# Configure Environment and Secrets for Flask

## Summary
Configure environment variables and secrets for a Flask app on Ample. Values passed with `--env` or `--env-file` are stored encrypted and injected at runtime; the platform never prints them and `ample.toml` declares only variable names. The fixture proves delivery by reporting whether the secret is set without echoing it.

## Prerequisites
- Code that reads configuration from the process environment
- The secret values at hand for `--env` or an env file
- An Ample account token with `servers:write`

## Tested Configuration
- **Template**: python-3.12  
- **Runtime**: python  
- **Size**: s-1vcpu-1gb  
- **Install**: `python3 -m pip install --target .ample/python -r requirements.txt`  
- **Start**: `PYTHONPATH=.ample/python:${PYTHONPATH:-} python3 app.py`

## Workflow Steps
1. **Declare, do not commit**: In `ample.toml` declare `SMTP_KEY = { secret = true }` style entries; never put literal secrets in the manifest.
2. **Pass values on deploy**: Use `--env KEY=value` (repeatable) or `--env-file .env.production`; values are encrypted at rest and reused on redeploys.  
   Command: `ample deploy . --name  --public --start "python3 app.py" --env CANARY_SECRET=...`
3. **Confirm without echoing**: Expose a route (`/config`) that reports `secret=set` or `secret=missing`, never the value.
4. **Verify**: Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.  
   Command: `ample logs  --kind build`

## Examples
- **Flask secret probe canary**: `/config` reports `secret=set` for an `--env` value delivered encrypted.

## Success Checks
- The app sees the configured variable without exposing it.  
  - **Kind**: http_get  
  - **Path**: `/config`  
  - **Expect**: `secret=set`

## Limitations
- Verified on the `node-22` template at `s-1vcpu-1gb`; other templates and sizes are not verified by this recipe.  
- Region, compliance attestations and request-duration limits are unknown and not claimed.  
- Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.  
- Plain `env` in the API request is rejected; only the encrypted path is supported.  
- Rotating a secret requires a redeploy with the new value.

## Cost Estimate
- **Currency**: USD  
- **Monthly Amount**: 5.0  
- **Note**: Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply.

## Evidence Summary
- **Kind**: canary_run  
  - **Summary**: Flask app (waitress) using psycopg with an auto-provisioned managed PostgreSQL database: `/items` reported `postgres=ok` and `/config` confirmed the encrypted secret.

## Next Actions
- **Browse the catalog index**: Browse available catalog items.
- **Search published recipes by intent, stack and constraints**: Enter search parameters to find specific recipes.
- **Prepare a side-effect-free deployment plan for an authorized project**: Plan deployments with no side effects.
- **Read the existing agent authentication setup**: Review current authentication settings.
- **Browse Flask**: Explore available resources about Flask integration.  
- **Browse Configure deployment**: View options related to deployment configuration.  
- **Browse Public web service**: Investigate public web service options.