Деплой Python/Django: продакшен с Gunicorn и Nginx

# Обновление системы
sudo apt update && sudo apt upgrade -y

# Установка Python 3 и pip
sudo apt install python3 python3-pip python3-venv python3-dev -y

# Создание директории приложения
sudo mkdir -p /var/www/mydjango
sudo chown $USER:$USER /var/www/mydjango
cd /var/www/mydjango

# Создание виртуального окружения
python3 -m venv venv

# Активация виртуального окружения
source venv/bin/activate

# Обновление pip
pip install --upgrade pip

cd /var/www
git clone https://github.com/user/mydjango.git
cd mydjango
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
pip install gunicorn

import os

DEBUG = False
SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')
ALLOWED_HOSTS = os.environ.get('DJANGO_ALLOWED_HOSTS', '').split(',')

# Заголовки безопасности
SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = 31536000
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True

# Статические файлы
STATIC_URL = '/static/'
STATIC_ROOT = BASE_DIR / 'staticfiles'
MEDIA_URL = '/media/'
MEDIA_ROOT = BASE_DIR / 'media'

sudo apt install postgresql postgresql-contrib -y
sudo -u postgres psql

CREATE DATABASE mydb;
CREATE USER dbuser WITH PASSWORD 'надёжный-пароль';
ALTER ROLE dbuser SET client_encoding TO 'utf8';
ALTER ROLE dbuser SET default_transaction_isolation TO 'read committed';
ALTER ROLE dbuser SET timezone TO 'UTC';
GRANT ALL PRIVILEGES ON DATABASE mydb TO dbuser;
\q

pip install psycopg2-binary
python manage.py migrate
python manage.py createsuperuser
python manage.py collectstatic --noinput

# gunicorn.conf.py
bind = 'unix:/run/gunicorn/gunicorn.sock'
workers = 3  # (2 * ядра CPU) + 1
worker_class = 'sync'
timeout = 30
max_requests = 1000
preload_app = True
user = 'www-data'
group = 'www-data'
errorlog = '/var/log/gunicorn/error.log'
accesslog = '/var/log/gunicorn/access.log'

[Unit]
Description=Gunicorn daemon for Django
After=network.target

[Service]
User=www-data
Group=www-data
WorkingDirectory=/var/www/mydjango
ExecStart=/var/www/mydjango/venv/bin/gunicorn \
    --config /var/www/mydjango/gunicorn.conf.py \
    myproject.wsgi:application
KillMode=mixed
TimeoutStopSec=5
PrivateTmp=true
EnvironmentFile=/var/www/mydjango/.env

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl start gunicorn
sudo systemctl enable gunicorn

server {
    listen 80;
    server_name example.com www.example.com;

    location /static/ {
        alias /var/www/mydjango/staticfiles/;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    location /media/ {
        alias /var/www/mydjango/media/;
    }

    location / {
        include proxy_params;
        proxy_pass http://unix:/run/gunicorn/gunicorn.sock;
        proxy_read_timeout 300;
    }

    client_max_body_size 100M;
}

sudo ln -s /etc/nginx/sites-available/mydjango /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com -d www.example.com

cd /var/www/mydjango
source venv/bin/activate
git pull origin main
pip install -r requirements.txt
python manage.py migrate
python manage.py collectstatic --noinput
sudo systemctl restart gunicorn