I changed my secret key to an environment variable on my Heroku app. I changed it because I found out that keeping the secret key in settings.py was a security risk.
However, now it won't work locally when I use python manage.py runserver. It gives an error about the secret key.
How do I fix it so I can develop my Heroku app locally?
You can export your secret key as an environment variable locally.
export SECRET_KEY=mysecretkey
./manage.py runserver
Or you could change your settings.py to use a hardcoded secret key in DEBUG mode. If you do this, make sure you are running with DEBUG = False on Heroku.
import os
if DEBUG:
SECRET_KEY = 'mysecretkey'
else:
SECRET_KEY = os.environ['SECRET_KEY']
You have to set your environmental variables in your development environment.
Windows
Go to Computer > Properties > Advanced System Settings.
Go to the Advanced tab, and at the bottom there is an Environment Variables... button.
In there you can edit the variables as you like.
Linux
Edit /etc/environment to include:
SECRET_KEY = <yoursecretkey>
or
You should be using a virtual environment to isolate your system Python installation from your different projects (it solves conflicting version requirements) and to make deployment easier. Virtualenv Tutorial
To activate your virtual environment when you want to use it there is a shell script located at <your_virtualenv>/bin/activate that handles changing all the environmental variables that make the virtual environment work.
Add:
SECRET_KEY='<yoursecretkey>'
export SECRET_KEY
to the bottom of the activate file and when it is run it will add (export) the environmental variable.
I had a bit of trouble working this out too, found my answer here: Set up your local environment variables
If you are using heroku local to develop locally, this might work for you. I just needed to include this line in an .env file placed in the top directory with my Procfile:
SECRET_KEY = 'yourkey'
And in settings.py:
os.environ.get('SECRET_KEY')
This works great for me. Otherwise if for whatever reason you aren't using heroku local, maybe you could try importing your key from another file when working locally (and placing this file in your gitignore), and swapping back to the heroku config variable for deployment.
Related
I have just started learning backend dev using django. My question is do I just commit the project files in the server folder alone, or should I also commit the .env folder to the repository?
I have done the following:
I have created virtual environment and I have also installed django in venv.
I have setup a django server and super admin.
I have setup the config.json to protect my API key.
Included the same in .gitignore.
What happens if I do or do not commit .env?
Assuming that your .env folder is your virtual environment, no you should not commit it.
The virtual environment should be rebuilt on the server using your requirements.txt file. The local environment you built on your development machine may have operating system specific binaries, and other compiled code that was generated for your local environment.
The server will have different compiled binaries, and therefore should rebuild the virtual environment using: pip install -r requirements.txt.
You shouldn't commit/include your .env file in your git repo because env stands for environment. You will different environment variables for your LOCAL, STAGING(development), PRODUCTION environments.
i.e. your LOCAL .env file might have something like
WEB_HOST=localhost
WEB_PORT=8000
ALLOWED_HOSTS=127.0.0.1, localhost
but your PRODUCTION .env will have something different like
WEB_HOST=www.mysite.com
WEB_PORT=8080
ALLOWED_HOSTS=www.mysite.com
Which is why you can't include your .env in your repo and should be created depending on the environment.
Im using Python and Django to create a Heroku web app and Heroku gives me this error after the command 'git push heroku master': ModuleNotFoundError: No module named 'dlist.secret_settings' when attempting to do this:
#settings.py
from .secret_settings import *
# from secret_settings.py import * doesn't work for some reason.
Here is what secret_settings.py (which is in the same folder as settings.py) contains:
#secret_settings.py
SECRET_KEY = 'string here'
The problem is, this works when I test my web app on my local server (ie http://127.0.0.1:8000/), but its not working when I push these changes to Heroku. All I want to do is hide my SECRET_KEY, per others advice, as you can see. Ive looked at others suggestions and I can't seem to figure it out, choosing this method because it was understandable. Very frustrating. Beginner friendly answers/steps are greatly appreciated.
I'm guessing you've configured Git to ignore secret_settings.py. That's the only reason I can think of to create a separate file.
Heroku deploys are powered by Git. Since secret_settings.py isn't tracked by Git it doesn't get pushed to Heroku. You could add the file to your repository, but that would defeat the purpose of having a separate untracked file in the first place.
The solution is to use an environment variable. This is well-supported on Heroku.
In your settings.py file, set your SECRET_KEY using os.getenv() like this:
import os
SECRET_KEY = os.getenv('SECRET_KEY', 'Optional default value')
This tells Django to load your SECRET_KEY setting from an environment variable called SECRET_KEY. If no such environment variable exists it will fall back to the optional default value. On your development machine it's probably fine to use the default.
Finally, set the SECRET_KEY environment variable on Heroku. You can do this by running heroku config:set SECRET_KEY="YOUR_SECRET_KEY_VALUE" on your development machine, or via Heroku's web-based dashboard.
Your secret_settings.py file is no longer required.
I am ready to deploy my project. Everything I learned is on my own and I am confused about the SECRET_KEY placement. As stated above, am I supposed to create a file use, .env or os.py to store my SECRET_KEY? It's not to clear to me and none of my tutorials mention this.
EDIT I plan on hosting on heroku
Since you are hosting on Heroku, you shouldn't manually create file on your server to store the SECRET_KEY, since it will be deleted on server restart. I would use Heroku environment variables, which can be set from your command line:
heroku config:set SECRET_KEY=some_very_secret_key
You can then easily read it in your Django settings:
os.environ['SECRET_KEY']
For more details see: https://devcenter.heroku.com/articles/config-vars
I currently have a running production Django application on Heroku. Unfortunately, I haven't been able to turn off the DEBUG setting on Heroku. Turning it off locally works fine, but when pushed to Heroku (after heroku config:set DEBUG=False), it doesn't apply.
The error pages are still the default DEBUG ones instead of the 404, 403, and 500 templates in our template root.
I have also tried using a DJANGO_DEBUG setting in case there were any environment conflicts with DEBUG, and casting the result to a boolean in the settings file. heroku config shows the settings in the environment are correct. This is on Django 1.3, Heroku Cedar.
Any tips or solutions?
Does your django settings.py file even look in the environment?
It does not, by default, care about anything you've set in the environment (via "config:set"). If you're "casting" the environment to a boolean, make sure you're casting it correctly. bool('False') is still True.
It's simplest just to detect if the environment variable exists so you don't have to worry about type casting or specific formats of the configuration.
DEBUG = os.environ.get('DEBUG', False)
To disable debug, remove the variable from the environment instead of trying to type cast... it just seems much more reliable and fool proof. config:unset DEBUG
The problem is that the environment variable is not a boolean, rather a string.
So do place below line in settings.py
DEBUG = (os.environ.get('DEBUG_VALUE') == 'True')
How do I use my production settings with heroku? This is my first attempt at any project deployment that I created ever, so I may be doing things completely wrong. I have a settings.py file and a settings_production file, but I can't seem to figure out how to get the production settings to work. I tried changing my manage.py from
"DJANGO_SETTINGS_MODULE", "myproject.settings"
to
"DJANGO_SETTINGS_MODULE", "myproject.settings_production"
then using the commands
git add .
git commit -m "production settings"
and I have also just tried changing DEBUG to False in my settings.py file. How do you commit changes to your settings in heroku or point to the correct file? I was able to get through the tutorial successfully, but I have not had luck trying to deploy my project. Also, should there be code that I add to manage.py that checks if it is a production or develop environment and uses the correct settings file accordingly, or do I manually change it? Still learning so I could be doing it completely wrong. Thanks for any help.
In Heroku, you can configure environment variables - they are called config vars.
The DJANGO_SETTINGS_MODULE environment variable should be set to myproject.settings_production.
Your manage.py is probably not being run in Heroku (there are other ways to run a Django app), which is why your change didn't work.