Basic Django Settings

1. The settings.py File: Your Project's Control Panel

As we discussed, the settings.py file is the heart of your project. From a Python perspective, it's simply a Python module with module-level variables. Django reads these variables to configure its behavior.

You'll find this file inside your project's configuration directory (e.g., mysite/settings.py).

Let's explore the first two crucial security-related settings.

2. The DEBUG Setting

The DEBUG setting is a boolean that radically changes how Django behaves.

• DEBUG = True (Default for new projects)
  This is your development mode. When active, Django provides detailed error pages if something goes wrong. This "yellow screen of death" is incredibly valuable for debugging as it shows the full traceback, local variables, and other configuration details. The development server also uses this setting to automatically reload when you save a file.

• DEBUG = False (Required for production)
  This is your production mode. You must set DEBUG to False before deploying your application to a live server. Running a site with DEBUG = True in production is a major security vulnerability, as it can expose sensitive information about your project's inner workings. With DEBUG = False, users will see a generic server error page instead of your detailed debug information.

3. The ALLOWED_HOSTS Setting

This setting is a list of strings representing the host/domain names that your Django site can serve. It's a critical security measure to prevent HTTP Host header attacks.

• During Development (DEBUG = True): If ALLOWED_HOSTS is empty, Django defaults to allowing ['localhost', '127.0.0.1']. This is why your development server works out-of-the-box without any changes.

• During Production (DEBUG = False): When you switch to production mode, Django becomes much stricter. If ALLOWED_HOSTS is empty, no requests will be served. You must explicitly list all the domain names that should be able to serve your site.

For example, for a live website, your configuration might look like this:

# settings.py

ALLOWED_HOSTS = ['yourdomain.com', 'www.yourdomain.com']

You can also use a wildcard to allow all subdomains:

# settings.py

ALLOWED_HOSTS = ['.yourdomain.com'] # Note the leading dot

4. The INSTALLED_APPS Setting

The INSTALLED_APPS setting is a list that tells Django which applications are active for your project. An "app" can be one of Django's built-in features (like the admin site or authentication system) or one of your own custom-built apps.

When you create a new project, Django pre-populates this list with several common apps:

• django.contrib.admin: The powerful admin interface.
• django.contrib.auth: The user authentication framework.
• django.contrib.contenttypes: A framework for content types.
• django.contrib.sessions: The session framework.
• django.contrib.messages: The messaging framework for notifications.
• django.contrib.staticfiles: The framework for managing static files like CSS and JavaScript.

Registering Your Own App

A key part of building any Django project is creating your own apps and registering them here. The process involves two steps:

1. Use a manage.py command to create the app's directory structure.
2. Add the app's name to the INSTALLED_APPS list in settings.py.

The following video provides an excellent demonstration of this process.

As a quick recap of the process shown in the video:

Step 1: Create the app
In your terminal, at the root of your project (where manage.py is), run:

python manage.py startapp playground

This will create a new playground/ directory with all the necessary files (models.py, views.py, etc.).

Step 2: Register the app
Open mysite/settings.py and add the name of your new app to the INSTALLED_APPS list:

# settings.py

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'playground', # Add this line
]

Now, Django knows about your playground app and will include it when running commands like creating database migrations or collecting static files.

Conclusion

In this lesson, you've moved from observing the project structure to actively configuring it. You now have control over three of the most important settings in your settings.py file.

Key Takeaways:

• DEBUG = True is for development only; it provides helpful error pages but is a security risk in production.
• ALLOWED_HOSTS is a security setting that you must configure with your domain name(s) when DEBUG is False.
• INSTALLED_APPS is the registry for all active features in your project. You must add any new app you create to this list to make it functional.
• The workflow for adding a new feature involves using manage.py startapp and then updating INSTALLED_APPS.

In our next lesson, "Create and register a new Django app within a project," we will build upon what you just learned. Having created and registered an app, we'll take the next logical step: making it do something by creating our first view and wiring it up to a URL.