_NAME"),
        ...
    }
}

# ⚠ 여기에는 비밀 값을 절대 두지 않음

from .base import *

DEBUG = True
ALLOWED_HOSTS = ["127.0.0.1", "localhost"]
SECRET_KEY = "dev-only-do-not-use-in-prod"
INSTALLED_APPS += ["debug_toolbar"]
INTERNAL_IPS = ["127.0.0.1"]

from .base import *
import os

DEBUG = False
SECRET_KEY = os.environ["SECRET_KEY"]   # 없으면 KeyError → 빠른 실패
ALLOWED_HOSTS = os.environ["ALLOWED_HOSTS"].split(",")

# ... 운영 전용 설정들 (아래 섹션들에서)

DJANGO_SETTINGS_MODULE=myproject.settings.prod gunicorn myproject.wsgi:application

os.environ.setdefault(
    "DJANGO_SETTINGS_MODULE",
    "myproject.settings.dev",   # 기본은 dev, 운영은 환경에서 덮어씀
)

import os
from pathlib import Path

BASE_DIR = Path(__file__).resolve().parent.parent

ENVIRONMENT = os.environ.get("DJANGO_ENV", "development")
PRODUCTION = ENVIRONMENT == "production"

DEBUG = not PRODUCTION

if PRODUCTION:
    SECRET_KEY = os.environ["SECRET_KEY"]
    ALLOWED_HOSTS = os.environ["ALLOWED_HOSTS"].split(",")
    DATABASES = {
        "default": {
            "ENGINE": "django.db.backends.postgresql",
            "NAME": os.environ["DB_NAME"],
            "USER": os.environ["DB_USER"],
            "PASSWORD": os.environ["DB_PASSWORD"],
            "HOST": os.environ["DB_HOST"],
            "PORT": os.environ.get("DB_PORT", "5432"),
        }
    }
else:
    SECRET_KEY = "dev-secret"
    ALLOWED_HOSTS = ["127.0.0.1", "localhost"]
    DATABASES = {
        "default": {
            "ENGINE": "django.db.backends.sqlite3",
            "NAME": BASE_DIR / "db.sqlite3",
        }
    }

pip install django-environ

import environ

env = environ.Env(
    DEBUG=(bool, False),
    ALLOWED_HOSTS=(list, []),
    DATABASE_URL=(str, ""),
)
environ.Env.read_env()   # .env 파일 로드 (있으면)

DEBUG = env("DEBUG")
SECRET_KEY = env("SECRET_KEY")
ALLOWED_HOSTS = env("ALLOWED_HOSTS")

# DATABASE_URL 한 줄로 DB 설정
DATABASES = {"default": env.db()}

# CACHE_URL도 한 줄
CACHES = {"default": env.cache()}

DEBUG=False
SECRET_KEY=...
ALLOWED_HOSTS=myapp.com,www.myapp.com
DATABASE_URL=postgres://user:pass@db:5432/mydb
CACHE_URL=redis://cache:6379/1

from pydantic import Field
from pydantic_settings import BaseSettings, SettingsConfigDict

class Settings(BaseSettings):
    debug: bool = False
    secret_key: str
    allowed_hosts: list[str] = []
    database_url: str

    model_config = SettingsConfigDict(env_file=".env", case_sensitive=False)

settings = Settings()   # 누락 변수면 startup 시점에 ValidationError

from myproject.config import settings as cfg

DEBUG = cfg.debug
SECRET_KEY = cfg.secret_key
ALLOWED_HOSTS = cfg.allowed_hosts

def custom_404(request, exception):
    return render(request, "404.html", status=404)

def custom_500(request):
    return render(request, "500.html", status=500)

handler404 = "myapp.views.custom_404"
handler500 = "myapp.views.custom_500"

ALLOWED_HOSTS = ["myapp.com", "www.myapp.com"]

ALLOWED_HOSTS = ["*"]

ALLOWED_HOSTS = [".myapp.com"]   # 점으로 시작 — *.myapp.com의미

ALLOWED_HOSTS = ["myapp.com", ".myapp.com", "10.0.0.0/8"]   # CIDR도 가능 (5.x)

from django.core.management.utils import get_random_secret_key
print(get_random_secret_key())

python -c "from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())"

SECRET_KEY = "new-key"
SECRET_KEY_FALLBACKS = ["old-key"]   # 잠시 유지

CSRF_TRUSTED_ORIGINS = [
    "https://myapp.com",
    "https://www.myapp.com",
    "https://payments.example.com",
]

CSRF_COOKIE_SECURE = True       # HTTPS에서만 전송
SESSION_COOKIE_SECURE = True    # 세션도 동일

CSRF_COOKIE_HTTPONLY = False    # JS가 토큰을 읽어 헤더에 넣을 수 있어야 함
SESSION_COOKIE_HTTPONLY = True  # 세션은 JS 접근 차단

CSRF_COOKIE_SAMESITE = "Lax"    # CSRF 기본 방어
SESSION_COOKIE_SAMESITE = "Lax"

SECURE_SSL_REDIRECT = True

SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")

SECURE_HSTS_SECONDS = 31536000           # 1년
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

X_FRAME_OPTIONS = "DENY"

pip install django-csp

MIDDLEWARE = [..., "csp.middleware.CSPMiddleware"]

CSP_DEFAULT_SRC = ("'self'",)
CSP_SCRIPT_SRC = ("'self'", "https://cdn.jsdelivr.net")
CSP_STYLE_SRC = ("'self'", "'unsafe-inline'")
CSP_IMG_SRC = ("'self'", "data:", "https:")
CSP_CONNECT_SRC = ("'self'", "https://api.myapp.com")

CSP_REPORT_ONLY = True
CSP_REPORT_URI = "/csp-report/"

SECURE_CONTENT_TYPE_NOSNIFF = True       # 기본 True (5.x)
SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin"

PASSWORD_HASHERS = [
    "django.contrib.auth.hashers.Argon2PasswordHasher",
    "django.contrib.auth.hashers.PBKDF2PasswordHasher",
    "django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher",
]

pip install argon2-cffi

AUTH_PASSWORD_VALIDATORS = [
    {"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"},
    {
        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
        "OPTIONS": {"min_length": 12},   # 8 → 12 권장
    },
    {"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator"},
    {"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"},
]

LOGGING = {
    "version": 1,
    "disable_existing_loggers": False,
    "formatters": {
        "verbose": {
            "format": "{levelname} {asctime} {name} {process:d} {message}",
            "style": "{",
        },
    },
    "handlers": {
        "console": {
            "class": "logging.StreamHandler",
            "formatter": "verbose",
        },
    },
    "root": {
        "handlers": ["console"],
        "level": "INFO",
    },
    "loggers": {
        "django.request": {
            "handlers": ["console"],
            "level": "ERROR",
            "propagate": False,
        },
        "django.security": {
            "handlers": ["console"],
            "level": "INFO",
            "propagate": False,
        },
    },
}

pip install "sentry-sdk[django]"

import sentry_sdk
from sentry_sdk.integrations.django import DjangoIntegration

sentry_sdk.init(
    dsn=os.environ["SENTRY_DSN"],
    integrations=[DjangoIntegration()],
    traces_sample_rate=0.1,
    send_default_pii=False,    # 개인정보 자동 수집 X
)

DJANGO_SETTINGS_MODULE=myproject.settings.prod python manage.py check --deploy

- name: Django deploy check
  run: |
    DJANGO_SETTINGS_MODULE=myproject.settings.prod \
    python manage.py check --deploy --fail-level WARNING

import boto3, json

if PRODUCTION:
    client = boto3.client("secretsmanager")
    secret = json.loads(client.get_secret_value(SecretId="myapp/prod")["SecretString"])
    SECRET_KEY = secret["django_secret"]
    ...

python -c "import django; from django.conf import settings; assert not settings.DEBUG"

python manage.py collectstatic --noinput