from .base import *

from django.core.exceptions import ImproperlyConfigured


DEBUG = False
if SECRET_KEY == "dev-only-change-me" or len(SECRET_KEY) < 50:
    raise ImproperlyConfigured("DJANGO_SECRET_KEY must be a unique production secret of at least 50 characters.")
if not env_list("DJANGO_ALLOWED_HOSTS"):
    raise ImproperlyConfigured("DJANGO_ALLOWED_HOSTS must contain the public production host.")
if not CSRF_TRUSTED_ORIGINS:
    raise ImproperlyConfigured("CSRF_TRUSTED_ORIGINS must contain the public HTTPS origin.")
if MEDIA_SIGNING_SECRET == "Set MEDIA_SIGNING_SECRET in Coolify" or len(MEDIA_SIGNING_SECRET) < 32:
    raise ImproperlyConfigured("MEDIA_SIGNING_SECRET must be a random secret of at least 32 characters.")

SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_SSL_REDIRECT = env_bool("SECURE_SSL_REDIRECT", True)
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
SECURE_HSTS_SECONDS = int(os.getenv("SECURE_HSTS_SECONDS", "31536000"))
SECURE_HSTS_INCLUDE_SUBDOMAINS = env_bool("SECURE_HSTS_INCLUDE_SUBDOMAINS", True)
SECURE_HSTS_PRELOAD = env_bool("SECURE_HSTS_PRELOAD", False)
SECURE_CONTENT_TYPE_NOSNIFF = True
USE_NGINX_MEDIA = env_bool("USE_NGINX_MEDIA", True)