Configure Environment and Secrets for Django

Summary

Configure environment variables and secrets for a Django app on Ample. Values passed with --env or --env-file are stored encrypted and injected at runtime; the platform never prints them and ample.toml declares only variable names. The fixture proves delivery by reporting whether the secret is set without echoing it.

Prerequisites

• Code that reads configuration from the process environment
• The secret values at hand for --env or an env file
• An Ample account token with servers:write

Tested Configuration

• Template: python-3.12
• Runtime: python
• Size: s-1vcpu-1gb
• Install: python3 -m pip install --target .ample/python -r requirements.txt
• Start: PYTHONPATH=.ample/python:${PYTHONPATH:-} python3 run.py

Input Schema

• env: Encrypted environment variables as KEY=value; secret values are never stored in ample.toml
• name: App name (lowercase, digits and dashes)
• path: Project directory to deploy, or one service name from ample.toml
• size: VM size; omit to let Ample pick a runtime-safe size
• start: Start command override when detection cannot infer it

Workflow Steps

1. Declare, do not commit: In ample.toml declare SMTP_KEY = { secret = true } style entries; never put literal secrets in the manifest.
2. Pass values on deploy: Use --env KEY=value (repeatable) or --env-file .env.production; values are encrypted at rest and reused on redeploys.
3. Confirm without echoing: Expose a route (/config) that reports secret=set or secret=missing, never the value.
4. Verify: Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.

Examples

• Django Secret Probe Canary: /config reports secret=set for an --env value delivered encrypted.

Success Checks

• App sees the configured variable without exposing it

Limitations

• Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.
• Region, compliance attestations and request-duration limits are unknown and not claimed.
• Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.
• Plain env in the API request is rejected; only the encrypted path is supported.
• Rotating a secret requires a redeploy with the new value.

Cost Estimate

• Currency: USD
• Monthly Amount: 5.0
• Note: Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply.

Next Actions

• Browse the catalog index
• Search published recipes by intent, stack and constraints
• Prepare a side-effect-free deployment plan for an authorized project
• Read the existing agent authentication setup
• Browse Django
• Browse Configure deployment
• Browse Public web service