# Configure Environment and Secrets for Django

## Summary
Configure environment variables and secrets for a Django app on Ample. Values passed with `--env` or `--env-file` are stored encrypted and injected at runtime; the platform never prints them and `ample.toml` declares only variable names. The fixture proves delivery by reporting whether the secret is set without echoing it.

## Prerequisites
- Code that reads configuration from the process environment
- The secret values at hand for `--env` or an env file
- An Ample account token with `servers:write`

## Tested Configuration
- **Template:** python-3.12
- **Runtime:** python
- **Size:** s-1vcpu-1gb
- **Install:** `python3 -m pip install --target .ample/python -r requirements.txt`
- **Start:** `PYTHONPATH=.ample/python:${PYTHONPATH:-} python3 run.py`

## Input Schema
- **env:** Encrypted environment variables as KEY=value; secret values are never stored in ample.toml
- **name:** App name (lowercase, digits and dashes)
- **path:** Project directory to deploy, or one service name from ample.toml
- **size:** VM size; omit to let Ample pick a runtime-safe size
- **start:** Start command override when detection cannot infer it

## Workflow Steps
1. **Declare, do not commit**: In `ample.toml` declare `SMTP_KEY = { secret = true }` style entries; never put literal secrets in the manifest.
2. **Pass values on deploy**: Use `--env KEY=value` (repeatable) or `--env-file .env.production`; values are encrypted at rest and reused on redeploys.
3. **Confirm without echoing**: Expose a route (`/config`) that reports `secret=set` or `secret=missing`, never the value.
4. **Verify**: Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.

## Examples
- **Django Secret Probe Canary**: `/config reports secret=set for an --env value delivered encrypted.`

## Success Checks
- App sees the configured variable without exposing it

## Limitations
- Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.
- Region, compliance attestations and request-duration limits are unknown and not claimed.
- Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.
- Plain env in the API request is rejected; only the encrypted path is supported.
- Rotating a secret requires a redeploy with the new value.

## Cost Estimate
- **Currency**: USD
- **Monthly Amount**: 5.0
- **Note**: Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply.

## Next Actions
- **Browse the catalog index**
- **Search published recipes by intent, stack and constraints**
- **Prepare a side-effect-free deployment plan for an authorized project**
- **Read the existing agent authentication setup**
- **Browse Django**
- **Browse Configure deployment**
- **Browse Public web service**