From d327e471ea9acf4a4347c5250285fdbc22606a15 Mon Sep 17 00:00:00 2001
From: FriggemannMichael <m.friggemann@proton.me>
Date: Tue, 7 Jul 2026 10:27:20 +0200
Subject: [PATCH] Add production-ready settings and CORS configuration

Make the deployment-relevant settings environment-driven so the same settings
file works locally and in production, with defaults that keep local development
unchanged:

- SECRET_KEY, DEBUG, ALLOWED_HOSTS, CSRF_TRUSTED_ORIGINS and CORS_ALLOWED_ORIGINS
  read from DJANGO_* environment variables.
- Add django-cors-headers (corsheaders app + middleware) so the browser frontend
  can call the API cross-origin; default allows the local Live Server origin.
- Add STATIC_ROOT for collectstatic and SECURE_PROXY_SSL_HEADER for running
  behind an HTTPS-terminating reverse proxy; enable secure cookies when DEBUG is
  off.
---
 core/settings.py | 43 ++++++++++++++++++++++++++++++++++++++-----
 requirements.txt |  1 +
 2 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/core/settings.py b/core/settings.py
index 40f0afc..2af211a 100644
--- a/core/settings.py
+++ b/core/settings.py
@@ -10,22 +10,34 @@
 https://docs.djangoproject.com/en/6.0/ref/settings/
 """
 
+import os
 from pathlib import Path
 
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
 
 
-# Quick-start development settings - unsuitable for production
-# See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/
+# Settings are environment-driven so the same file works locally and in
+# production. The defaults keep local development working out of the box.
+
+
+def _env_list(name, default=''):
+    value = os.environ.get(name, default)
+    return [item.strip() for item in value.split(',') if item.strip()]
+
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-hv7w)krtshfc5ag$#w+*@sx-@38japanbw$m$)f8#lp3t*9fbq'
+SECRET_KEY = os.environ.get(
+    'DJANGO_SECRET_KEY',
+    'django-insecure-hv7w)krtshfc5ag$#w+*@sx-@38japanbw$m$)f8#lp3t*9fbq',
+)
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
+DEBUG = os.environ.get('DJANGO_DEBUG', 'True') == 'True'
 
-ALLOWED_HOSTS = []
+ALLOWED_HOSTS = _env_list('DJANGO_ALLOWED_HOSTS', 'localhost,127.0.0.1')
+
+CSRF_TRUSTED_ORIGINS = _env_list('DJANGO_CSRF_TRUSTED_ORIGINS')
 
 
 # Application definition
@@ -38,6 +50,7 @@
     'django.contrib.messages',
     'django.contrib.staticfiles',
     # Third-party
+    'corsheaders',
     'django_filters',
     'rest_framework',
     'rest_framework.authtoken',
@@ -51,6 +64,7 @@
 
 MIDDLEWARE = [
     'django.middleware.security.SecurityMiddleware',
+    'corsheaders.middleware.CorsMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
@@ -98,6 +112,15 @@
 }
 
 
+# Cross-Origin Resource Sharing (django-cors-headers)
+# Origins that are allowed to call the API from a browser.
+
+CORS_ALLOWED_ORIGINS = _env_list(
+    'DJANGO_CORS_ALLOWED_ORIGINS',
+    'http://127.0.0.1:5500,http://localhost:5500',
+)
+
+
 # Database
 # https://docs.djangoproject.com/en/6.0/ref/settings/#databases
 
@@ -146,3 +169,13 @@
 # https://docs.djangoproject.com/en/6.0/howto/static-files/
 
 STATIC_URL = 'static/'
+STATIC_ROOT = BASE_DIR / 'staticfiles'
+
+
+# Deployment behind a reverse proxy (Nginx/Cloudflare) that terminates HTTPS.
+
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+
+if not DEBUG:
+    SESSION_COOKIE_SECURE = True
+    CSRF_COOKIE_SECURE = True
diff --git a/requirements.txt b/requirements.txt
index 96d002b..e9bb38c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,6 +2,7 @@ asgiref==3.11.1
 colorama==0.4.6
 coverage==7.14.3
 Django==6.0.6
+django-cors-headers==4.9.0
 django-filter==25.2
 django-stubs==6.0.6
 django-stubs-ext==6.0.6