SPLENT Framework

Core library for building modular, feature-driven Flask applications using Software Product Line principles.

Quick start

from splent_framework import create_splent_app

app = create_splent_app(__name__, config_name="development")

Production defaults

A product built with create_splent_app gets these without any code. Each one is a variable in the deployment's .env. The header and asset settings can also be fixed in the product's config.py, which then wins over the .env. For SPLENT_COOKIE_SECURE and MAX_CONTENT_LENGTH the .env wins over the product and over any feature's inject_config, because only the deployment knows whether it runs over HTTPS and how large its uploads are. The factory applies both again after the features load.

Variable	Default	What it does
SPLENT_TRUSTED_PROXIES	0	Number of reverse proxies in front of the app. Set it to 1 behind a TLS proxy (nginx, Caddy, Traefik) so the app sees the client address and the https the proxy was reached on, builds https:// links and sends HSTS. Leave it at 0 when the app port is reachable without the proxy.
SPLENT_COOKIE_SECURE	auto	Session and remember-me cookies are always HttpOnly and SameSite=Lax. Left unset, every cookie is Secure when the request arrived over HTTPS, directly or through a trusted proxy, so behind TLS set SPLENT_TRUSTED_PROXIES. true forces Secure, false never sets it.
MAX_CONTENT_LENGTH	16M	Largest request body. Bigger ones get 413, as JSON for a client that sent or asked for JSON. Accepts bytes or K, M, G, and 0 for no limit.
SPLENT_SECURITY_HEADERS	true	nosniff, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cache-Control: no-store for signed-in users. false leaves them all to the proxy.
SPLENT_FRAME_OPTIONS	SAMEORIGIN	DENY, or off to send nothing.
SPLENT_REFERRER_POLICY	strict-origin-when-cross-origin	Any Referrer-Policy value.
SPLENT_PERMISSIONS_POLICY	camera, microphone, geolocation, payment and USB off	The whole Permissions-Policy value. Embedded maps lose their location button under the default; allow geolocation here if a product needs it.
SPLENT_NO_STORE_SIGNED_IN	true	Cache-Control: no-store on pages for a signed-in user.
SPLENT_HSTS_MAX_AGE	31536000	Sent only over HTTPS. 0 turns HSTS off.
SPLENT_HSTS_INCLUDE_SUBDOMAINS, SPLENT_HSTS_PRELOAD	false	The optional HSTS directives.
SPLENT_CONTENT_SECURITY_POLICY	none	A Content-Security-Policy to send. Opt in, since existing templates use inline scripts.
SPLENT_CSP_REPORT_ONLY	false	Send that policy as Content-Security-Policy-Report-Only to try it first.
SPLENT_ASSET_MAX_AGE	31536000	How long a versioned asset (?v=<mtime>) may be cached. 0 turns it off.
SPLENT_ASSET_VERSIONING	true	Add ?v=<mtime> to the asset URLs url_for builds.

Database connections are pinged when they leave the pool and recycled after an hour (SQLALCHEMY_ENGINE_OPTIONS), so a database restart or MariaDB's eight hour wait_timeout never reaches a visitor as a 500. A product changes them in its config.py.

Requirements

• Python 3.13+
• Flask 3.1+
• SQLAlchemy 2.0+

Documentation

Full docs, tutorials, and architecture reference at docs.splent.io

License

splent_framework is free software under the GNU Lesser General Public License, version 3 or any later version (LGPL-3.0-or-later). See COPYING.LESSER, and COPYING for the GNU General Public License it builds on. A product built on the framework can carry any license of its own choice.