Environment Configuration

Overview

The Password Generator application uses environment variables to manage configuration across different environments. This guide covers all required and optional environment variables for both frontend and backend.

Backend Environment Variables

Required Variables

These variables must be set for the Django backend to function properly:

string

required

Django secret key for cryptographic signing. Generate a secure random string.

# Generate a secure secret key
python -c 'from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())'

boolean

required

Enable or disable debug mode. Must be False in production.

DEBUG=False  # Production
DEBUG=True   # Development

string

required

PostgreSQL database connection URL (production only).

DATABASE_URL=postgresql://username:password@host:port/database

In development with DEBUG=True, SQLite is used automatically and DATABASE_URL is not required.

Deployment Configuration

list

required

Comma-separated list of allowed hostnames for production.

ALLOWED_HOSTS_DEPLOY=yourdomain.com,www.yourdomain.com,api.yourdomain.com

list

default:"localhost,127.0.0.1"

Comma-separated list of allowed hostnames for development.

ALLOWED_HOSTS_DEV=localhost,127.0.0.1,192.168.1.100

CORS Configuration

Cross-Origin Resource Sharing (CORS) settings allow the frontend to communicate with the backend API:

list

required

Comma-separated list of allowed origins for production.

CORS_ALLOWED_ORIGINS_DEPLOY=https://yourdomain.com,https://www.yourdomain.com

list

Comma-separated list of allowed origins for development.

CORS_ALLOWED_ORIGINS_DEV=http://localhost:3000,http://127.0.0.1:3000

list

required

Comma-separated list of trusted origins for CSRF protection in production.

CSRF_TRUSTED_ORIGINS_DEPLOY=https://yourdomain.com,https://www.yourdomain.com

list

Comma-separated list of trusted origins for CSRF protection in development.

CSRF_TRUSTED_ORIGINS_DEV=http://localhost:3000,http://127.0.0.1:3000

Database Configuration

The application uses different database configurations based on the DEBUG setting:

Development (DEBUG=True)

settings.py

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': BASE_DIR / 'db.sqlite3',
    }
}

Production (DEBUG=False)

settings.py

DATABASES = {
    'default': dj_database_url.config(
        default=env('DATABASE_URL'),
        conn_max_age=600,
        ssl_require=True
    )
}

The production configuration uses dj-database-url to parse the DATABASE_URL and enables SSL connections.

JWT Authentication Configuration

The application uses JWT tokens for authentication with the following settings:

settings.py

SIMPLE_JWT = {
    'ACCESS_TOKEN_LIFETIME': timedelta(days=1),
    'REFRESH_TOKEN_LIFETIME': timedelta(days=1),
    'ROTATE_REFRESH_TOKENS': True,
    'BLACKLIST_AFTER_ROTATION': True,
}

duration

default:"1 day"

How long access tokens remain valid.

duration

default:"1 day"

How long refresh tokens remain valid.

boolean

default:"True"

Generate a new refresh token when refreshing.

boolean

default:"True"

Blacklist old refresh tokens after rotation.

Fly.io Specific

string

Automatically set by Fly.io. The app name is added to ALLOWED_HOSTS.

settings.py

FLY_APP_NAME = os.environ.get('FLY_APP_NAME')
if FLY_APP_NAME:
    ALLOWED_HOSTS.append(f'{FLY_APP_NAME}.fly.dev')

Frontend Environment Variables

API Configuration

string

required

Backend API URL. Must be prefixed with NEXT_PUBLIC_ to be exposed to the browser.

.env.local

NEXT_PUBLIC_API_URL=https://password-generator-backend.fly.dev/api/

The current implementation in src/app/utils/Request.api.js uses a hardcoded URL. Update it to use this environment variable:

const api = axios.create({
  baseURL: process.env.NEXT_PUBLIC_API_URL || "http://localhost:8000/api/",
});

Environment File Examples

Backend `.env` (Development)

.env

# Django Configuration
SECRET_KEY=your-development-secret-key-here
DEBUG=True

# Development Hosts
ALLOWED_HOSTS_DEV=localhost,127.0.0.1

# CORS Configuration (Development)
CORS_ALLOWED_ORIGINS_DEV=http://localhost:3000,http://127.0.0.1:3000
CSRF_TRUSTED_ORIGINS_DEV=http://localhost:3000,http://127.0.0.1:3000

Backend `.env` (Production)

.env

# Django Configuration
SECRET_KEY=your-production-secret-key-change-this-to-a-random-string
DEBUG=False

# Database
DATABASE_URL=postgresql://username:password@host:5432/database

# Production Hosts
ALLOWED_HOSTS_DEPLOY=api.yourdomain.com,yourdomain.com

# CORS Configuration (Production)
CORS_ALLOWED_ORIGINS_DEPLOY=https://yourdomain.com,https://www.yourdomain.com
CSRF_TRUSTED_ORIGINS_DEPLOY=https://yourdomain.com,https://www.yourdomain.com

Frontend `.env.local`

.env.local

# API Configuration
NEXT_PUBLIC_API_URL=https://password-generator-backend.fly.dev/api/

# Or for local development
# NEXT_PUBLIC_API_URL=http://localhost:8000/api/

Django Settings Configuration

The application uses django-environ to read environment variables:

settings.py

import environ
import dj_database_url

env = environ.Env()
environ.Env.read_env()

BASE_DIR = Path(__file__).resolve().parent.parent

# Read environment variables
SECRET_KEY = env('SECRET_KEY')
DEBUG = env.bool('DEBUG', default=False)

# Environment-specific configuration
if not DEBUG:
    # Production settings
    ALLOWED_HOSTS = env.list('ALLOWED_HOSTS_DEPLOY', default=[])
    CORS_ALLOWED_ORIGINS = env.list('CORS_ALLOWED_ORIGINS_DEPLOY', default=[])
    CSRF_TRUSTED_ORIGINS = env.list('CSRF_TRUSTED_ORIGINS_DEPLOY', default=[])
    
    # PostgreSQL database
    DATABASES = {
        'default': dj_database_url.config(
            default=env('DATABASE_URL'),
            conn_max_age=600,
            ssl_require=True
        )
    }
else:
    # Development settings
    ALLOWED_HOSTS = env.list('ALLOWED_HOSTS_DEV', default=['localhost', '127.0.0.1'])
    CORS_ALLOWED_ORIGINS = env.list('CORS_ALLOWED_ORIGINS_DEV', default=[])
    CSRF_TRUSTED_ORIGINS = env.list('CSRF_TRUSTED_ORIGINS_DEV', default=[])
    
    # SQLite database
    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.sqlite3',
            'NAME': BASE_DIR / 'db.sqlite3',
        }
    }

REST Framework Configuration

The Django REST Framework is configured with JWT authentication:

settings.py

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework_simplejwt.authentication.JWTAuthentication',
    ),
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    ),
    "DEFAULT_SCHEMA_CLASS": "rest_framework.schemas.coreapi.AutoSchema",
}

Static Files Configuration (Production)

settings.py

if not DEBUG:
    STATIC_ROOT = os.path.join(BASE_DIR, 'staticfiles')
    STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'

Localization Settings

The application is configured for Colombian Spanish:

settings.py

LANGUAGE_CODE = 'es-co'
TIME_ZONE = 'America/Bogota'
USE_I18N = True
USE_TZ = True

Security Best Practices

Generate a strong SECRET_KEY

Use a cryptographically secure random string:

python -c 'from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())'

Never commit .env files

Add to .gitignore:

.gitignore

.env
.env.local
.env.*.local

Use different keys per environment

Never reuse the same SECRET_KEY across development, staging, and production.

Restrict CORS origins

Only allow your frontend domain(s):

# Good
CORS_ALLOWED_ORIGINS_DEPLOY=https://yourdomain.com

# Bad - too permissive
CORS_ALLOW_ALL_ORIGINS=True

Enable database SSL in production

The configuration already includes ssl_require=True for PostgreSQL connections.

Environment Variable Checklist

Backend Production

SECRET_KEY is set to a strong random value
DEBUG=False
DATABASE_URL points to PostgreSQL
ALLOWED_HOSTS_DEPLOY includes your domain
CORS_ALLOWED_ORIGINS_DEPLOY includes your frontend domain
CSRF_TRUSTED_ORIGINS_DEPLOY includes your frontend domain

Backend Development

SECRET_KEY is set (can be simple for dev)
DEBUG=True
ALLOWED_HOSTS_DEV includes localhost
CORS_ALLOWED_ORIGINS_DEV includes localhost:3000

Frontend

NEXT_PUBLIC_API_URL points to backend API
Updated Request.api.js to use environment variable

Troubleshooting

”SECRET_KEY” KeyError

If you see this error, the SECRET_KEY environment variable is not set:

# Verify environment variables are loaded
python manage.py shell
>>> import os
>>> os.environ.get('SECRET_KEY')

CORS Errors

If you see CORS errors in the browser console:

Verify CORS_ALLOWED_ORIGINS_DEPLOY includes your frontend URL (with protocol)
Ensure there are no trailing slashes
Check the backend logs for CORS rejection messages

Database Connection Failed

If the database connection fails:

# Test database URL format
echo $DATABASE_URL

# Should output:
# postgresql://username:password@host:port/database

Get Started

Features

Python Package

Deployment

Overview

Backend Environment Variables

Required Variables

Deployment Configuration

CORS Configuration

Database Configuration

Development (DEBUG=True)

Production (DEBUG=False)

JWT Authentication Configuration

Fly.io Specific

Frontend Environment Variables

API Configuration

Environment File Examples

Backend `.env` (Development)

Backend `.env` (Production)

Frontend `.env.local`

Django Settings Configuration

REST Framework Configuration

Static Files Configuration (Production)

Localization Settings

Security Best Practices

Environment Variable Checklist

Troubleshooting

”SECRET_KEY” KeyError

CORS Errors

Database Connection Failed

Next Steps

Frontend Deployment

Backend Deployment

​Overview

​Backend Environment Variables

​Required Variables

​Deployment Configuration

​CORS Configuration

​Database Configuration

​Development (DEBUG=True)

​Production (DEBUG=False)

​JWT Authentication Configuration

​Fly.io Specific

​Frontend Environment Variables

​API Configuration

​Environment File Examples

​Backend .env (Development)

​Backend .env (Production)

​Frontend .env.local

​Django Settings Configuration

​REST Framework Configuration

​Static Files Configuration (Production)

​Localization Settings

​Security Best Practices

​Environment Variable Checklist

​Troubleshooting

​”SECRET_KEY” KeyError

​CORS Errors

​Database Connection Failed

​Next Steps

Frontend Deployment

Backend Deployment

Overview

Backend Environment Variables

Required Variables

Deployment Configuration

CORS Configuration

Database Configuration

Development (DEBUG=True)

Production (DEBUG=False)

JWT Authentication Configuration

Fly.io Specific

Frontend Environment Variables

API Configuration

Environment File Examples

Backend `.env` (Development)

Backend `.env` (Production)

Frontend `.env.local`

Django Settings Configuration

REST Framework Configuration

Static Files Configuration (Production)

Localization Settings

Security Best Practices

Environment Variable Checklist

Troubleshooting

”SECRET_KEY” KeyError

CORS Errors

Database Connection Failed

Next Steps