One package, as many sites as you like
Each site is a separate Django project on the same machine: its own Unix account, database, service and cache prefix. The package is shared; what belongs to the site lives in a single file, the .env next to settings.py, readable by the site alone.
A site's .env
SECRET_KEY=… # never in the database, never in a repository
DOMAIN_NAME=mysite.com
JEIKO_SITE_NAME=mysite
DB_NAME=mysite
DB_USER=mysite
DB_PASS=…
JEIKO_LANGUAGE=en-us # the site's default language
JEIKO_TIMEZONE=Europe/London
JEIKO_SSL=true # HTTPS, secure cookies, HSTS
An update replaces settings.py with the new release's template: that is how a release can add an application without anyone touching the server. So it can't overwrite any of your configuration — everything that is yours lives in the .env.