Configuration & architecture

There is no Wred settings object to memorize. Configure the component that actually owns the behavior. A small victory for both readability and your remaining memory.

Who configures what?

Concern	Owner and documentation
Routes, methods, validation, error responses	Your Wred application. See the API reference.
Host, port, workers, reload, transport timeouts	Your ASGI server. Wred has no server configuration or CLI.
CORS, signed sessions, request context	The middleware stack. See Starlette middleware and custom ASGI middleware.
Database connections and credentials	Your application and database client. The notebook’s settings are below.
HTTPS, body limits, proxy routing	Your edge server. See Caddy or Nginx.
Process supervision and environment files	Your deployment system. See operations.

App() takes no settings and Wred reads no environment variables. A variable called WRED_DEBUG will do exactly what an unread environment variable usually does: occupy a small amount of memory.

Notebook environment variables

Variable	Default	Read by
`MONGODB_URI`	`mongodb://127.0.0.1:27017`	`example_app.app.create_app()`
`MONGODB_DATABASE`	`wred_notebook`	`example_app.app.create_app()`
`WRED_TEST_MONGODB_URI`	Unset: database integration tests are skipped.	`tests/test_notebook.py`; not the running app.

Explicit mongodb_uri and database_name arguments override the two app environment values. Passing database=... overrides both by supplying an application-owned database object.

A notebook entry point in the repository root

from example_app.app import create_app

app = create_app(
    mongodb_uri='mongodb://127.0.0.1:27017',
    database_name='my_notebook',
)

The factory and its environment variables belong to the example application, not the Wred package. Its wrapper calls the database’s async initialize() and close() methods through lifespan.

Recipe-only settings

Setting	Used by	Meaning
`SESSION_SECRET`	`examples/session_app.py`	Required signing secret, shared by all workers. No built-in default.
`COOKIE_SECURE`	`examples/session_app.py`	Defaults to `1`. Set `0` only for the local HTTP recipe.

These two settings configure the standalone Starlette session example. The notebook’s refresh cookie uses the incoming ASGI scheme instead. The similar-looking cookies are under different management.

Separate HTTP from lifespan

Wred’s inner app handles HTTP. The notebook’s outer app handles startup and shutdown; Starlette can also be the outer lifecycle owner when composing apps. Pass unhandled protocols through middleware to the component that owns them.

A bare Wred app should use your server’s unsupported-lifespan detection or an explicit lifespan-off setting. The notebook should run with lifespan enabled so database startup failures are visible. --lifespan on is shown in its Weft commands.

Register routes before serving traffic. One worker’s in-memory objects do not become shared state merely because another worker was launched with the same command.

Configure forwarding at one layer

The deployment examples bind Weft to 127.0.0.1 and use --forwarded-allow-ips 127.0.0.1. Their proxies preserve the public Host and supply the scheme and client address. If you use the alternative Uvicorn middleware recipe, let that wrapper own this processing instead.

Correct scheme information matters for Secure cookies, redirects, and the notebook’s same-origin checks. A proxy configuration is part of application behavior, not a decorative YAML-adjacent accessory.

Tutorial

Reference