settings.py introduction

settings.py is Django's control panel—database, installed apps, middleware, templates, static files, and security flags all live here (or in split settings modules for production).

Settings you touch early

• DEBUG — True in development only; never in production
• SECRET_KEY — signs sessions/CSRF; keep secret, rotate if leaked
• ALLOWED_HOSTS — hostnames the site will serve (required when DEBUG is False)
• DATABASES — default SQLite locally; PostgreSQL in production
• INSTALLED_APPS, MIDDLEWARE, TEMPLATES, STATIC_URL

Environment-specific settings

Mature projects use settings/base.py, dev.py, prod.py and env vars for secrets—never commit production SECRET_KEY or DB passwords.

Important interview questions and answers

1. Q: Why is DEBUG=False in production?
   A: DEBUG exposes stack traces and sensitive settings to attackers—use logging and Sentry instead.
2. Q: Where should SECRET_KEY live?
   A: Environment variable or secret manager—not in git.
3. Q: Default dev database?
   A: SQLite (db.sqlite3)—fine for learning; PostgreSQL is standard for production Django.

Self-check

1. What happens if ALLOWED_HOSTS is empty and DEBUG is False?
2. Name two settings that must differ between dev and prod.