from .base import *  # noqa: F401,F403

DEBUG = False

ALLOWED_HOSTS = env.list("ALLOWED_HOSTS", default=[])

DATABASES = {
    "default": env.db("DATABASE_URL"),
}

CACHES = {
    "default": {
        "BACKEND": "django.core.cache.backends.redis.RedisCache",
        "LOCATION": env("REDIS_URL", default="redis://redis:6379/1"),
    }
}

# 安全相关设置：详见 documents/设计方案分析与完善版.md §2.11
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
SECURE_CONTENT_TYPE_NOSNIFF = True
X_FRAME_OPTIONS = "DENY"

# 阿里云 SLB / 腾讯云 CLB 等负载均衡在边缘终止 TLS，转发到后端的是明文 HTTP，
# 需要通过约定的代理头识别原始请求是否为 HTTPS，否则 SECURE_SSL_REDIRECT 会导致死循环重定向。
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")

CSRF_TRUSTED_ORIGINS = env.list("CSRF_TRUSTED_ORIGINS", default=[])

# 国内对象存储（阿里云 OSS / 腾讯云 COS 均兼容 S3 协议）
DEFAULT_FILE_STORAGE = env(
    "DEFAULT_FILE_STORAGE",
    default="django.core.files.storage.FileSystemStorage",
)
AWS_ACCESS_KEY_ID = env("OSS_ACCESS_KEY_ID", default="")
AWS_SECRET_ACCESS_KEY = env("OSS_SECRET_ACCESS_KEY", default="")
AWS_STORAGE_BUCKET_NAME = env("OSS_BUCKET_NAME", default="")
AWS_S3_ENDPOINT_URL = env("OSS_ENDPOINT_URL", default="")
# 国内 CDN 加速域名（阿里云 CDN / 腾讯云 CDN / 又拍云，绑定到 OSS/COS 源站后填入），
# 配置后媒体文件 URL 会替换成该加速域名，避免直接暴露 OSS 源站地址（详见 §2.15）。
AWS_S3_CUSTOM_DOMAIN = env("OSS_CDN_DOMAIN", default="")

LOGGING = {
    "version": 1,
    "disable_existing_loggers": False,
    "handlers": {
        "console": {"class": "logging.StreamHandler"},
    },
    "root": {"handlers": ["console"], "level": "INFO"},
}
