Configure Environment and Secrets for Flask

Summary

Configure environment variables and secrets for a Flask app on Ample. Values passed with --env or --env-file are stored encrypted and injected at runtime; the platform never prints them and ample.toml declares only variable names. The fixture proves delivery by reporting whether the secret is set without echoing it.

Prerequisites

• Code that reads configuration from the process environment
• The secret values at hand for --env or an env file
• An Ample account token with servers:write

Tested Configuration

• Template: python-3.12
• Runtime: python
• Size: s-1vcpu-1gb
• Install: python3 -m pip install --target .ample/python -r requirements.txt
• Start: PYTHONPATH=.ample/python:${PYTHONPATH:-} python3 app.py

Workflow Steps

1. Declare, do not commit: In ample.toml declare SMTP_KEY = { secret = true } style entries; never put literal secrets in the manifest.
2. Pass values on deploy: Use --env KEY=value (repeatable) or --env-file .env.production; values are encrypted at rest and reused on redeploys.
   Command: ample deploy . --name --public --start "python3 app.py" --env CANARY_SECRET=...
3. Confirm without echoing: Expose a route (/config) that reports secret=set or secret=missing, never the value.
4. Verify: Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.
   Command: ample logs --kind build

Examples

• Flask secret probe canary: /config reports secret=set for an --env value delivered encrypted.

Success Checks

• The app sees the configured variable without exposing it.
  • Kind: http_get
  • Path: /config
  • Expect: secret=set

Limitations

• Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.
• Region, compliance attestations and request-duration limits are unknown and not claimed.
• Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.
• Plain env in the API request is rejected; only the encrypted path is supported.
• Rotating a secret requires a redeploy with the new value.

Cost Estimate

• Currency: USD
• Monthly Amount: 5.0
• Note: Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply.

Evidence Summary

• Kind: canary_run
  • Summary: Flask app (waitress) using psycopg with an auto-provisioned managed PostgreSQL database: /items reported postgres=ok and /config confirmed the encrypted secret.

Next Actions

• Browse the catalog index: Browse available catalog items.
• Search published recipes by intent, stack and constraints: Enter search parameters to find specific recipes.
• Prepare a side-effect-free deployment plan for an authorized project: Plan deployments with no side effects.
• Read the existing agent authentication setup: Review current authentication settings.
• Browse Flask: Explore available resources about Flask integration.
• Browse Configure deployment: View options related to deployment configuration.
• Browse Public web service: Investigate public web service options.