Questions d'entretien Django et Python : Top 25 en 2026

# models.py
# Le Model représente la structure des données et la logique métier
from django.db import models

class Article(models.Model):
    title = models.CharField(max_length=200)
    content = models.TextField()
    published_at = models.DateTimeField(auto_now_add=True)
    author = models.ForeignKey(
        "auth.User",
        on_delete=models.CASCADE,  # Supprime les articles si l'auteur est supprimé
        related_name="articles"     # Accès inverse : user.articles.all()
    )

    class Meta:
        ordering = ["-published_at"]  # Tri par défaut

    def __str__(self):
        return self.title

# views.py
# La View contient la logique de traitement des requêtes
from django.shortcuts import render, get_object_or_404

def article_detail(request, pk):
    # get_object_or_404 lève Http404 si l'objet n'existe pas
    article = get_object_or_404(Article, pk=pk)
    return render(request, "blog/article_detail.html", {"article": article})

# Créer un projet et une application
# django-admin startproject myproject
# python manage.py startapp blog

# settings.py
# Enregistrement des applications dans le projet
INSTALLED_APPS = [
    "django.contrib.admin",       # Interface d'administration
    "django.contrib.auth",        # Authentification
    "django.contrib.contenttypes",
    "django.contrib.sessions",
    "django.contrib.messages",
    "django.contrib.staticfiles",
    # Applications personnalisées
    "blog.apps.BlogConfig",       # Application blog
    "users.apps.UsersConfig",     # Application utilisateurs
]

# middleware.py
# Les middlewares interceptent chaque requête/réponse
class RequestTimingMiddleware:
    """Middleware qui mesure le temps de traitement."""

    def __init__(self, get_response):
        self.get_response = get_response  # Référence au middleware suivant

    def __call__(self, request):
        import time
        start = time.time()

        # Phase requête : avant la vue
        response = self.get_response(request)

        # Phase réponse : après la vue
        duration = time.time() - start
        response["X-Request-Duration"] = f"{duration:.3f}s"
        return response

# queryset_lazy.py
# Démonstration du lazy loading des QuerySets

# Aucune requête SQL n'est exécutée ici
qs = Article.objects.filter(published=True)  # Pas de requête
qs = qs.exclude(title="Draft")               # Toujours pas
qs = qs.order_by("-created_at")              # Toujours pas

# La requête SQL est exécutée UNIQUEMENT ici
for article in qs:  # UNE seule requête SQL combinée
    print(article.title)

# Autres déclencheurs d'évaluation
list(qs)        # Conversion en liste
qs[0]           # Accès par index
len(qs)         # Comptage (préférer qs.count())
bool(qs)        # Test d'existence (préférer qs.exists())

# n_plus_one.py
# Problème N+1 et solutions

# ❌ PROBLÈME : N+1 requêtes
# 1 requête pour les articles + 1 requête PAR article pour l'auteur
articles = Article.objects.all()
for article in articles:
    print(article.author.username)  # Requête SQL à chaque itération !

# ✅ SOLUTION 1 : select_related (ForeignKey, OneToOne)
# Joint les tables en UNE seule requête SQL (JOIN)
articles = Article.objects.select_related("author").all()
for article in articles:
    print(article.author.username)  # Pas de requête supplémentaire

# ✅ SOLUTION 2 : prefetch_related (ManyToMany, reverse FK)
# Exécute 2 requêtes séparées + assemblage Python
articles = Article.objects.prefetch_related("tags").all()
for article in articles:
    print(article.tags.all())  # Données déjà en cache

# ✅ SOLUTION 3 : Prefetch personnalisé avec filtre
from django.db.models import Prefetch

articles = Article.objects.prefetch_related(
    Prefetch(
        "comments",
        queryset=Comment.objects.filter(approved=True).select_related("user"),
        to_attr="approved_comments"  # Attribut personnalisé
    )
)

# managers.py
# Managers et QuerySets personnalisés

class PublishedQuerySet(models.QuerySet):
    """QuerySet réutilisable pour les articles publiés."""

    def published(self):
        return self.filter(status="published", published_at__lte=timezone.now())

    def by_author(self, user):
        return self.filter(author=user)

    def popular(self):
        return self.annotate(
            comment_count=models.Count("comments")
        ).order_by("-comment_count")


class PublishedManager(models.Manager):
    """Manager qui expose uniquement les articles publiés."""

    def get_queryset(self):
        return PublishedQuerySet(self.model, using=self._db).published()


class Article(models.Model):
    # ...
    objects = models.Manager()          # Manager par défaut (tous les articles)
    published = PublishedManager()      # Manager personnalisé (publiés uniquement)

    # Utilisation :
    # Article.objects.all()             → Tous les articles
    # Article.published.all()           → Articles publiés uniquement
    # Article.published.popular()       → Articles publiés triés par popularité

# views_comparison.py
# FBV : Explicite, simple, facile à comprendre
from django.http import JsonResponse
from django.views.decorators.http import require_http_methods

@require_http_methods(["GET", "POST"])
def article_list(request):
    if request.method == "GET":
        articles = Article.published.all()
        return render(request, "articles/list.html", {"articles": articles})

    # POST : création d'article
    form = ArticleForm(request.POST)
    if form.is_valid():
        form.save()
        return redirect("article-list")
    return render(request, "articles/list.html", {"form": form})

# views_cbv.py
# CBV : Réutilisable, extensible via mixins
from django.views.generic import ListView, CreateView
from django.contrib.auth.mixins import LoginRequiredMixin

class ArticleListView(LoginRequiredMixin, ListView):
    model = Article
    template_name = "articles/list.html"
    context_object_name = "articles"    # Nom de la variable dans le template
    paginate_by = 20                     # Pagination automatique

    def get_queryset(self):
        # Surcharge pour filtrer les articles publiés
        return Article.published.all()

class ArticleCreateView(LoginRequiredMixin, CreateView):
    model = Article
    form_class = ArticleForm
    success_url = reverse_lazy("article-list")

    def form_valid(self, form):
        form.instance.author = self.request.user  # Assigne l'auteur
        return super().form_valid(form)

# auth_middleware.py
# Middleware d'authentification personnalisé
import jwt
from django.conf import settings
from django.http import JsonResponse

class JWTAuthenticationMiddleware:
    """Vérifie le token JWT sur les endpoints protégés."""

    EXEMPT_PATHS = ["/api/auth/login", "/api/auth/register", "/health"]

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        # Ignorer les chemins exemptés
        if any(request.path.startswith(p) for p in self.EXEMPT_PATHS):
            return self.get_response(request)

        # Extraire et vérifier le token
        auth_header = request.headers.get("Authorization", "")
        if not auth_header.startswith("Bearer "):
            return JsonResponse({"error": "Token manquant"}, status=401)

        try:
            token = auth_header.split(" ")[1]
            payload = jwt.decode(token, settings.SECRET_KEY, algorithms=["HS256"])
            request.user_id = payload["user_id"]  # Attache au request
        except jwt.ExpiredSignatureError:
            return JsonResponse({"error": "Token expiré"}, status=401)
        except jwt.InvalidTokenError:
            return JsonResponse({"error": "Token invalide"}, status=401)

        return self.get_response(request)

# serializers.py
from rest_framework import serializers

# Serializer manuel : contrôle total sur chaque champ
class ArticleSerializer(serializers.Serializer):
    id = serializers.IntegerField(read_only=True)
    title = serializers.CharField(max_length=200)
    content = serializers.CharField()
    author_name = serializers.SerializerMethodField()

    def get_author_name(self, obj):
        return obj.author.get_full_name()

    def create(self, validated_data):
        return Article.objects.create(**validated_data)

    def update(self, instance, validated_data):
        instance.title = validated_data.get("title", instance.title)
        instance.content = validated_data.get("content", instance.content)
        instance.save()
        return instance


# ModelSerializer : génération automatique des champs
class ArticleModelSerializer(serializers.ModelSerializer):
    author_name = serializers.SerializerMethodField()
    comment_count = serializers.IntegerField(read_only=True)

    class Meta:
        model = Article
        fields = ["id", "title", "content", "author", "author_name",
                  "comment_count", "published_at"]
        read_only_fields = ["published_at"]

    def get_author_name(self, obj):
        return obj.author.get_full_name()

# settings.py
# Configuration globale de la pagination
REST_FRAMEWORK = {
    "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination",
    "PAGE_SIZE": 20,
}

# pagination.py
# Pagination personnalisée par vue
from rest_framework.pagination import CursorPagination, LimitOffsetPagination

class ArticleCursorPagination(CursorPagination):
    """Pagination par curseur : performante pour les grands datasets."""
    page_size = 20
    ordering = "-published_at"  # Champ indexé requis
    cursor_query_param = "cursor"

class ArticleLimitOffsetPagination(LimitOffsetPagination):
    """Pagination offset/limit : flexible mais moins performante."""
    default_limit = 20
    max_limit = 100

# views.py
class ArticleViewSet(viewsets.ModelViewSet):
    queryset = Article.published.all()
    serializer_class = ArticleModelSerializer
    pagination_class = ArticleCursorPagination  # Pagination spécifique

# permissions.py
from rest_framework.permissions import BasePermission, IsAuthenticated

class IsAuthorOrReadOnly(BasePermission):
    """Seul l'auteur peut modifier, tout le monde peut lire."""

    def has_object_permission(self, request, view, obj):
        # GET, HEAD, OPTIONS sont toujours autorisés
        if request.method in ("GET", "HEAD", "OPTIONS"):
            return True
        # Seul l'auteur peut modifier ou supprimer
        return obj.author == request.user


class IsAdminOrManager(BasePermission):
    """Accès réservé aux admins et managers."""

    def has_permission(self, request, view):
        return (
            request.user.is_authenticated
            and request.user.role in ("admin", "manager")
        )


# views.py
from rest_framework.viewsets import ModelViewSet
from rest_framework.throttling import UserRateThrottle

class ArticleViewSet(ModelViewSet):
    permission_classes = [IsAuthenticated, IsAuthorOrReadOnly]
    throttle_classes = [UserRateThrottle]  # Rate limiting

    def get_permissions(self):
        # Permissions dynamiques selon l'action
        if self.action == "destroy":
            return [IsAdminOrManager()]
        return super().get_permissions()

# signals.py
from django.db.models.signals import post_save, pre_delete
from django.dispatch import receiver
from django.core.mail import send_mail

@receiver(post_save, sender=Article)
def notify_on_publish(sender, instance, created, **kwargs):
    """Envoie une notification quand un article est publié."""
    if not created and instance.status == "published":
        # Déclenché uniquement lors de la publication (pas la création)
        subscribers = instance.author.subscribers.values_list("email", flat=True)
        send_mail(
            subject=f"Nouvel article : {instance.title}",
            message=f"Découvrez le dernier article de {instance.author.username}",
            from_email="noreply@example.com",
            recipient_list=list(subscribers),
        )

@receiver(pre_delete, sender=Article)
def cleanup_article_files(sender, instance, **kwargs):
    """Supprime les fichiers associés avant la suppression de l'article."""
    if instance.cover_image:
        instance.cover_image.delete(save=False)  # Supprime le fichier physique

# celery_config.py
# Configuration Celery dans le projet Django
import os
from celery import Celery

os.environ.setdefault("DJANGO_SETTINGS_MODULE", "myproject.settings")

app = Celery("myproject")
app.config_from_object("django.conf:settings", namespace="CELERY")
app.autodiscover_tasks()  # Découvre les tasks.py dans chaque app

# tasks.py
from celery import shared_task
from django.core.mail import send_mass_mail

@shared_task(bind=True, max_retries=3, default_retry_delay=60)
def send_newsletter(self, article_id):
    """Envoie la newsletter de manière asynchrone."""
    try:
        article = Article.objects.get(id=article_id)
        subscribers = User.objects.filter(newsletter=True)

        messages = [
            (f"Nouveau : {article.title}", article.content[:200],
             "noreply@example.com", [sub.email])
            for sub in subscribers
        ]
        send_mass_mail(messages, fail_silently=False)
    except Article.DoesNotExist:
        pass  # L'article a été supprimé entre-temps
    except Exception as exc:
        self.retry(exc=exc)  # Retry automatique en cas d'erreur

# Appel depuis une vue
# send_newsletter.delay(article.id)  # Exécution asynchrone
# send_newsletter.apply_async(args=[article.id], countdown=300)  # Délai de 5 min

# Protection CSRF dans les formulaires
# Le template tag {% csrf_token %} génère un champ hidden

# Pour les API (DRF), CSRF est souvent désactivé en faveur de tokens
# settings.py
REST_FRAMEWORK = {
    "DEFAULT_AUTHENTICATION_CLASSES": [
        "rest_framework.authentication.SessionAuthentication",  # Inclut CSRF
        "rest_framework.authentication.TokenAuthentication",     # Pas de CSRF
    ],
}

# Pour les vues AJAX avec session auth
# Le cookie csrftoken doit être envoyé dans le header X-CSRFToken

# csrf_exemption.py
# Exempter une vue spécifique (avec précaution)
from django.views.decorators.csrf import csrf_exempt, ensure_csrf_cookie

@ensure_csrf_cookie
def get_csrf_token(request):
    """Endpoint qui force l'envoi du cookie CSRF au client."""
    return JsonResponse({"detail": "CSRF cookie set"})

@csrf_exempt  # ⚠️ À utiliser uniquement pour les webhooks externes
def stripe_webhook(request):
    """Webhook Stripe - authentifié par signature, pas par CSRF."""
    payload = request.body
    sig_header = request.headers.get("Stripe-Signature")
    # Vérification par signature Stripe à la place

# models.py
from django.contrib.auth.models import AbstractBaseUser, BaseUserManager, PermissionsMixin

class CustomUserManager(BaseUserManager):
    """Manager pour le modèle User personnalisé."""

    def create_user(self, email, password=None, **extra_fields):
        if not email:
            raise ValueError("L'email est obligatoire")
        email = self.normalize_email(email)  # Normalise le domaine
        user = self.model(email=email, **extra_fields)
        user.set_password(password)  # Hash le mot de passe
        user.save(using=self._db)
        return user

    def create_superuser(self, email, password=None, **extra_fields):
        extra_fields.setdefault("is_staff", True)
        extra_fields.setdefault("is_superuser", True)
        return self.create_user(email, password, **extra_fields)


class CustomUser(AbstractBaseUser, PermissionsMixin):
    email = models.EmailField(unique=True)          # Login par email
    username = models.CharField(max_length=30, blank=True)
    is_active = models.BooleanField(default=True)
    is_staff = models.BooleanField(default=False)
    date_joined = models.DateTimeField(auto_now_add=True)

    objects = CustomUserManager()

    USERNAME_FIELD = "email"      # Champ utilisé pour le login
    REQUIRED_FIELDS = []          # Champs requis en plus de USERNAME_FIELD

# settings.py
AUTH_USER_MODEL = "users.CustomUser"  # Avant la première migration !

# query_optimization.py
from django.db.models import F, Q, Count, Avg, Prefetch

# 1. Only/Defer : charger uniquement les champs nécessaires
articles = Article.objects.only("title", "published_at")  # SELECT title, published_at
heavy_articles = Article.objects.defer("content")          # Tout SAUF content

# 2. Agrégations au niveau SQL (pas Python)
stats = Article.objects.aggregate(
    total=Count("id"),
    avg_views=Avg("view_count"),
)

# 3. F() expressions : opérations au niveau SQL
Article.objects.filter(published=True).update(
    view_count=F("view_count") + 1  # Incrémentation atomique en SQL
)

# 4. Q() objects : requêtes complexes
results = Article.objects.filter(
    Q(title__icontains="django") | Q(tags__name="python"),
    ~Q(status="draft"),  # NOT draft
    published_at__year=2026
)

# 5. Bulk operations : réduire les requêtes INSERT/UPDATE
articles = [Article(title=f"Article {i}") for i in range(100)]
Article.objects.bulk_create(articles, batch_size=50)  # 2 requêtes au lieu de 100

Article.objects.filter(status="draft").update(status="archived")  # 1 requête

# settings.py
CACHES = {
    "default": {
        "BACKEND": "django.core.cache.backends.redis.RedisCache",
        "LOCATION": "redis://127.0.0.1:6379/1",
    }
}

# cache_strategies.py
from django.core.cache import cache
from django.views.decorators.cache import cache_page
from django.utils.decorators import method_decorator

# Cache par vue : met en cache la réponse HTTP entière
@cache_page(60 * 15)  # 15 minutes
def article_list(request):
    return render(request, "articles/list.html", {"articles": Article.published.all()})

# Cache de données : contrôle granulaire
def get_popular_articles():
    cache_key = "popular_articles_v1"
    articles = cache.get(cache_key)

    if articles is None:
        articles = list(
            Article.published.popular()[:10].values("id", "title", "view_count")
        )
        cache.set(cache_key, articles, timeout=60 * 30)  # 30 min

    return articles

# Invalidation du cache
def invalidate_article_cache(article_id):
    cache.delete(f"article_{article_id}")
    cache.delete("popular_articles_v1")
    cache.delete_pattern("article_list_*")  # Avec django-redis

# 0005_migrate_data.py
# Migration de données personnalisée
from django.db import migrations

def migrate_user_roles(apps, schema_editor):
    """Convertit les booléens is_admin en rôles textuels."""
    User = apps.get_model("users", "CustomUser")
    # Utiliser apps.get_model() pour accéder au modèle historique
    User.objects.filter(is_admin=True).update(role="admin")
    User.objects.filter(is_admin=False, is_staff=True).update(role="manager")
    User.objects.filter(is_admin=False, is_staff=False).update(role="user")

def reverse_migrate(apps, schema_editor):
    """Migration inverse pour le rollback."""
    User = apps.get_model("users", "CustomUser")
    User.objects.filter(role="admin").update(is_admin=True)

class Migration(migrations.Migration):
    dependencies = [
        ("users", "0004_add_role_field"),
    ]

    operations = [
        migrations.RunPython(migrate_user_roles, reverse_migrate),
    ]

# models.py
class Article(models.Model):
    title = models.CharField(max_length=200)
    slug = models.SlugField(unique=True)
    status = models.CharField(max_length=20, db_index=True)  # Index simple
    published_at = models.DateTimeField(null=True)
    author = models.ForeignKey("auth.User", on_delete=models.CASCADE)

    class Meta:
        indexes = [
            # Index composé pour les requêtes fréquentes
            models.Index(fields=["status", "-published_at"], name="idx_status_date"),
            # Index partiel : uniquement les articles publiés
            models.Index(
                fields=["published_at"],
                condition=models.Q(status="published"),
                name="idx_published_articles"
            ),
            # Index GIN pour la recherche full-text (PostgreSQL)
            GinIndex(fields=["search_vector"], name="idx_search"),
        ]

# tests/test_views.py
from django.test import TestCase, Client
from django.urls import reverse
from rest_framework.test import APITestCase, APIClient

class ArticleViewTests(TestCase):
    """Tests des vues avec le client Django."""

    def setUp(self):
        self.client = Client()
        self.user = CustomUser.objects.create_user(
            email="test@example.com", password="testpass123"
        )
        self.article = Article.objects.create(
            title="Test Article",
            content="Content here",
            author=self.user,
            status="published"
        )

    def test_article_list_returns_200(self):
        response = self.client.get(reverse("article-list"))
        self.assertEqual(response.status_code, 200)
        self.assertContains(response, "Test Article")

    def test_create_article_requires_auth(self):
        response = self.client.post(reverse("article-create"), {"title": "New"})
        self.assertEqual(response.status_code, 302)  # Redirige vers login


class ArticleAPITests(APITestCase):
    """Tests de l'API REST avec DRF."""

    def setUp(self):
        self.user = CustomUser.objects.create_user(
            email="api@example.com", password="testpass123"
        )
        self.client = APIClient()
        self.client.force_authenticate(user=self.user)

    def test_create_article_via_api(self):
        data = {"title": "API Article", "content": "Created via API"}
        response = self.client.post("/api/articles/", data, format="json")
        self.assertEqual(response.status_code, 201)
        self.assertEqual(Article.objects.count(), 1)

# factories.py
import factory
from factory.django import DjangoModelFactory

class UserFactory(DjangoModelFactory):
    class Meta:
        model = CustomUser

    email = factory.Sequence(lambda n: f"user{n}@example.com")
    username = factory.Faker("user_name")
    is_active = True

class ArticleFactory(DjangoModelFactory):
    class Meta:
        model = Article

    title = factory.Faker("sentence", nb_words=5)
    content = factory.Faker("paragraphs", nb=3)
    author = factory.SubFactory(UserFactory)  # Crée un user automatiquement
    status = "published"

    class Params:
        draft = factory.Trait(status="draft", published_at=None)

# tests.py
def test_published_articles_count(self):
    ArticleFactory.create_batch(5)              # 5 articles publiés
    ArticleFactory.create_batch(3, draft=True)  # 3 brouillons
    self.assertEqual(Article.published.count(), 5)

# consumers.py
import json
from channels.generic.websocket import AsyncWebsocketConsumer

class ChatConsumer(AsyncWebsocketConsumer):
    """Consumer WebSocket pour un chat en temps réel."""

    async def connect(self):
        self.room_name = self.scope["url_route"]["kwargs"]["room_name"]
        self.room_group = f"chat_{self.room_name}"

        # Rejoindre le groupe de la room
        await self.channel_layer.group_add(self.room_group, self.channel_name)
        await self.accept()

    async def disconnect(self, close_code):
        # Quitter le groupe
        await self.channel_layer.group_discard(self.room_group, self.channel_name)

    async def receive(self, text_data):
        data = json.loads(text_data)
        # Diffuser le message à tout le groupe
        await self.channel_layer.group_send(
            self.room_group,
            {"type": "chat.message", "message": data["message"],
             "username": self.scope["user"].username}
        )

    async def chat_message(self, event):
        # Envoie le message au client WebSocket
        await self.send(text_data=json.dumps({
            "message": event["message"],
            "username": event["username"],
        }))

# services/article_service.py
from django.db import transaction

class ArticleService:
    """Service encapsulant la logique métier des articles."""

    @staticmethod
    def publish_article(article_id: int, user) -> Article:
        """Publie un article avec toutes les vérifications."""
        article = Article.objects.select_for_update().get(id=article_id)

        if article.author != user:
            raise PermissionError("Seul l'auteur peut publier cet article")
        if article.status == "published":
            raise ValueError("L'article est déjà publié")

        article.status = "published"
        article.published_at = timezone.now()
        article.save(update_fields=["status", "published_at"])

        # Effets de bord : notification, cache, analytics
        send_newsletter.delay(article.id)
        cache.delete("popular_articles_v1")

        return article

    @staticmethod
    @transaction.atomic
    def bulk_archive(article_ids: list[int], user) -> int:
        """Archive plusieurs articles dans une transaction."""
        updated = Article.objects.filter(
            id__in=article_ids,
            author=user,
            status="published"
        ).update(status="archived", archived_at=timezone.now())
        return updated

# settings/base.py
# Configuration partagée entre tous les environnements
import os
from pathlib import Path
from dotenv import load_dotenv

load_dotenv()  # Charge le fichier .env

BASE_DIR = Path(__file__).resolve().parent.parent.parent

SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]  # Obligatoire, pas de valeur par défaut
DEBUG = os.environ.get("DEBUG", "False").lower() == "true"
ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "").split(",")

DATABASES = {
    "default": {
        "ENGINE": "django.db.backends.postgresql",
        "NAME": os.environ.get("DB_NAME", "myapp"),
        "USER": os.environ.get("DB_USER", "postgres"),
        "HOST": os.environ.get("DB_HOST", "localhost"),
        "PORT": os.environ.get("DB_PORT", "5432"),
    }
}

# settings/production.py
from .base import *

DEBUG = False
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_HSTS_SECONDS = 31536000  # 1 an

# Checklist de déploiement Django

# 1. Vérification avec la commande built-in
# python manage.py check --deploy

# 2. Configuration WSGI/ASGI pour la production
# gunicorn.conf.py
import multiprocessing

bind = "0.0.0.0:8000"
workers = multiprocessing.cpu_count() * 2 + 1  # Formule recommandée
worker_class = "gthread"           # Workers avec threads
threads = 4
max_requests = 1000                # Recycler les workers pour éviter les fuites mémoire
max_requests_jitter = 50
timeout = 30
accesslog = "-"                    # Logs sur stdout
errorlog = "-"

# docker-compose.yml (configuration typique)
# Services : web (gunicorn), db (postgres), redis (cache/celery), worker (celery)

# 3. Fichiers statiques
# python manage.py collectstatic --noinput
# Servir via nginx ou un CDN (WhiteNoise pour les cas simples)

# 4. Configuration nginx
# - Proxy vers gunicorn sur le port 8000
# - Servir /static/ et /media/ directement
# - Activer gzip, HTTP/2, et les en-têtes de sécurité