# Configure environment and secrets for Express

## Summary

Configure environment variables and secrets for an Express app on Ample. Values passed with --env or --env-file are stored encrypted and injected at runtime; the platform never prints them, and ample.toml declares only the variable names.

## Infrastructure requirements

- Compute: verified (Apps run in isolated x86_64 Firecracker microVMs that auto-pause when idle and wake on request; sizes are the priced VM sizes.)

## Prerequisites

- Code that reads configuration from process.env
- The secret values at hand for --env or an env file
- An Ample account token with servers:write

## Exact tested configuration

- template: `node-22`
- runtime: `node`
- size: `s-1vcpu-1gb`
- install: `npm install`
- build: `npm run build --if-present`
- start: `node server.js`

## Steps

1. **Declare, do not commit.** In ample.toml declare SMTP_KEY = { secret = true } style entries; never put literal secrets in the manifest.
2. **Pass values on deploy.** Use --env KEY=value (repeatable) or --env-file .env.production; values are encrypted at rest and re-used on redeploys.

```
   ample deploy . --name <app-name> --public --env DATABASE_URL=postgres://...
   ```
3. **Confirm without echoing.** Expose a route that reports which variables are set (host names, not values) and check it.
4. **Verify.** Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.

```
   ample logs <deployment_id> --kind build
   ```

## Tested examples

- **Encrypted DATABASE_URL canary** (tests/deploy-canaries/env-database-url): /db reports the configured host with secret=false, proving delivery without disclosure.

## Success checks

- app sees the configured variable without exposing it (`/db` on the live URL, expect secret=false)

## Limitations

- Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.
- Region, compliance attestations and request-duration limits are unknown and not claimed.
- Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.
- Plain env in the API request is rejected; only the encrypted path is supported.
- Rotating a secret requires a redeploy with the new value.

## Cost estimate

Estimated 5.00 USD per month (size prices from pricing.toml at build revision a1b8c38919e59cd035ebabaced73cf84ece24371).
- app server x1 `s-1vcpu-1gb`: 5.00 USD

Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply.

## Verification evidence

- canary_run on 2026-09-19T23:55:33Z at revision `1764076-tls-account-903d345`: A supplied DATABASE_URL was delivered as an encrypted environment variable; the app saw the configured host and the secret was never echoed by the platform. (expires 2027-03-18T23:55:33Z)
- canary_run on 2026-09-19T23:55:33Z at revision `1764076-tls-account-903d345`: Express app with npm install and npm run start deployed on the node-22 template; the public URL served the expected response. (expires 2027-03-18T23:55:33Z)

Last verified: 2026-09-19T23:55:33Z

## Execution binding

MCP tool `ample_deploy` (registry `mcp:ample_deploy`), schema hash `876465fce906da0c` observed 2026-09-20T01:55:48.667900+00:00 at revision `199ff1dfd526`, binding state `current`, required scopes: servers:write.