# Host Recruiting Tracker with Flask: Private Attachments

Deploy a recruiting tracker built with Flask on Ample using the private document library pattern. Compute runs the app in an isolated microVM behind a public HTTPS URL, a managed PostgreSQL 16 database is auto-provisioned and injected as DATABASE_URL, a private S3-compatible bucket holds objects with credentials delivered as encrypted environment variables. Verified on Flask: a role-to-document access model with negative tests (401 without identity, 403 for the wrong role) and a private-bucket round-trip for the allowed role (private=ok). Not separately tested: your identity integration and role assignments; treat the recruiting tracker-specific behavior as your application code.

## Summary
- **Framework**: Flask
- **Workload**: Recruiting tracker
- **Release Status**: Published
- **Support Status**: Verified
- **Execution Status**: Ready

## Resource Requirements
- **Compute**: Isolated x86_64 Firecracker microVMs that auto-pause when idle.
- **Postgres**: Managed PostgreSQL 16 running in its own microVM.
- **S3-compatible object storage**: Buckets with issued credentials.

## Prerequisites
1. A Flask project that builds and starts with the documented commands.
2. A PostgreSQL driver reading DATABASE_URL at runtime.
3. A bucket from `ample bucket create` with its credentials passed as encrypted S3_* environment variables.
4. An Ample account token with appropriate permissions.

## Tested Configuration
- **Template**: python-3.12
- **Runtime**: python
- **Size**: s-1vcpu-1gb
- **Install**: `python3 -m pip install --target .ample/python -r requirements.txt`
- **Start**: `PYTHONPATH=.ample/python:${PYTHONPATH:-} python3 app.py`

## Workflow Steps
1. **Build and Start**: `pip install into .ample/python from requirements.txt, then waitress from app.py reading PORT on the python-3.12 template.`
2. **Implement the Pattern on PostgreSQL**: Use a role-to-document access model.
3. **Wire Object Storage**: Create the bucket(s) and pass credentials as --env values.
4. **Deploy**: Run the synchronous deploy command.
5. **Verify**: Fetch the live URL and run your own checks.

## Success Checks
- **App responds on its public URL**: `ample canary flask patterns`
- **Private-document-library self-test**: `private=ok (with ?role=owner; 401 without, 403 for viewer)`

## Limitations
- Verified on the python-3.12 template; other sizes and versions may not be verified.
- The recruiting tracker itself (identity integration and role assignments) is application code and was not separately tested.

## Cost Estimate
- **Currency**: USD
- **Monthly Amount**: $10.00
- **Components**:
  - **App Server**: $5.00
  - **Managed PostgreSQL Database**: $5.00

## Evidence Summary
- **Flask pattern fixture** deployed on Ample with passed checks for configuration-secrets.
- **Canary Runs** demonstrate successful deployments and accessibility of the private-document-library module.

## Next Actions
- **Browse the catalog**: [GET /v1/catalog](https://ample.com/catalog/)
- **Search recipes**: [POST /v1/catalog/search](https://ample.com/search)
- **Prepare a deployment plan**: [POST /v1/catalog/plan](https://ample.com/plan)