diff --git a/server/requirements.txt b/server/requirements.txt
index 200af56..8bc90a5 100644
--- a/server/requirements.txt
+++ b/server/requirements.txt
@@ -2,3 +2,4 @@ Django==4.0.3
 djangorestframework==3.13.1
 django-cors-headers==3.11.0
 djangorestframework-camel-case==1.3.0
+getconf~=1.11.1
diff --git a/server/ulm_cine_club_api/settings.py b/server/ulm_cine_club_api/settings/base.py
similarity index 72%
rename from server/ulm_cine_club_api/settings.py
rename to server/ulm_cine_club_api/settings/base.py
index f000e8e..3aade8a 100644
--- a/server/ulm_cine_club_api/settings.py
+++ b/server/ulm_cine_club_api/settings/base.py
@@ -1,7 +1,7 @@
 """
-Django settings for ulm_cine_club_api project.
+Django settings for open_democracy_back project.
 
-Generated by 'django-admin startproject' using Django 3.2.12.
+Generated by 'django-admin startproject' using Django 3.2.11.
 
 For more information on this file, see
 https://docs.djangoproject.com/en/3.2/topics/settings/
@@ -9,24 +9,21 @@ https://docs.djangoproject.com/en/3.2/topics/settings/
 For the full list of settings and their values, see
 https://docs.djangoproject.com/en/3.2/ref/settings/
 """
-
+import getconf
 from pathlib import Path
 
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
 
+config = getconf.ConfigGetter(
+    "cineClub",
+    ["./local_settings.ini"],
+)
+
 
 # Quick-start development settings - unsuitable for production
 # See https://docs.djangoproject.com/en/3.2/howto/deployment/checklist/
 
-# SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = "django-insecure-)3^d_7xfyv3#+oz#8rj9tym2=g*n!+-sp#_v!t&h+i0y+gv(8u"
-
-# SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
-
-ALLOWED_HOSTS = []
-
 
 # Application definition
 
@@ -39,12 +36,14 @@ INSTALLED_APPS = [
     "django.contrib.staticfiles",
     "myapi.apps.MyapiConfig",
     "rest_framework",
+    "corsheaders",
 ]
 
 MIDDLEWARE = [
     "django.middleware.security.SecurityMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",
     "django.middleware.common.CommonMiddleware",
+    "corsheaders.middleware.CorsMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.contrib.auth.middleware.AuthenticationMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
@@ -71,18 +70,6 @@ TEMPLATES = [
 
 WSGI_APPLICATION = "ulm_cine_club_api.wsgi.application"
 
-
-# Database
-# https://docs.djangoproject.com/en/3.2/ref/settings/#databases
-
-DATABASES = {
-    "default": {
-        "ENGINE": "django.db.backends.sqlite3",
-        "NAME": BASE_DIR / "db.sqlite3",
-    }
-}
-
-
 # Password validation
 # https://docs.djangoproject.com/en/3.2/ref/settings/#auth-password-validators
 
@@ -105,7 +92,7 @@ AUTH_PASSWORD_VALIDATORS = [
 # Internationalization
 # https://docs.djangoproject.com/en/3.2/topics/i18n/
 
-LANGUAGE_CODE = "fr-fr"
+LANGUAGE_CODE = "fr"
 
 TIME_ZONE = "UTC"
 
@@ -115,19 +102,21 @@ USE_L10N = True
 
 USE_TZ = True
 
+# ManifestStaticFilesStorage is recommended in production, to prevent outdated
+# JavaScript / CSS assets being served from cache (e.g. after a Wagtail upgrade).
+# See https://docs.djangoproject.com/en/3.2/ref/contrib/staticfiles/#manifeststaticfilesstorage
+STATICFILES_STORAGE = "django.contrib.staticfiles.storage.ManifestStaticFilesStorage"
 
-# Static files (CSS, JavaScript, Images)
-# https://docs.djangoproject.com/en/3.2/howto/static-files/
-
+STATIC_ROOT = BASE_DIR / "static"
 STATIC_URL = "/static/"
 
-# Default primary key field type
-# https://docs.djangoproject.com/en/3.2/ref/settings/#default-auto-field
+MEDIA_ROOT = BASE_DIR / "media"
+MEDIA_URL = "/media/"
 
 DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
 
-
 REST_FRAMEWORK = {
+    "DEFAULT_PERMISSION_CLASSES": ("rest_framework.permissions.AllowAny",),
     "DEFAULT_RENDERER_CLASSES": (
         "djangorestframework_camel_case.render.CamelCaseJSONRenderer",
         "djangorestframework_camel_case.render.CamelCaseBrowsableAPIRenderer",
@@ -138,14 +127,3 @@ REST_FRAMEWORK = {
         "djangorestframework_camel_case.parser.CamelCaseJSONParser",
     ),
 }
-
-BASE_URL = "http://localhost:8000/"
-
-FRONT_END_URL = "http://localhost:3000"
-SESSION_COOKIE_SAMESITE = None
-CORS_ALLOWED_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:3000"]
-CORS_ALLOW_CREDENTIALS = True
-
-CORS_ORIGIN_WHITELIST = ("http://localhost:3000",)
-
-CSRF_TRUSTED_ORIGINS = ["http://localhost:3000"]
diff --git a/server/ulm_cine_club_api/settings/dev.py b/server/ulm_cine_club_api/settings/dev.py
new file mode 100644
index 0000000..1b89840
--- /dev/null
+++ b/server/ulm_cine_club_api/settings/dev.py
@@ -0,0 +1,32 @@
+from .base import *  # noqa: F401,F403
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = True
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = "django-insecure-)3^d_7xfyv3#+oz#8rj9tym2=g*n!+-sp#_v!t&h+i0y+gv(8u"
+
+BASE_URL = "http://localhost:8000/"
+
+FRONT_END_URL = "http://localhost:3000"
+SESSION_COOKIE_SAMESITE = None
+CORS_ALLOWED_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:3000"]
+CORS_ALLOW_CREDENTIALS = True
+
+CORS_ORIGIN_WHITELIST = ("http://localhost:3000",)
+
+CSRF_TRUSTED_ORIGINS = ["http://localhost:3000"]
+
+
+EMAIL_BACKEND = "django.core.mail.backends.console.EmailBackend"
+DEFAULT_FROM_EMAIL = "cineclub-contact@ens.fr"
+
+# Database
+# https://docs.djangoproject.com/en/3.2/ref/settings/#databases
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": BASE_DIR.parent / "db.sqlite3",
+    }
+}
diff --git a/server/ulm_cine_club_api/settings/production.py b/server/ulm_cine_club_api/settings/production.py
new file mode 100644
index 0000000..ad9fea8
--- /dev/null
+++ b/server/ulm_cine_club_api/settings/production.py
@@ -0,0 +1,17 @@
+from .base import *
+
+DEBUG = False
+
+SECRET_KEY = config.getstr("security.secret_key")
+ALLOWED_HOSTS = config.getlist("security.allowed_hosts")
+STATIC_ROOT = config.getstr("staticfiles.static_root")
+# TODO configure media ?
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.postgresql",
+        "NAME": config.getstr("database.name"),
+        "USER": config.getstr("database.user"),
+        "password": config.getstr("database.password"),
+    }
+}