# Configure environment and secrets for Next.js

## Summary  
Configure environment variables and secrets for a Next.js app on Ample. Values passed with `--env` or `--env-file` are stored encrypted and injected at runtime; the platform never prints them and ample.toml declares only variable names. The fixture proves delivery by reporting whether the secret is set without echoing it.

## Prerequisites  
- Code that reads configuration from the process environment  
- The secret values at hand for `--env` or an env file  
- An Ample account token with `servers:write`

## Workflow Steps  
1. **Declare, do not commit**  
   In ample.toml declare `SMTP_KEY = { secret = true }` style entries; never put literal secrets in the manifest.  
2. **Pass values on deploy**  
   Use `--env KEY=value` (repeatable) or `--env-file .env.production`; values are encrypted at rest and reused on redeploys.  
   ```bash  
   ample deploy . --name  --public --env CANARY_SECRET=...  
   ```  
3. **Confirm without echoing**  
   Expose a route (`/api/config`) that reports `secret=set` or `secret=missing`, never the value.  
4. **Verify**  
   Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.  
   ```bash  
   ample logs  --kind build  
   ```

## Tested Configuration  
- **Template**: node-22  
- **Runtime**: node  
- **Size**: s-1vcpu-1gb  
- **Install**: `npm install`  
- **Build**: `npm run build --if-present`  
- **Start**: `npm run start`

## Success Checks  
- App sees the configured variable without exposing it  
  - **Kind**: http_get  
  - **Path**: `/api/config`  
  - **Expect**: `secret=set`

## Limitations  
- Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.  
- Region, compliance attestations and request-duration limits are unknown and not claimed.  
- Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.  
- Plain env in the API request is rejected; only the encrypted path is supported.  
- Rotating a secret requires a redeploy with the new value.

## Cost Estimate  
- **Currency**: USD  
- **Monthly Amount**: 5.0  
- **Basis**: size prices from pricing.toml (loaded by the API) at build revision 1ac5595375130d45290090e82ed0f554ccd45405-dirty  
- **Components**:  
  - **Name**: app server  
  - **Size**: s-1vcpu-1gb  
  - **Quantity**: 1.0  
  - **Monthly Amount**: 5.0  
- **Note**: Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply.