INFRASTRUCTURE

What it needs

• Compute: verified (Apps run in isolated x86_64 Firecracker microVMs that auto-pause when idle and wake on request; sizes are the priced VM sizes.)

PREREQUISITES

Before you start

• Code that reads configuration from the process environment
• The secret values at hand for --env or an env file
• An Ample account token with servers:write

TESTED CONFIGURATION

Exactly what was tested

• install: python3 -m pip install --target .ample/python -r requirements.txt
• runtime: python
• size: s-1vcpu-1gb
• start: PYTHONPATH=.ample/python:${PYTHONPATH:-} python3 run.py
• template: python-3.12

STEP BY STEP

How to do it

1. Declare, do not commit
   In ample.toml declare SMTP_KEY = { secret = true } style entries; never put literal secrets in the manifest.

2. Pass values on deploy
   Use --env KEY=value (repeatable) or --env-file .env.production; values are encrypted at rest and reused on redeploys.

   ample deploy . --name <app-name> --public --start "python3 run.py" --env CANARY_SECRET=...  
   

3. Confirm without echoing
   Expose a route (/config) that reports secret=set or secret=missing, never the value.

4. Verify
   Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.

   ample logs <deployment_id> --kind build  
   

EXAMPLES

Tested examples

• Django secret probe canary (tests/deploy-canaries/django-postgres): /config reports secret=set for an --env value delivered encrypted.

SUCCESS CHECKS

How to know it worked

• app sees the configured variable without exposing it (/config on the live URL, expect secret=set)

LIMITATIONS

Know the limits

• Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.
• Region, compliance attestations and request-duration limits are unknown and not claimed.
• Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.
• Plain env in the API request is rejected; only the encrypted path is supported.
• Rotating a secret requires a redeploy with the new value.

COST

Cost estimate

Estimated 5.00 USD per month (size prices from pricing.toml at build revision a1b8c38919e59cd035ebabaced73cf84ece24371).

• app server x1 s-1vcpu-1gb: 5.00 USD

Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply.

EVIDENCE

Verification evidence

• canary_run on 2026-09-20T01:42:25Z at revision 199ff1dfd52683832ae75d3f98b53a7a4bff7f96-dirty (CLI e3181f5): Django 5 project with dj-database-url and psycopg: the managed PostgreSQL database was auto-provisioned, python3 manage.py migrate ran as the release command, and /db and /migrated reported postgres=ok and the migrated marker. (expires 2027-03-19T01:42:25Z)

EXECUTION

Execution binding

MCP tool ample_deploy (registry mcp:ample_deploy), schema hash 876465fce906da0c observed 2026-09-20T01:55:48.667900+00:00 at revision 199ff1dfd526. Binding state at export: current. Required scopes: servers:write.

NEXT ACTIONS

Typed next actions

• Browse the catalog index (GET /v1/catalog on the api origin; authentication not required, approval not required)
• Search published recipes by intent, stack and constraints (POST /v1/catalog/search on the api origin; authentication not required, approval not required)
• Prepare a side-effect-free deployment plan for an authorized project (POST /v1/catalog/plan on the api origin; authentication required, approval not required)
• Read the existing agent authentication setup (GET /mcp/setup on the api origin; authentication not required, approval not required)
• Browse Django (GET /v1/catalog/nodes/stack%3Aframework-django on the api origin; authentication not required, approval not required)
• Browse Configure deployment (GET /v1/catalog/nodes/intent%3Aconfigure-deployment on the api origin; authentication not required, approval not required)
• Browse Public web service (GET /v1/catalog/nodes/pattern%3Apublic-web-service on the api origin; authentication not required, approval not required)

Actions describe possible next steps. They are typed data, not commands, and grant no permission. Public discovery never provisions anything; planning requires your own authenticated token and approval happens in your client.