MobileAudit Environment Variables: Complete Configuration Guide for settings.py

MobileAudit loads all runtime configuration via the env() helper from the getenv package in app/config/settings.py, allowing full environment-driven deployment without code changes.

The mpast/mobileaudit repository is a Django-based mobile application security testing framework. Every configurable value—from database credentials to third-party API keys—is centralized in app/config/settings.py and driven entirely by environment variables. This design eliminates the need for separate configuration files per environment and supports containerized deployments natively.

How Environment Variables Are Loaded in MobileAudit

The getenv Helper Function

At the top of app/config/settings.py, the configuration system imports the env helper:

from getenv import env

This function implements a consistent pattern: env(name, default). It checks the current OS environment for the specified variable name. If present, it returns the value as a string; otherwise, it returns the supplied Python default literal. Because Django evaluates settings at import time, environment variables must be populated before the application starts.

Type Casting

For numeric or boolean values, the code explicitly casts the result. For example, line 64 reads:

DEBUG = int(env("DEBUG", 0))

This ensures that environment strings are converted to the appropriate Python types expected by Django.

Required and Optional Environment Variables

While every variable has a default defined in app/config/settings.py, production deployments must override sensitive values. The configuration is organized into logical groups:

Core Django Settings

These variables control fundamental Django behavior and security:

• SECRET_KEY (line 62): Cryptographic signing key for sessions and tokens. Default: "<SECRET_KEY>" (placeholder).
• DEBUG (line 64): Debug mode flag (1 for on, 0 for off). Default: 0.
• DJANGO_ALLOWED_HOSTS (line 66): Valid host headers. Default: ['web','app','localhost','127.0.0.1'].
• CSRF_TRUSTED_ORIGINS (line 67): Trusted origins for CSRF protection. Default: ['http://web','http://app','http://localhost','http://127.0.0.1'].
• ENV (line 72): Environment identifier ("DEV" or "PROD").

Database Configuration

When ENV equals "PROD", the application expects PostgreSQL credentials (lines 75-81):

• SQL_ENGINE: Database backend. Default: "django.db.backends.sqlite3".
• SQL_DATABASE: Database name. Default: "db.sqlite3".
• SQL_USER: Database user. Default: "postgres".
• SQL_PASSWORD: Database password. Default: "postgres".
• SQL_HOST: Database host. Default: "db".
• SQL_PORT: Database port. Default: "5432".

Security Hardening Flags

Production-specific security headers (lines 85-88):

• SESSION_COOKIE_SECURE: Forces HTTPS-only cookies. Default: False.
• SECURE_HSTS_PRELOAD: HSTS preload flag. Default: False.
• SECURE_HSTS_INCLUDE_SUBDOMAINS: HSTS subdomain inclusion. Default: False.
• SECURE_BROWSER_XSS_FILTER: XSS filter header. Default: True.

Third-Party Service Integrations

CWE Definitions (line 53):

• CWE_URL: Base URL for CWE API. Default: https://cwe.mitre.org/data/definitions/.

Malware Databases (lines 55-58):

• MALWARE_ENABLED: Toggle malware checks. Default: True.
• MALWAREDB_URL: Malware Domain List URL.
• MALTRAILDB_URL: Maltrail domains feed.

VirusTotal (lines 59-66):

• VIRUSTOTAL_ENABLED: Toggle integration. Default: False.
• VIRUSTOTAL_API_KEY: API authentication. Default: empty string.
• VIRUSTOTAL_UPLOAD: Enable file upload. Default: False.

DefectDojo (lines 67-70):

• DEFECTDOJO_ENABLED: Toggle integration. Default: False.
• DEFECTDOJO_URL: Instance URL.
• DEFECTDOJO_API_KEY: Authentication key.

Background Task Configuration

Celery message broker settings (lines 87-92):

• CELERY_BROKER_URL: AMQP broker. Default: amqp://guest:guest@rabbitmq:5672.
• CELERY_RESULT_BACKEND: Result storage. Default: db+sqlite:///rabbitmq/results.sqlite.

Configuration Examples

Local Development with a .env File

Create a .env file in the project root for local testing:

SECRET_KEY=my-local-dev-secret-key-change-in-production
DEBUG=1
DJANGO_ALLOWED_HOSTS=['localhost','127.0.0.1']
CSRF_TRUSTED_ORIGINS=['http://localhost']
ENV=DEV

When you run python manage.py runserver, the getenv package automatically loads these values into the process environment.

Docker and Kubernetes Deployment

For production containers, inject variables via your orchestration platform:

# docker-compose.yml snippet

services:
  web:
    environment:
      - SECRET_KEY=${SECRET_KEY}
      - ENV=PROD
      - SQL_ENGINE=django.db.backends.postgresql
      - SQL_DATABASE=mobileaudit
      - SQL_USER=postgres
      - SQL_PASSWORD=${POSTGRES_PASSWORD}
      - SQL_HOST=db
      - SQL_PORT=5432
      - VIRUSTOTAL_ENABLED=True
      - VIRUSTOTAL_API_KEY=${VT_API_KEY}

In Kubernetes, use Secrets for sensitive values like SECRET_KEY and VIRUSTOTAL_API_KEY, referencing them in your Deployment manifests.

Accessing Variables Programmatically

While app/config/settings.py handles the bulk of configuration, you can use the same helper elsewhere if needed:

from getenv import env

api_key = env('VIRUSTOTAL_API_KEY', '')
if not api_key:
    raise RuntimeError("VirusTotal API key is required for scanning")

Summary

• Centralized Configuration: All settings reside in app/config/settings.py and use the env() helper from the getenv package.
• Environment-Driven Deployment: No code changes are required between development and production; simply set environment variables.
• Sensible Defaults: Every variable has a default value, but production deployments must override SECRET_KEY, database credentials, and third-party API keys.
• Security Controls: Production-specific flags like SESSION_COOKIE_SECURE and SECURE_HSTS_PRELOAD are available but default to development-safe values.
• Integration Ready: Built-in support for VirusTotal, DefectDojo, malware databases, and Celery task queues via environment configuration.

Frequently Asked Questions

What happens if I don't set SECRET_KEY in production?

If you do not override SECRET_KEY, the application uses the placeholder default "<SECRET_KEY>" defined in app/config/settings.py at line 62. This exposes your deployment to critical security vulnerabilities because Django uses this key to sign session cookies and cryptographic tokens. Always generate a unique, random string for production.

How do I switch from SQLite to PostgreSQL in MobileAudit?

Set ENV=PROD and provide the PostgreSQL connection variables. Specifically, set SQL_ENGINE=django.db.backends.postgresql and provide values for SQL_DATABASE, SQL_USER, SQL_PASSWORD, SQL_HOST, and SQL_PORT. When ENV equals "PROD", app/config/settings.py automatically uses these values instead of the SQLite defaults.

Can I use a .env file in production?

Yes. The getenv package automatically loads variables from a .env file if present in the working directory. However, for production deployments, consider using Docker secrets, Kubernetes Secrets, or your orchestration platform's native secret management instead of committing a .env file to version control, as this provides better security and audit trails.

Where are the default values defined?

All default values are defined inline within app/config/settings.py as the second argument to the env() function calls. For example, line 64 reads int(env("DEBUG", 0)), where 0 is the default. The repository also includes an .env.example file that documents all recognized variables with example values for reference.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}