How to properly protect passwords and secret keys when building a heroku app?

Question

Django

The secret key and data for entering the database are written in settings.py. I created a new file keys.py in the same directory with settings.py, created variables and entered the secret key and everything related to the database as values. This file has been added to gitignore. Thus, it seems to have hidden all the secrets. But when I wanted to update the application on heroku (it was already added there), it gives me an error that keys.py could not be imported (it does not see the file, most likely due to the fact that I have it in gitignore). How to be?

This is what my settings.py looks like:

from . import keys

SECRET_KEY = keys.secret_key

DATABASES = {
    'default': {
        'ENGINE': keys.db_engine,
        'NAME': keys.db_name,
        'USER': keys.db_user,
        'PORT': keys.db_port,
        'PASSWORD': keys.db_password,
        'HOST': keys.db_host,
    }
}

Here is the full error log after I typed git push heroku master:

remote: -----> $ python manage.py collectstatic --noinput
remote:        Traceback (most recent call last):
remote:          File "/app/.heroku/python/lib/python3.8/site-packages/django/core/management/__init__.py", line 224, in fetch_command     
remote:            app_name = commands[subcommand]
remote:        KeyError: 'collectstatic'
remote:        During handling of the above exception, another exception occurred:
remote:        Traceback (most recent call last):
remote:          File "manage.py", line 21, in <module>
remote:            main()
remote:          File "manage.py", line 17, in main
remote:            execute_from_command_line(sys.argv)
remote:          File "/app/.heroku/python/lib/python3.8/site-packages/django/core/management/__init__.py", line 401, in execute_from_command_line
remote:            utility.execute()
remote:          File "/app/.heroku/python/lib/python3.8/site-packages/django/core/management/__init__.py", line 395, in execute
remote:            self.fetch_command(subcommand).run_from_argv(self.argv)
remote:          File "/app/.heroku/python/lib/python3.8/site-packages/django/core/management/__init__.py", line 231, in fetch_command     
remote:            settings.INSTALLED_APPS
remote:          File "/app/.heroku/python/lib/python3.8/site-packages/django/conf/__init__.py", line 76, in __getattr__
remote:            self._setup(name)
remote:          File "/app/.heroku/python/lib/python3.8/site-packages/django/conf/__init__.py", line 63, in _setup
remote:            self._wrapped = Settings(settings_module)
remote:          File "/app/.heroku/python/lib/python3.8/site-packages/django/conf/__init__.py", line 142, in __init__
remote:            mod = importlib.import_module(self.SETTINGS_MODULE)
remote:          File "/app/.heroku/python/lib/python3.8/importlib/__init__.py", line 127, in import_module
remote:            return _bootstrap._gcd_import(name[level:], package, level)
remote:          File "<frozen importlib._bootstrap>", line 1014, in _gcd_import
remote:          File "<frozen importlib._bootstrap>", line 991, in _find_and_load
remote:          File "<frozen importlib._bootstrap>", line 975, in _find_and_load_unlocked
remote:          File "<frozen importlib._bootstrap>", line 671, in _load_unlocked
remote:          File "<frozen importlib._bootstrap_external>", line 783, in exec_module
remote:          File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
remote:          File "/tmp/build_77a98f2ac83490e663d0fc6b665daf9c/project/settings.py", line 2, in <module>
remote:            from . import keys
remote:        ImportError: cannot import name 'keys' from 'project' (/tmp/build_77a98f2ac83490e663d0fc6b665daf9c/project/__init__.py)     
remote:
remote:  !     Error while running '$ python manage.py collectstatic --noinput'.
remote:        See traceback above for details.
remote:
remote:        You may need to update application code to resolve this error.
remote:        Or, you can disable collectstatic for this application:
remote:
remote:           $ heroku config:set DISABLE_COLLECTSTATIC=1
remote:
remote:        https://devcenter.heroku.com/articles/django-assets
remote:  !     Push rejected, failed to compile Python app.
remote:
remote:  !     Push failed
remote: Verifying deploy...
remote:
remote: !       Push rejected to infinite-river-34996.
remote:
To https://git.heroku.com/infinite-river-34996.git
 ! [remote rejected] master -> master (pre-receive hook declined)
error: failed to push some refs to 'https://git.heroku.com/infinite-river-34996.git'

Answer 1

Do you have the keys in clear text in keys.py???
You should always use the environment variable
and then in the code
SECRET_KEY = os.getenv("DJANGO_SECRET")