DEBUG = get_bool_from_env("DEBUG", True)
…
ALLOWED_CLIENT_HOSTS = os.environ.get("ALLOWED_CLIENT_HOSTS")
if not ALLOWED_CLIENT_HOSTS:
    if DEBUG:
        ALLOWED_CLIENT_HOSTS = _DEFAULT_CLIENT_HOSTS
    else:
        raise ImproperlyConfigured(
            "ALLOWED_CLIENT_HOSTS environment variable must be set when DEBUG=False."
        )
…
if ENABLE_SSL:
    SECURE_SSL_REDIRECT = not DEBUG
…
# Make this unique, and don't share it with anybody.
SECRET_KEY = os.environ.get("SECRET_KEY")
…
if not SECRET_KEY and DEBUG:
    warnings.warn(
        "SECRET_KEY not configured, using a random temporary key.", stacklevel=1
    )
    SECRET_KEY = get_random_secret_key()
…
ALLOWED_HOSTS = get_list(os.environ.get("ALLOWED_HOSTS", "localhost,127.0.0.1"))
ALLOWED_GRAPHQL_ORIGINS: list[str] = get_list(
    os.environ.get("ALLOWED_GRAPHQL_ORIGINS", "*")
)
…
# When `True`, HTTP requests made from arbitrary URLs will be rejected (e.g., webhooks).
# if they try to access private IP address ranges, and loopback ranges (unless
# `HTTP_IP_FILTER_ALLOW_LOOPBACK_IPS=False`).
HTTP_IP_FILTER_ENABLED: bool = get_bool_from_env("HTTP_IP_FILTER_ENABLED", True)

# When `False` it rejects loopback IPs during external calls.
# Refer to `HTTP_IP_FILTER_ENABLED` for more details.
HTTP_IP_FILTER_ALLOW_LOOPBACK_IPS: bool = get_bool_from_env(
    "HTTP_IP_FILTER_ALLOW_LOOPBACK_IPS", False
)
…
JWT_TTL_ACCESS = datetime.timedelta(
    seconds=parse(os.environ.get("JWT_TTL_ACCESS", "5 minutes"))
)
JWT_TTL_APP_ACCESS = datetime.timedelta(
    seconds=parse(os.environ.get("JWT_TTL_APP_ACCESS", "5 minutes"))
)
JWT_TTL_REFRESH = datetime.timedelta(
    seconds=parse(os.environ.get("JWT_TTL_REFRESH", "30 days"))
)
…
# Lock time for request password reset mutation per user (seconds)
RESET_PASSWORD_LOCK_TIME = parse(
    os.environ.get("RESET_PASSWORD_LOCK_TIME", "15 minutes")
)
Warm-up
