Configuration Reference for Pokédex Web App

The Pokédex Web App’s configuration is defined directly in source code rather than through environment variables or a separate settings file. This page documents every configurable value, the file it lives in, its default, and how to change it safely — especially before deploying to a production environment.

Several defaults in this project (plain-text secret key, debug=True) are suitable for local development only. Review every item on this page before running the application anywhere it is publicly reachable.

Configuration Values

`application.secret_key`

application.secret_key

string

default:"pokesecretkey123"

Signs and verifies Flask session cookies. Any change to this value invalidates all existing sessions.

Property	Detail
File	`application.py`
Default	`"pokesecretkey123"`
Purpose	Cryptographically signs Flask session cookies using HMAC-SHA1. If an attacker knows the key they can forge sessions and impersonate any user.

How to change: Replace the hard-coded value with a long, random string. For production, load it from an environment variable so the secret never appears in source control:

import os
application.secret_key = os.environ.get("SECRET_KEY", "pokesecretkey123")

Then set the variable in your deployment environment:

export SECRET_KEY="$(python -c 'import secrets; print(secrets.token_hex(32))')"

The default "pokesecretkey123" is publicly known. Always replace it with a strong random value before deploying to any environment accessible over a network.

`DB_PATH`

DB_PATH

string

Filesystem path to the SQLite database file. Resolved relative to models/database.py.

Property	Detail
File	`models/database.py`
Default	`os.path.join(os.path.dirname(__file__), '..', 'pokedex.db')`
Resolved path	`Proyecto-UPC/pokedex.db`
Purpose	Tells `sqlite3.connect()` where to create or open the database file.

How to change: Edit the DB_PATH variable at the top of models/database.py:

# models/database.py
DB_PATH = "/var/data/pokedex.db"   # absolute path example

Or load from an environment variable for flexibility across environments:

import os
DB_PATH = os.environ.get("DB_PATH", os.path.join(os.path.dirname(__file__), '..', 'pokedex.db'))

The directory containing the database file must already exist and be writable by the process running the app. SQLite will not create intermediate directories.

`PokeAPI.BASE_URL`

BASE_URL

string

default:"https://pokeapi.co/api/v2"

Root URL for all PokéAPI HTTP requests. Changing this allows you to point the app at a self-hosted mirror of PokéAPI.

Property	Detail
File	`services/poke_api.py`
Default	`"https://pokeapi.co/api/v2"`
Purpose	Base URL prepended to every endpoint path when fetching Pokémon data.

How to change: Update the class constant in services/poke_api.py:

class PokeAPI:
    BASE_URL = "https://your-pokeapi-mirror.example.com/api/v2"

PokéAPI is a free, public API with no authentication requirement. The local cache_pokemon table means the live API is only called once (on first startup or after the cache is cleared), so rate-limiting is not a practical concern for normal use.

`Equipo.MAX_POKEMONES`

MAX_POKEMONES

integer

default:"6"

Maximum number of Pokémon a single user may have in their team at one time. Enforced in application logic, not at the database level.

Property	Detail
File	`models/equipo.py`
Default	`6`
Purpose	Guards the `/equipo/agregar/` route. `Equipo.agregar_pokemon()` returns `(False, message)` if the team is already full.

How to change: Update the class constant in models/equipo.py:

class Equipo:
    MAX_POKEMONES = 6   # change to any positive integer

The value 6 mirrors the team-size limit in the mainline Pokémon video games. Increasing it is technically supported but will diverge from standard Pokémon rules and may affect how team display templates render.

Debug Mode

debug

boolean

default:"True"

Enables Flask’s interactive debugger and auto-reloader. Only active when application.py is run directly (not via Gunicorn).

Property	Detail
File	`application.py` (bottom of file)
Default	`debug=True`
Scope	Only executed when the file is run as `__main__` — i.e., `python application.py`. Gunicorn ignores this block entirely.

# application.py
if __name__ == "__main__":
    application.run(debug=True)

How to change for production: When running via Gunicorn (see below) this block is never reached, so no change is required for production. For direct invocation during development, leave debug=True. If you run the app directly in a shared environment, set it to False:

if __name__ == "__main__":
    application.run(debug=False)

Flask’s debug mode exposes a browser-based interactive Python console when an unhandled exception occurs. An attacker with access to this console can execute arbitrary code on the server. Never enable debug mode on a publicly accessible host.

Gunicorn (Production Server)

Property	Detail
File	`Procfile`
Command	`web: gunicorn application:application`
Module	`application` (the file `application.py`)
WSGI callable	`application` (the `Flask(__name__)` instance)

The Procfile is used by platforms such as Heroku and other PaaS providers. Running locally with Gunicorn:

gunicorn application:application

Recommended production settings:

Set the number of workers

Gunicorn defaults to 1 worker. A common rule of thumb is (2 × CPU cores) + 1:

gunicorn --workers 3 application:application

Bind to a port

By default Gunicorn binds to 127.0.0.1:8000. To expose on all interfaces:

gunicorn --bind 0.0.0.0:8000 --workers 3 application:application

Set the secret key environment variable

export SECRET_KEY="your-long-random-secret"
gunicorn --workers 3 application:application

SQLite is not designed for high-concurrency write workloads. For a deployment with many simultaneous users, consider migrating to PostgreSQL or MySQL and updating models/database.py accordingly.

Configuration at a Glance

Secret Key

File: application.py
Default: "pokesecretkey123"
Load from SECRET_KEY environment variable in production.

Database Path

File: models/database.py
Default: ../pokedex.db (relative to models/)
Set DB_PATH to an absolute path for predictable behavior.

PokéAPI Base URL

File: services/poke_api.py
Default: https://pokeapi.co/api/v2
Point to a mirror by changing PokeAPI.BASE_URL.

Team Size Limit

File: models/equipo.py
Default: 6
Change Equipo.MAX_POKEMONES to any positive integer.

There is no .env file or 12-factor configuration system in this project. All configuration is defined in-code. For a production deployment, refactor sensitive values (secret key, database path) to be loaded from environment variables so they are never committed to version control.

Architecture

Routes & Configuration

Configuration Reference for Pokédex Web App

Configuration Values

`application.secret_key`

`DB_PATH`

`PokeAPI.BASE_URL`

`Equipo.MAX_POKEMONES`

Debug Mode

Gunicorn (Production Server)

Configuration at a Glance

Secret Key

Database Path

PokéAPI Base URL

Team Size Limit

Build docs developers (and LLMs) love

Architecture

Routes & Configuration

Documentation Index

​Configuration Values

​application.secret_key

​DB_PATH

​PokeAPI.BASE_URL

​Equipo.MAX_POKEMONES

​Debug Mode

​Gunicorn (Production Server)

​Configuration at a Glance

Secret Key

Database Path

PokéAPI Base URL

Team Size Limit

Build docs developers (and LLMs) love

Configuration Values

`application.secret_key`

`DB_PATH`

`PokeAPI.BASE_URL`

`Equipo.MAX_POKEMONES`

Debug Mode

Gunicorn (Production Server)

Configuration at a Glance