-
-
Notifications
You must be signed in to change notification settings - Fork 32
Description
Problem
settings/prod.py is tracked in git, but it's not actually a source file — it's generated by Ansible from roles/regluit_prod/templates/prod.py.j2 (in regluit-provisioning) with real credentials filled in from the vault.
This causes two problems:
-
Permanently dirty
git statuson the production server. Ansible overwrites the git version with the live credentials version, so the file always shows asmodified. This masks real changes and confuses anyone doing agit statuson the server. -
The git version is stale and misleading. It references
storages.backends.s3boto.S3BotoStorage(old) instead ofs3boto3, usesMAIL_USE_TLSinstead ofEMAIL_USE_TLS, and is missingNOTIFICATION_LOCK_FILE,CELERY_LOG_DIR,GroupWriteRotatingFileHandler, and several Celery beat jobs that are in the current Ansible template. A developer reading the git version would get a false picture of what actually runs in production.
The source of truth for prod config is the Ansible template + vault, not this file.
Solution
In the regluit repo:
git rm --cached settings/prod.py
echo "settings/prod.py" >> .gitignore
git add .gitignore
git commit -m "Stop tracking settings/prod.py — Ansible-generated, not a source file"This:
- Removes the file from git tracking (leaves it on disk — Ansible will still generate it)
- Adds it to
.gitignoreso it never accidentally gets committed again - Makes
git statusclean on the production server - Makes the Ansible template (
prod.py.j2) the unambiguous source of truth
No changes needed to regluit-provisioning — Ansible writes the file regardless of whether git tracks it.
Verification
After the PR is merged and deployed:
git statuson the production server should be clean (onlyvenv/anddeploy/prod.wsgias untracked, which are also Ansible artifacts and similarly harmless)- Ansible re-provisioning should work identically
Related
deploy/prod.wsgiis also Ansible-generated and untracked — this is already fine behavior.settings/prod.pyshould match that pattern.