Configure environment and secrets for Express

Summary

Configure environment variables and secrets for an Express app on Ample. Values passed with --env or --env-file are stored encrypted and injected at runtime; the platform never prints them, and ample.toml declares only the variable names.

Infrastructure requirements

• Compute: verified (Apps run in isolated x86_64 Firecracker microVMs that auto-pause when idle and wake on request; sizes are the priced VM sizes.)

Prerequisites

• Code that reads configuration from process.env
• The secret values at hand for --env or an env file
• An Ample account token with servers:write

Exact tested configuration

• template: node-22
• runtime: node
• size: s-1vcpu-1gb
• install: npm install
• build: npm run build --if-present
• start: node server.js

Steps

1. Declare, do not commit. In ample.toml declare SMTP_KEY = { secret = true } style entries; never put literal secrets in the manifest.
2. Pass values on deploy. Use --env KEY=value (repeatable) or --env-file .env.production; values are encrypted at rest and re-used on redeploys.

   ample deploy . --name <app-name> --public --env DATABASE_URL=postgres://...

3. Confirm without echoing. Expose a route that reports which variables are set (host names, not values) and check it.
4. Verify. Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.

   ample logs <deployment_id> --kind build

Tested examples

• Encrypted DATABASE_URL canary (tests/deploy-canaries/env-database-url): /db reports the configured host with secret=false, proving delivery without disclosure.

Success checks

• app sees the configured variable without exposing it (/db on the live URL, expect secret=false)

Limitations

• Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.
• Region, compliance attestations and request-duration limits are unknown and not claimed.
• Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.
• Plain env in the API request is rejected; only the encrypted path is supported.
• Rotating a secret requires a redeploy with the new value.

Cost estimate

Estimated 5.00 USD per month (size prices from pricing.toml at build revision a1b8c38919e59cd035ebabaced73cf84ece24371).

• app server x1 s-1vcpu-1gb: 5.00 USD

Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply.

Verification evidence

• canary_run on 2026-09-19T23:55:33Z at revision 1764076-tls-account-903d345: A supplied DATABASE_URL was delivered as an encrypted environment variable; the app saw the configured host and the secret was never echoed by the platform. (expires 2027-03-18T23:55:33Z)
• canary_run on 2026-09-19T23:55:33Z at revision 1764076-tls-account-903d345: Express app with npm install and npm run start deployed on the node-22 template; the public URL served the expected response. (expires 2027-03-18T23:55:33Z)

Last verified: 2026-09-19T23:55:33Z

Execution binding

MCP tool ample_deploy (registry mcp:ample_deploy), schema hash 876465fce906da0c observed 2026-09-20T01:55:48.667900+00:00 at revision 199ff1dfd526, binding state current, required scopes: servers:write.