Use keyring for setting SECRET_KEY.

[Thomas Grainger]

managing the django SECRET_KEY for new projects is a bit of a pain and easy to end up either committing the SECRET_KEY to source control or copying a SECRET_KEY from a blog post.

Generating and storing a secret key in the system keyring adds some complexity, but it a much more sensible default

using some code like this:

from django.core.management.utils import get_random_secret_key

import keyring

def _get(settings_module):
    return keyring.get_password(settings_module, "SECRET_KEY")


def _create():
    password = get_random_secret_key()
    keyring.set_password(settings_module, "SECRET_KEY", password)
    return password


def get_or_create(settings_module):
    return _get(settings_module) or _create(settings_module)

it can be used explicitly in a settings module like:

SECRET_KEY = get_or_create(__name__)

or in the LazySettings like this

        elif name == 'SECRET_KEY' and not val:
            return get_or_create(self._wrapped.SETTINGS_MODULE)
            # raise ImproperlyConfigured("The SECRET_KEY setting must not be empty.")

while this is mostly useful in development, it's also useful in production where you can plug a credential provider into keyring such as ​https://github.com/FindHotel/s3keyring

[Thomas Grainger]

Other options include raising:

raise ImproperlyConfigured(
    "The SECRET_KEY setting must not be empty, "
    "and a system keyring SECRET_KEY could not be found, set one with: "
    "manage.py setsecretkey"
)

if get_password doesn't work and using a management command setsecretkey to run keyring.set_password, as this would sidestep any concurrency issues and be less surprising than silently working in most cases and then failing when deploying to machines without a system keyring.

[Adam Johnson]

The keyring module you refer to is: ​https://pypi.org/project/keyring/

I've not worked on any projects using the system keyring like this. It looks neat but I think some evidence of use in the Django ecosystem via a third party package would be warranted before merging to core.

[Mariusz Felisiak]

Thanks for this ticket, however there are many possible solutions and I don't think that we should include a few lines hook to recommend any of them. You can start a discussion on DevelopersMailingList if you don't agree.

I've also never used keyring, but that's only a comment, not an argument for closing this ticket.