Better production defaults in the generated settings

[treagod]

I noticed that the default :production settings in a freshly generated Marten project are basically just host/port. That’s nice for “it boots”, but it also makes it easy to ship a first production deploy with a couple of risky / suboptimal defaults still in place (or missing entirely).

What I’d like to propose is adding a small, opinionated production baseline to the generator template:

• Load secret_key from ENV (and fail fast if it’s missing)
• Require allowed_hosts (also from ENV, comma-separated)
• Ensure debug = false (just in case it was set in the base config)
• Set sensible secure defaults for sessions + CSRF cookies (secure + httpOnly + same-site)
• Enable template caching

And then optionally include a few commented “production hints” (so we don’t force anything, but we guide people):

• proxy headers (use_x_forwarded_*) for common setups behind Caddy/Nginx
• HTTPS redirect / HSTS / CSP (only if the corresponding middlewares are used)

Rough sketch:

Marten.configure :production do |config|
  config.debug = false

  config.secret_key = ENV["MARTEN_SECRET_KEY"]
  config.allowed_hosts = ENV["MARTEN_ALLOWED_HOSTS"].split(',').map(&.strip).reject(&.empty?)

  config.sessions.cookie_secure = true
  config.sessions.cookie_http_only = true

  config.csrf.cookie_secure = true
  config.csrf.cookie_http_only = true

  config.templates.cached = true
end

If this direction makes sense, I’m happy to open a PR that updates the generator settings template with these production overrides + commented hints.

[ellmetha]

Makes sense! I think that having these defaults in the generated production.cr won't hurt anyone.