Add an overview of good practices for production settings

[Aymeric Augustin]

Quoting Claude:

add a section in the docs where we explain what settings should be typically added in deployed projects, but not suitable in public repositories (DEBUG=False, DATABASES, STATIC_ROOT, SECRET_KEY, ADMINS, SERVER_EMAIL, etc.) and link to this section in the template.

[Aymeric Augustin]

This was discussed in the context of the new project template. A link to that document should be added below the comment that reads: "# Quick-start development settings - unsuitable for production".

[Carl Meyer]

Lukasz Langa mentioned in IRC today that it would be good to document that most production sites probably want to use the caching template loader. This isn't exactly something that is "not suitable in public repositories", but it fits in a slightly broader document about "things you probably want to do when you go to production." Using the caching loader in development is painful because you don't get template updates until a reload, but almost all sites probably should be using it in production.

[Carl Meyer]

Also, ALLOWED_HOSTS definitely belongs here; see #19875

[Aymeric Augustin]

This is an excellent start, thank you!

A few suggestions:

• add an introduction explaining that you probably want a different settings file for development and production
• group settings by category
  • 1) for security
  • 2) for HTTPS
  • 3) for performance
  • 4) for error reporting
  • add more if necessary
• look for other production-related settings in the settings list
  • ALLOWED_INCLUDE_ROOTS
  • CACHES
  • CSRF_COOKIE_SECURE
  • EMAIL_* + SERVER_EMAIL
  • LOGGING
  • MANAGERS
  • MEDIA_ROOT & URL
  • SESSION_COOKIE_SECURE
  • TEMPLATE_LOADERS => enable the cached template loader

[Aymeric Augustin]

Pull request re-sent together here: ​https://github.com/django/django/pull/839

[Aymeric Augustin]

Updated pull request: ​https://github.com/django/django/pull/913

[Aymeric Augustin <aymeric.augustin@…>]

In 912b5d2a6bc78067d6a7e130f10514c51bd1a58f:

Fixed #19697 -- Added a deployment checklist.