Piye carane ngelola pengaturan ing saperangan lingkungan?

Question

Accepted Answer

Konfigurasi Django manggon ing `settings.py`, nanging aplikasi nyata perlu **pengaturan beda saben lingkungan** (development, staging, production) lan kudu njaga **rahasia tetep adoh saka kode**. Ngelola iki kanthi bener minangka kebutuhan operasional lan prasyarat keamanan.

## Masalah karo settings.py tunggal

```python
# ❌ hardcoded, environment-mixed, and INSECURE settings
DEBUG = True                                    # must be False in production!
SECRET_KEY = "hardcoded-secret-in-code"          # ❌ secret committed to git
DATABASES = {"default": {"PASSWORD": "prod-pw"}} # ❌ production password in code
```

Nga-hardcode nilai nyampur lingkungan lan — sing kritis — commit rahasia (SECRET_KEY, sandi database, API keys) menyang version control, pelanggaran keamanan serius.

## Solusi 1: maca config saka environment variables

```python
import os
from pathlib import Path

SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]    # from the environment, NOT code
DEBUG = os.environ.get("DJANGO_DEBUG", "False") == "True"
ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "").split(",")
DATABASES = {
    "default": {
        "ENGINE": "django.db.backends.postgresql",
        "NAME": os.environ["DB_NAME"],
        "PASSWORD": os.environ["DB_PASSWORD"],   # injected per environment
    }
}
# tools like django-environ / python-decouple make this cleaner (+ .env file support)
```

Maca config (utamane rahasia) saka **environment variables** njaga yen tetep adoh saka kode — kodebase sing padha mlaku ing sembarang lingkungan karo nilai injeksi beda-beda (pendekatan twelve-factor).

## Solusi 2: pisah file pengaturan saben lingkungan

```text
settings/
  base.py          # shared settings (apps, middleware, templates)
  development.py   # from base import *; DEBUG=True, local DB, debug toolbar
  production.py    # from base import *; DEBUG=False, security hardening, real DB
  test.py          # test-specific settings
```

```python
# production.py
from .base import *
DEBUG = False
ALLOWED_HOSTS = ["example.com"]
SECURE_SSL_REDIRECT = True            # production-only security settings
# select via: DJANGO_SETTINGS_MODULE=config.settings.production
```

Pisahing pengaturan menyang `base.py` sing dipaake bareng plus file saben-lingkungan (dipilih via `DJANGO_SETTINGS_MODULE`) pisah karo cetha konfigurasi khusus-lingkungan nalika bareng pengaturan umum.

## Pengaturan production kritis

```python
DEBUG = False                  # ❗ NEVER True in production — leaks sensitive error info
ALLOWED_HOSTS = ["example.com"] # required when DEBUG=False
SECRET_KEY = os.environ[...]    # strong, secret, from the environment
# + SECURE_SSL_REDIRECT, SESSION_COOKIE_SECURE, HSTS, etc. for hardening
```

```text
✓ NEVER commit secrets — use env vars / a secret manager; gitignore .env
✓ DEBUG=False in production (DEBUG=True leaks tracebacks, settings → security risk)
✓ Commit a .env.example documenting required variables (no real values)
```

## Apa gunane

Ngelola pengaturan ing saperangan lingkungan minangka **kebutuhan operasional** lan **praktik keamanan kritis** kanggo aplikasi Django nyata.

Aplikasi kudu tumindak berlainan saperangan lingkungan — development butuh `DEBUG=True` lan pengaturan lokal sing gampang, dene production butuh `DEBUG=False`, penguatan keamanan, database nyata, lan host bener — lan `settings.py` hardcode tunggal ora bisa layani kabeh iki.

Kang luwih penting, iki **kekhawatiran keamanan besar**: naga-hardcode rahasia (SECRET_KEY, sandi database, API keys) commit menyang version control, siji saka pelanggar keamanan paling umum lan serius (sapa wae sing duwe akses repo, utawa ing repo publik, oleh kunci aplikasi lan data kowe).

Nanggerti solusi — maca config lan rahasia saka **environment variables** (njaga yen tetep adoh saka kode, pendekatan twelve-factor, asring karo piranti kaya django-environ lan berkas `.env` sing gitignored) lan **pisah pengaturan** menyang basis bareng plus file saben-lingkungan — penting banget kanggo ngeblak Django kanthi aman lan bener.
\_Ngerti **pengaturan production kritis** (utamane yen `DEBUG` kudu `False` ing production, sebab `DEBUG=True` bocor tracebacks, jalur sumber, lan pengaturan menyang penyerang, plus `ALLOWED_HOSTS` lan penguatan keamanan) ora bisa dihilangake nang pengetahuan production.

Kapan pengaturan manajemen dikerjaken bener — rahasia ing environment, konfigurasi sesuai-lingkungan, standar production aman — minangka pokok kanggo nglakoni aplikasi Django kanthi profesional lan nyiakake kerentanan serius sing asale saka rahasia bocor utawa lingkungan production salah konfigurasi, dadi penting, pengetahuan praktis-kritis kanggo sembarang blakan nyata.