page:recipes:partner portal:django:public profiles

Host partner portal with Django: public profile assets

Deploy a partner portal built with Django on Ample using the public image delivery pattern. Compute runs the app in an isolated microVM behind a public HTTPS URL, a managed PostgreSQL 16 database is auto-provisioned and injected as DATABASE_URL, a private S3-compatible bucket holds objects with credentials delivered as encrypted environment variables, and a published bucket serves public assets from the CDN host. Verified on Django: public objects in a published bucket served from the CDN URL, kept separate from private objects in an unpublished bucket that require authorization (private=ok only for the allowed role). Not separately tested: your image processing and profile-media rules; treat the partner portal-specific behavior as your application code.

Representative Queries

Resource Requirements

Infrastructure Requirements

  1. Compute
    Apps run in isolated x86_64 Firecracker microVMs that auto-pause when idle and wake on request; sizes are the priced VM sizes.
  2. Postgres
    Managed PostgreSQL 16 runs in its own microVM and is auto-provisioned when an app needs a database and no DATABASE_URL is supplied.
  3. S3-compatible object storage
    Buckets are S3-compatible with issued credentials; PutObject and GetObject are verified by canary. Other S3 operations are not verified.
  4. CDN
    The CDN host serves objects from published buckets. It does not front app compute and is not a cache or key-value store.

Prerequisites

Tested Configuration

Workflow Steps

  1. Build and start
    pip install into .ample/python from requirements.txt, then waitress serving project.wsgi from run.py reading PORT on the python-3.12 template. The server must bind 0.0.0.0 on PORT.
  2. Implement the pattern on PostgreSQL
    The fixture's module implements public image delivery: public objects in a published bucket served from the CDN URL, kept separate from private objects in an unpublished bucket that require authorization (private=ok only for the allowed role). Copy the approach into your schema; keep migrations idempotent and run them with --release-command.
  3. Wire object storage
    Create the bucket(s), then pass endpoint, region, bucket and keys as --env values. Use path-style addressing. Keep private data in an unpublished bucket. Publish only the bucket that serves public assets and reference its CDN URL.
  4. Deploy
    Run the synchronous deploy once and read the result (exit 0 live, 1 failed, 2 blocked). Re-running with no change is a no-op.
    ample deploy . --name  --public --start "python3 run.py" --env S3_ENDPOINT=... --env S3_REGION=... --env S3_BUCKET=... --env S3_ACCESS_KEY_ID=... --env S3_SECRET_ACCESS_KEY=... --env CDN_PUBLIC_URL=...
  5. Verify
    Fetch the live URL and the pattern self-test route(s) (/p/public-media-library, /p/private-document-library) from the example; then run your own checks. On failure read ample logs --kind build then --kind runtime.
    ample logs  --kind build

Success Checks

  1. app responds on its public URL
    • Kind: http_get
    • Path: /
    • Expect: ample canary django patterns
  2. public-media-library self-test
    • Kind: http_get
    • Path: /p/public-media-library
    • Expect: a CDN URL whose content is served publicly
  3. private-document-library self-test
    • Kind: http_get
    • Path: /p/private-document-library
    • Expect: private=ok (with ?role=owner; 401 without, 403 for viewer)

Limitations

Cost Estimate

Breakdown

  1. App server
    • Size: s-1vcpu-1gb
    • Quantity: 1.0
    • Monthly Amount: 5.0
  2. Managed PostgreSQL database
    • Size: s-1vcpu-1gb
    • Quantity: 1.0
    • Monthly Amount: 5.0

Evidence Summary

  1. Canary run
    Summary: Django pattern fixture deployed on Ample; checks passed for public-media-library, private-document-library and configuration-secrets. Pattern proof: public objects in a published bucket served from the CDN URL, kept separate from private objects in an unpublished bucket that require authorization (private=ok only for the allowed role).
    • Observed At: 2026-09-20T03:31:44Z
    • Implementation Revision: 03b6402b1b3e19178985f08ea4033804521d85d4-dirty (CLI b75e104)
    • Expires At: 2027-03-19T03:31:44Z
  2. Canary run
    Summary: The same Django app deployed with a --release-command migration; the marker it created was readable after activation.
    • Observed At: 2026-09-20T01:54:51Z
    • Implementation Revision: 199ff1dfd52683832ae75d3f98b53a7a4bff7f96-dirty (CLI e3181f5)
    • Expires At: 2027-03-19T01:54:51Z

Next Actions