## Configure environment and secrets for NestJS

### Summary
Configuration and secrets for a NestJS app on Ample. Verified on NestJS: an --env value delivered encrypted and reported as present without being echoed (secret=set). Build and start: npm install, nest build (TypeScript) then node dist/main.js on the node-22 template.

### Prerequisites
- A NestJS project (npm install, nest build (TypeScript) then node dist/main.js on the node-22 template)
- An Ample account token with servers:write

### Workflow Steps
1. **Build and start**  
   npm install, nest build (TypeScript) then node dist/main.js on the node-22 template; the server must bind 0.0.0.0 on PORT.

2. **Pass values on deploy**  
   Use --env KEY=value (repeatable) or --env-file; values are encrypted at rest and reused on redeploys. Declare names only in ample.toml.  
   Command: `ample deploy . --name  --public --env MY_SECRET=...`

3. **Verify**  
   Fetch the live URL and /p/configuration-secrets on the example; on failure read the build and runtime logs.  
   Command: `ample logs  --kind build`

### Success Checks
- App responds on its public URL  
  Kind: `http_get`  
  Path: `/`  
  Expect: `ample canary nestjs patterns`

- Configuration-secrets check from the example  
  Kind: `http_get`  
  Path: `/p/configuration-secrets`  
  Expect: `see the pattern fixture checks`

### Limitations
- Verified on the node-22 template at s-1vcpu-1gb; other sizes and NestJS major versions are not verified.
- Region, compliance attestations and request-duration limits are unknown and not claimed.

### Cost Estimate
- Currency: USD  
- Monthly Amount: 5.0  
- Authoritative: true  
- Basis: size prices from pricing.toml (loaded by the API) at build revision 1ac5595375130d45290090e82ed0f554ccd45405-dirty  
- Note: Always-on monthly price of the tested sizes; apps auto-pause when idle. Buckets are allocation-priced per quota and not included.

### Evidence Summary
- Kind: `canary_run`  
- Summary: NestJS pattern fixture deployed on Ample (npm install, nest build (TypeScript) then node dist/main.js on the node-22 template); for this guide: an --env value delivered encrypted and reported as present without being echoed (secret=set).  
- Observed At: `2026-09-21T02:34:39Z`  
- Expires At: `2027-03-20T02:34:39Z`

### Tested Configuration
- Template: node-22
- Runtime: node
- Size: s-1vcpu-1gb
- Install: `npm install`
- Build: `npm run build --if-present`
- Start: `npm run start`

### Input Schema
```json
{
  "additionalProperties": false,
  "properties": {
      "env": {
          "description": "Encrypted environment variables",
          "items": {
              "pattern": "^[A-Z][A-Z0-9_]*=.*$",
              "type": "string"
          },
          "maxItems": 50,
          "type": "array"
      },
      "name": {
          "description": "App name",
          "maxLength": 63,
          "minLength": 1,
          "pattern": "^[a-z0-9-]+$",
          "type": "string"
      },
      "path": {
          "description": "Project directory or ample.toml service",
          "maxLength": 512,
          "minLength": 1,
          "type": "string"
      },
      "release_command": {
          "description": "Migration command run before activation",
          "maxLength": 512,
          "type": "string"
      }
  },
  "required": ["env", "name", "path"],
  "type": "object"
}
```

### Examples
- **NestJS pattern fixture**  
  - Description: Verified configuration and secrets on NestJS.  
  - Source Ref: `tests/deploy-canaries/nestjs-patterns`