Start here. This is the direct spoken answer to practice first.
Overview
Settings should make differences explicit while keeping one understandable configuration model.
I keep shared defaults in code and load environment-specific values such as secret keys, database URLs, allowed hosts, and service credentials from deployment configuration. The application should fail clearly at startup when a required value is missing or malformed. Development convenience settings must not silently become production defaults, and secrets should never be committed to the repository.