security: harden data auth and deployment

scripts/prepare_production_settings.py

@@ -9,6 +9,8 @@ from pathlib import Path
 import secrets
 import sys
 
+from cryptography.fernet import Fernet
+
 from app.runtime import get_runtime_settings
 
 
@@ -30,6 +32,7 @@ def prepare(destination: Path) -> None:
     password = secrets.token_urlsafe(30)
     values.update(
         APP_NAME='Magent', JWT_SECRET=secrets.token_urlsafe(48),
+        SETTINGS_ENCRYPTION_KEY=Fernet.generate_key().decode('ascii'),
         ADMIN_USERNAME='admin', ADMIN_PASSWORD=password,
         AUTH_COOKIE_SECURE=True, AUTH_COOKIE_DOMAIN='magent.grizzlyflix.co.nz',
         AUTH_COOKIE_NAME='magent_auth', AUTH_STATE_COOKIE_NAME='magent_logged_in',