moomboss

中文

English

中文

English

Appearance

第17章：部署上线 ​

17.1 生产环境配置 ​

settings分离 ​

将Django设置文件分离为开发、测试和生产环境：

python
# settings/__init__.py
import os

# 根据环境变量加载不同的设置文件
DJANGO_ENV = os.environ.get('DJANGO_ENV', 'development')

if DJANGO_ENV == 'production':
    from .production import *
elif DJANGO_ENV == 'staging':
    from .staging import *
elif DJANGO_ENV == 'testing':
    from .testing import *
else:
    from .development import *

# settings/base.py
import os
from pathlib import Path

BASE_DIR = Path(__file__).resolve().parent.parent.parent

# 安全设置
SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY', 'your-secret-key-here')
DEBUG = False
ALLOWED_HOSTS = []

# 应用配置
INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'blog',
    'accounts',
    # 其他应用...
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

ROOT_URLCONF = 'myproject.urls'

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [BASE_DIR / 'templates'],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
            ],
        },
    },
]

WSGI_APPLICATION = 'myproject.wsgi.application'

# 国际化
LANGUAGE_CODE = 'zh-hans'
TIME_ZONE = 'Asia/Shanghai'
USE_I18N = True
USE_TZ = True

# 静态文件
STATIC_URL = '/static/'
STATIC_ROOT = BASE_DIR / 'staticfiles'

# 默认主键字段
DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'

# settings/development.py
from .base import *

DEBUG = True
ALLOWED_HOSTS = ['localhost', '127.0.0.1']

# 开发环境数据库
DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': BASE_DIR / 'db.sqlite3',
    }
}

# 开发环境邮箱后端
EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'

# 开发环境日志
LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'handlers': {
        'console': {
            'class': 'logging.StreamHandler',
        },
    },
    'root': {
        'handlers': ['console'],
        'level': 'DEBUG',
    },
}

# settings/production.py
from .base import *
import os

DEBUG = False
ALLOWED_HOSTS = [
    'yourdomain.com',
    'www.yourdomain.com',
    os.environ.get('SERVER_IP', ''),
]

# 生产环境数据库
DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': os.environ.get('DB_NAME', 'myproject'),
        'USER': os.environ.get('DB_USER', 'myproject'),
        'PASSWORD': os.environ.get('DB_PASSWORD', ''),
        'HOST': os.environ.get('DB_HOST', 'localhost'),
        'PORT': os.environ.get('DB_PORT', '5432'),
        'OPTIONS': {
            'charset': 'utf8mb4',
        },
    }
}

# 缓存配置
CACHES = {
    'default': {
        'BACKEND': 'django_redis.cache.RedisCache',
        'LOCATION': os.environ.get('REDIS_URL', 'redis://127.0.0.1:6379/1'),
        'OPTIONS': {
            'CLIENT_CLASS': 'django_redis.client.DefaultClient',
        }
    }
}

# 安全设置
SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_SECONDS = 31536000
SECURE_REDIRECT_EXEMPT = []
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True

# 邮箱配置
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
EMAIL_HOST = os.environ.get('EMAIL_HOST', 'smtp.gmail.com')
EMAIL_PORT = int(os.environ.get('EMAIL_PORT', 587))
EMAIL_USE_TLS = True
EMAIL_HOST_USER = os.environ.get('EMAIL_HOST_USER', '')
EMAIL_HOST_PASSWORD = os.environ.get('EMAIL_HOST_PASSWORD', '')

# 静态文件存储
STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.ManifestStaticFilesStorage'

# 媒体文件
MEDIA_URL = '/media/'
MEDIA_ROOT = '/var/www/myproject/media/'

# 日志配置
LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'formatters': {
        'verbose': {
            'format': '{levelname} {asctime} {module} {process:d} {thread:d} {message}',
            'style': '{',
        },
        'simple': {
            'format': '{levelname} {message}',
            'style': '{',
        },
    },
    'handlers': {
        'file': {
            'level': 'INFO',
            'class': 'logging.FileHandler',
            'filename': '/var/log/django/myproject.log',
            'formatter': 'verbose',
        },
        'mail_admins': {
            'level': 'ERROR',
            'class': 'django.utils.log.AdminEmailHandler',
        },
    },
    'root': {
        'handlers': ['file'],
        'level': 'INFO',
    },
    'loggers': {
        'django': {
            'handlers': ['file', 'mail_admins'],
            'level': 'INFO',
            'propagate': False,
        },
    },
}

环境变量 ​

使用环境变量管理敏感配置：

python
# .env 文件示例
"""
DJANGO_ENV=production
DJANGO_SECRET_KEY=your-very-long-secret-key-here
DEBUG=False

# 数据库配置
DB_NAME=myproject
DB_USER=myproject
DB_PASSWORD=your-db-password
DB_HOST=localhost
DB_PORT=5432

# Redis配置
REDIS_URL=redis://127.0.0.1:6379/1

# 邮箱配置
EMAIL_HOST=smtp.gmail.com
EMAIL_PORT=587
EMAIL_USE_TLS=True
EMAIL_HOST_USER=your-email@gmail.com
EMAIL_HOST_PASSWORD=your-app-password

# 服务器配置
SERVER_IP=your-server-ip
"""

# env.py
import os
from dotenv import load_dotenv

# 加载环境变量
load_dotenv()

def get_env_variable(var_name, default=None, required=False):
    """获取环境变量"""
    value = os.environ.get(var_name, default)
    
    if required and value is None:
        raise ValueError(f"环境变量 {var_name} 是必需的")
    
    return value

def get_bool_env_variable(var_name, default=False):
    """获取布尔型环境变量"""
    value = os.environ.get(var_name, str(default)).lower()
    return value in ('true', '1', 'yes', 'on')

def get_int_env_variable(var_name, default=0):
    """获取整型环境变量"""
    try:
        return int(os.environ.get(var_name, default))
    except ValueError:
        return default

# 在settings中使用
from .env import get_env_variable, get_bool_env_variable, get_int_env_variable

SECRET_KEY = get_env_variable('DJANGO_SECRET_KEY', required=True)
DEBUG = get_bool_env_variable('DEBUG', False)

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': get_env_variable('DB_NAME', 'myproject'),
        'USER': get_env_variable('DB_USER', 'myproject'),
        'PASSWORD': get_env_variable('DB_PASSWORD', required=True),
        'HOST': get_env_variable('DB_HOST', 'localhost'),
        'PORT': get_env_variable('DB_PORT', '5432'),
    }
}

# 配置管理类
class Config:
    """配置管理类"""
    
    @classmethod
    def get_database_config(cls):
        """获取数据库配置"""
        return {
            'ENGINE': 'django.db.backends.postgresql',
            'NAME': get_env_variable('DB_NAME', 'myproject'),
            'USER': get_env_variable('DB_USER', 'myproject'),
            'PASSWORD': get_env_variable('DB_PASSWORD', required=True),
            'HOST': get_env_variable('DB_HOST', 'localhost'),
            'PORT': get_env_variable('DB_PORT', '5432'),
        }
    
    @classmethod
    def get_redis_config(cls):
        """获取Redis配置"""
        return {
            'BACKEND': 'django_redis.cache.RedisCache',
            'LOCATION': get_env_variable('REDIS_URL', 'redis://127.0.0.1:6379/1'),
            'OPTIONS': {
                'CLIENT_CLASS': 'django_redis.client.DefaultClient',
            }
        }
    
    @classmethod
    def get_email_config(cls):
        """获取邮箱配置"""
        return {
            'EMAIL_BACKEND': 'django.core.mail.backends.smtp.EmailBackend',
            'EMAIL_HOST': get_env_variable('EMAIL_HOST', 'smtp.gmail.com'),
            'EMAIL_PORT': get_int_env_variable('EMAIL_PORT', 587),
            'EMAIL_USE_TLS': get_bool_env_variable('EMAIL_USE_TLS', True),
            'EMAIL_HOST_USER': get_env_variable('EMAIL_HOST_USER', required=True),
            'EMAIL_HOST_PASSWORD': get_env_variable('EMAIL_HOST_PASSWORD', required=True),
        }

日志配置 ​

详细的日志配置以监控生产环境：

python
# logging_config.py
import os
from .env import get_env_variable

# 日志目录
LOG_DIR = get_env_variable('LOG_DIR', '/var/log/django')

# 确保日志目录存在
os.makedirs(LOG_DIR, exist_ok=True)

LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'formatters': {
        'verbose': {
            'format': '{levelname} {asctime} {module} {process:d} {thread:d} {message}',
            'style': '{',
        },
        'simple': {
            'format': '{levelname} {asctime} {message}',
            'style': '{',
        },
        'django.server': {
            '()': 'django.utils.log.ServerFormatter',
            'format': '[{server_time}] {message}',
            'style': '{',
        }
    },
    'filters': {
        'require_debug_false': {
            '()': 'django.utils.log.RequireDebugFalse',
        },
        'require_debug_true': {
            '()': 'django.utils.log.RequireDebugTrue',
        },
    },
    'handlers': {
        'console': {
            'level': 'INFO',
            'filters': ['require_debug_true'],
            'class': 'logging.StreamHandler',
            'formatter': 'simple'
        },
        'django.server': {
            'level': 'INFO',
            'class': 'logging.StreamHandler',
            'formatter': 'django.server',
        },
        'file': {
            'level': 'INFO',
            'class': 'logging.handlers.RotatingFileHandler',
            'filename': os.path.join(LOG_DIR, 'django.log'),
            'maxBytes': 1024*1024*15,  # 15MB
            'backupCount': 10,
            'formatter': 'verbose',
        },
        'error_file': {
            'level': 'ERROR',
            'class': 'logging.handlers.RotatingFileHandler',
            'filename': os.path.join(LOG_DIR, 'django_error.log'),
            'maxBytes': 1024*1024*15,  # 15MB
            'backupCount': 10,
            'formatter': 'verbose',
        },
        'security_file': {
            'level': 'INFO',
            'class': 'logging.handlers.RotatingFileHandler',
            'filename': os.path.join(LOG_DIR, 'security.log'),
            'maxBytes': 1024*1024*15,  # 15MB
            'backupCount': 10,
            'formatter': 'verbose',
        },
        'mail_admins': {
            'level': 'ERROR',
            'filters': ['require_debug_false'],
            'class': 'django.utils.log.AdminEmailHandler',
            'include_html': True,
        }
    },
    'root': {
        'handlers': ['console', 'file'],
        'level': 'INFO',
    },
    'loggers': {
        'django': {
            'handlers': ['file', 'error_file', 'mail_admins'],
            'level': 'INFO',
            'propagate': False,
        },
        'django.server': {
            'handlers': ['django.server'],
            'level': 'INFO',
            'propagate': False,
        },
        'django.security': {
            'handlers': ['security_file', 'mail_admins'],
            'level': 'INFO',
            'propagate': False,
        },
        'myproject': {
            'handlers': ['file', 'error_file'],
            'level': 'INFO',
            'propagate': False,
        },
    }
}

# 自定义日志记录器
import logging

# 创建应用特定的日志记录器
logger = logging.getLogger('myproject')
security_logger = logging.getLogger('django.security')
performance_logger = logging.getLogger('myproject.performance')

# 在视图中使用日志
from django.shortcuts import render
import time

def article_detail(request, slug):
    start_time = time.time()
    
    try:
        article = get_object_or_404(Article, slug=slug)
        
        # 记录性能日志
        duration = time.time() - start_time
        performance_logger.info(
            f"Article detail view for {slug} took {duration:.3f} seconds"
        )
        
        return render(request, 'blog/article_detail.html', {'article': article})
    
    except Exception as e:
        # 记录错误日志
        logger.error(
            f"Error in article_detail view for {slug}: {str(e)}",
            exc_info=True,
            extra={
                'request': request,
                'user_id': request.user.id if request.user.is_authenticated else None,
            }
        )
        raise

# 中间件中添加请求日志
class RequestLoggingMiddleware:
    """请求日志中间件"""
    
    def __init__(self, get_response):
        self.get_response = get_response
        self.logger = logging.getLogger('myproject.requests')
    
    def __call__(self, request):
        start_time = time.time()
        
        response = self.get_response(request)
        
        # 记录请求日志
        duration = time.time() - start_time
        self.logger.info(
            f"{request.method} {request.path} - "
            f"Status: {response.status_code} - "
            f"Duration: {duration:.3f}s - "
            f"User: {getattr(request.user, 'username', 'Anonymous')}"
        )
        
        return response

安全设置 ​

生产环境的安全配置：

python
# security.py
from .env import get_bool_env_variable, get_env_variable

# 基本安全设置
SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_SECONDS = 31536000  # 1年
SECURE_REDIRECT_EXEMPT = []
SECURE_SSL_REDIRECT = get_bool_env_variable('SECURE_SSL_REDIRECT', True)
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

# Cookie安全设置
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_AGE = 1209600  # 2周
SESSION_EXPIRE_AT_BROWSER_CLOSE = False

CSRF_COOKIE_SECURE = True
CSRF_COOKIE_HTTPONLY = True

# 认证安全设置
AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
        'OPTIONS': {
            'min_length': 8,
        }
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
]

# 文件上传安全
FILE_UPLOAD_MAX_MEMORY_SIZE = 5242880  # 5MB
DATA_UPLOAD_MAX_MEMORY_SIZE = 5242880  # 5MB
DATA_UPLOAD_MAX_NUMBER_FIELDS = 1000

# 限制请求频率
# 可以使用django-ratelimit或其他第三方包

# CORS设置（如果需要）
# 安装: pip install django-cors-headers

# CORS_ALLOWED_ORIGINS = [
#     "https://yourdomain.com",
#     "https://www.yourdomain.com",
# ]

# CORS_ALLOW_CREDENTIALS = True

# 内容安全策略
# 可以使用django-csp包

# CSP_DEFAULT_SRC = ("'self'",)
# CSP_SCRIPT_SRC = ("'self'", "'unsafe-inline'", "https://cdn.example.com")
# CSP_STYLE_SRC = ("'self'", "'unsafe-inline'", "https://cdn.example.com")
# CSP_IMG_SRC = ("'self'", "data:", "https://cdn.example.com")

# 安全中间件
SECURITY_MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    # 'csp.middleware.CSPMiddleware',  # 如果使用CSP
]

# 自定义安全检查
from django.core.exceptions import SuspiciousOperation

class SecurityMiddleware:
    """自定义安全中间件"""
    
    def __init__(self, get_response):
        self.get_response = get_response
    
    def __call__(self, request):
        # 检查用户代理
        user_agent = request.META.get('HTTP_USER_AGENT', '')
        suspicious_agents = ['malicious-bot', 'scanner']
        
        if any(agent in user_agent.lower() for agent in suspicious_agents):
            raise SuspiciousOperation("Suspicious user agent detected")
        
        # 检查请求频率（简化示例）
        client_ip = self.get_client_ip(request)
        # 这里应该实现实际的频率限制逻辑
        
        response = self.get_response(request)
        return response
    
    def get_client_ip(self, request):
        """获取客户端IP"""
        x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
        if x_forwarded_for:
            ip = x_forwarded_for.split(',')[0]
        else:
            ip = request.META.get('REMOTE_ADDR')
        return ip

# 安全视图装饰器
from django.contrib.auth.decorators import user_passes_test
from django.core.exceptions import PermissionDenied

def require_ajax(view_func):
    """要求AJAX请求的装饰器"""
    def wrapper(request, *args, **kwargs):
        if not request.headers.get('X-Requested-With') == 'XMLHttpRequest':
            raise PermissionDenied("AJAX request required")
        return view_func(request, *args, **kwargs)
    return wrapper

def require_https(view_func):
    """要求HTTPS请求的装饰器"""
    def wrapper(request, *args, **kwargs):
        if not request.is_secure() and not settings.DEBUG:
            raise PermissionDenied("HTTPS required")
        return view_func(request, *args, **kwargs)
    return wrapper

通过这些生产环境配置，可以确保Django应用在生产环境中的安全性、稳定性和可维护性。

小结 ​

Django生产环境配置的核心要点：

  1. ✅ 分离不同环境的设置文件确保配置灵活性
  2. ✅ 使用环境变量管理敏感配置信息
  3. ✅ 配置详细的日志系统便于问题排查
  4. ✅ 实施全面的安全设置保护应用安全
  5. ✅ 优化数据库、缓存和静态文件配置

合理的生产环境配置是应用稳定运行的基础。

下一篇 ​

我们将学习具体的部署方案。

17.2 部署方案 →

目录 ​

返回课程目录

Released under the Apache 2.0 License.

Copyright © 2025 ITBosser