# Configure Environment and Secrets for Fastify

## Summary
Configure environment variables and secrets for a Fastify app on Ample. Values passed with `--env` or `--env-file` are stored encrypted and injected at runtime; the platform never prints them and `ample.toml` declares only variable names. The fixture proves delivery by reporting whether the secret is set without echoing it.

## Prerequisites
- Code that reads configuration from the process environment
- The secret values at hand for `--env` or an env file
- An Ample account token with `servers:write`

## Workflow Steps
1. **Declare, do not commit**  
   In `ample.toml` declare `SMTP_KEY = { secret = true }` style entries; never put literal secrets in the manifest.
2. **Pass values on deploy**  
   Use `--env KEY=value` (repeatable) or `--env-file .env.production`; values are encrypted at rest and reused on redeploys.
   ```bash
   ample deploy . --name <app-name> --public --env CANARY_SECRET=...
   ```
3. **Confirm without echoing**  
   Expose a route (`/config`) that reports `secret=set` or `secret=missing`, never the value.
4. **Verify**  
   Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.
   ```bash
   ample logs  --kind build
   ```

## Tested Configuration
- **Template**: node-22
- **Runtime**: node
- **Size**: s-1vcpu-1gb
- **Install**: `npm install`
- **Build**: `npm run build --if-present`
- **Start**: `npm run start`

## Input Schema
### Properties
- **env**: Encrypted environment variables as KEY=value; secret values are never stored in `ample.toml`.
- **name**: App name (lowercase, digits and dashes)
- **path**: Project directory to deploy, or one service name from `ample.toml`
- **size**: VM size; omit to let Ample pick a runtime-safe size
- **start**: Start command override when detection cannot infer it

### Required Fields
- env
- name
- path

## Success Checks
- App sees the configured variable without exposing it
  - **Kind**: http_get
  - **Path**: /config
  - **Expect**: secret=set

## Limitations
- Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.
- Region, compliance attestations and request-duration limits are unknown and not claimed.
- Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.
- Plain env in the API request is rejected; only the encrypted path is supported.
- Rotating a secret requires a redeploy with the new value.

## Cost Estimate
- **Currency**: USD
- **Monthly Amount**: 5.0
- **Basis**: size prices from `pricing.toml` (loaded by the API)
- **Components**: 
  - App server: size s-1vcpu-1gb, quantity 1.0, monthly amount 5.0

## Evidence Summary
- **Kind**: canary_run
- **Summary**: Fastify REST API using pg with no DATABASE_URL supplied: Ample auto-provisioned a managed PostgreSQL 16 database and /items reported postgres=ok after a real insert and count.
- **Observed At**: 2026-09-20T01:42:25Z
- **Expires At**: 2027-03-19T01:42:25Z

## Next Actions
- **Browse the catalog index**: GET /v1/catalog
- **Search published recipes by intent, stack and constraints**: POST /v1/catalog/search - Body: {"limit":5,"query":"Configure environment and secrets for Fastify"}
- **Prepare a side-effect-free deployment plan for an authorized project**: POST /v1/catalog/plan - Body: {"inputs":{},"projectId":"","recipeId":"page:guides:fastify:configuration-secrets","recipeRevision":"r1"}
- **Read the existing agent authentication setup**: GET /mcp/setup
- **Browse Fastify**: GET /v1/catalog/nodes/stack%3Aframework-fastify
- **Browse Configure deployment**: GET /v1/catalog/nodes/intent%3Aconfigure-deployment
- **Browse Public web service**: GET /v1/catalog/nodes/pattern%3Apublic-web-service