{ "manifest_version": "1.0.0", "template": { "id": "f28857ac-fff9-41aa-9d42-9e1edf431c3e", "slug": "2fauth", "name": "2Fauth", "description": "Deploy and Host 2Fauth with Railway", "url": "https://railway.com/deploy/2fauth", "upstream": { "image": "2fauth/2fauth" } }, "status": "unvalidated", "validated_at": null, "success_rate_30d": null, "services": [ { "name": "postgres", "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:17" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "tcp_ports": [ 5432 ], "http": false }, { "name": "2fauth", "source": { "image": "2fauth/2fauth" }, "needs_volume": true, "volume_mount_path": "/2fauth", "http": true } ], "required_inputs": [ { "key": "PGDATA", "service": "postgres", "description": "Location where the database will be initialized", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "PGHOST", "service": "postgres", "description": "Railway Private Domain Name.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PGPORT", "service": "postgres", "description": "Port to connect to Postgres.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "PGUSER", "service": "postgres", "description": "Required variable for Data panel", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGDATABASE", "service": "postgres", "description": "Required variable for the data panel.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGPASSWORD", "service": "postgres", "description": "Required variable for Data panel", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_DB", "service": "postgres", "description": "Default database created when image is started.", "secret": false, "strategy": "default", "default": "railway" }, { "key": "DATABASE_URL", "service": "postgres", "description": "URL to connect to Postgres database.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_USER", "service": "postgres", "description": "User to connect to Postgres DB", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "SSL_CERT_DAYS", "service": "postgres", "description": "SSL certificate expiry in days.", "secret": false, "strategy": "default", "default": "820" }, { "key": "POSTGRES_PASSWORD", "service": "postgres", "description": "Password to connect to DB", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "DATABASE_PUBLIC_URL", "service": "postgres", "description": "Public URL to connect to Postgres database, used by the Data panel.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS", "service": "postgres", "description": "Allow Postgres to cleanly shut down", "secret": false, "strategy": "default", "default": "60" }, { "key": "APP_ENV", "service": "2fauth", "description": "You can leave this on \"local\". If you change it to production most console commands will ask for extra confirmation.Never set it to \"testing\".", "secret": false, "strategy": "default", "default": "local" }, { "key": "APP_KEY", "service": "2fauth", "description": "The encryption key for our database and sessions. Keep this very secure. If you generate a new one all existing data must be considered LOST.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "APP_URL", "service": "2fauth", "description": "This variable must match your installation's external address. Webauthn won't work otherwise.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "DB_HOST", "service": "2fauth", "description": "Provide a value for DB_HOST.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DB_PORT", "service": "2fauth", "description": "Provide a value for DB_PORT.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "APP_NAME", "service": "2fauth", "description": "You can change the name of the app", "secret": false, "strategy": "default", "default": "2FAuth" }, { "key": "APP_DEBUG", "service": "2fauth", "description": "Set to true if you want to see debug information in error screens.", "secret": false, "strategy": "default", "default": "false" }, { "key": "LOG_LEVEL", "service": "2fauth", "description": "Log level. You can set this from least severe to most severe: debug, info, notice, warning, error, critical, alert, emergency If you set it to debug your logs will grow large, and fast. If you set it to emergency probably nothing will get logged, ever.", "secret": false, "strategy": "default", "default": "notice" }, { "key": "MAIL_PORT", "service": "2fauth", "description": "Provide a value for MAIL_PORT.", "secret": false, "strategy": "default", "default": "2525" }, { "key": "SITE_OWNER", "service": "2fauth", "description": "This should be your email address", "secret": false, "strategy": "ask_user" }, { "key": "DB_DATABASE", "service": "2fauth", "description": "Provide a value for DB_DATABASE.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DB_PASSWORD", "service": "2fauth", "description": "Provide a value for DB_PASSWORD.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DB_USERNAME", "service": "2fauth", "description": "Provide a value for DB_USERNAME.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "IS_DEMO_APP", "service": "2fauth", "description": "Turn this to true if you want your app to react like a demo. The Demo mode reset the app content every hours and set a generic demo user.", "secret": false, "strategy": "default", "default": "false" }, { "key": "LOG_CHANNEL", "service": "2fauth", "description": " The log channel defines where your log entries go to. 'daily' is the default logging mode giving you 7 daily rotated log files in /storage/logs/. Also available are 'errorlog', 'syslog', 'stderr', 'papertrail', 'slack' and a 'stack' channel to combine multiple channels into a single one.", "secret": false, "strategy": "default", "default": "daily" }, { "key": "MAIL_MAILER", "service": "2fauth", "description": "Provide a value for MAIL_MAILER.", "secret": false, "strategy": "default", "default": "log" }, { "key": "WEBAUTHN_ID", "service": "2fauth", "description": "Relying Party ID, should equal the site domain (i.e 2fauth.example.com). If null, the device will fill it internally (recommended) See https://webauthn-doc.spomky-labs.com/prerequisites/the-relying-party#how-to-determine-the-relying-party-id", "secret": false, "strategy": "default", "default": "null" }, { "key": "APP_TIMEZONE", "service": "2fauth", "description": "The timezone for your application, which is used to record dates and times to database. This global setting can be overridden by users via in-app settings for a personalised dates and times display. If this setting is changed while the application is already running, existing records in the database won't be updated", "secret": false, "strategy": "default", "default": "UTC" }, { "key": "CACHE_DRIVER", "service": "2fauth", "description": "If you're looking for performance improvements, you could install memcached.", "secret": false, "strategy": "default", "default": "file" }, { "key": "THROTTLE_API", "service": "2fauth", "description": " API settings The maximum number of API calls in a minute from the same IP. Once reached, all requests from this IP will be rejected until the minute has elapsed. Set to null to disable the API throttling.", "secret": false, "strategy": "default", "default": "60" }, { "key": "DB_CONNECTION", "service": "2fauth", "description": "Provide a value for DB_CONNECTION.", "secret": false, "strategy": "default", "default": "pgsql" }, { "key": "MAIL_PASSWORD", "service": "2fauth", "description": "Provide a value for MAIL_PASSWORD.", "secret": true, "strategy": "default", "default": "null" }, { "key": "MAIL_USERNAME", "service": "2fauth", "description": "Provide a value for MAIL_USERNAME.", "secret": false, "strategy": "default", "default": "null" }, { "key": "WEBAUTHN_NAME", "service": "2fauth", "description": "WebAuthn settings Relying Party name, aka the name of the application. If blank, defaults to APP_NAME. Do not set to null.", "secret": false, "strategy": "default", "default": "2FAuth" }, { "key": "LOGIN_THROTTLE", "service": "2fauth", "description": "Authentication settings The number of times per minute a user can fail to log in before being locked out. Once reached, all login attempts will be rejected until the minute has elapsed. This setting applies to both email/password and webauthn login attemps.", "secret": false, "strategy": "default", "default": "5" }, { "key": "MAIL_FROM_NAME", "service": "2fauth", "description": "Provide a value for MAIL_FROM_NAME.", "secret": false, "strategy": "default", "default": "MAIL_FROM_NAME" }, { "key": "SESSION_DRIVER", "service": "2fauth", "description": "Provide a value for SESSION_DRIVER.", "secret": false, "strategy": "default", "default": "file" }, { "key": "MAIL_ENCRYPTION", "service": "2fauth", "description": "Provide a value for MAIL_ENCRYPTION.", "secret": false, "strategy": "default", "default": "null" }, { "key": "TRUSTED_PROXIES", "service": "2fauth", "description": "Use this setting to declare trusted proxied. Supported: '*': to trust any proxy A comma separated IP list: The list of proxies IP to trust. ", "secret": false, "strategy": "default", "default": "null" }, { "key": "PROXY_LOGOUT_URL", "service": "2fauth", "description": "Custom logout URL to open when using an auth proxy.", "secret": false, "strategy": "default", "default": "null" }, { "key": "MAIL_FROM_ADDRESS", "service": "2fauth", "description": "Provide a value for MAIL_FROM_ADDRESS.", "secret": false, "strategy": "default", "default": "null" }, { "key": "AUTHENTICATION_GUARD", "service": "2fauth", "description": "The default authentication guard Supported: 'web-guard' : The Laravel built-in auth system (default if nulled) 'reverse-proxy-guard' : When 2FAuth is deployed behind a reverse-proxy that handle authentication WARNING When using 'reverse-proxy-guard' 2FAuth only look for the dedicated headers and skip all other built-in authentication checks. That means your proxy is fully responsible of the authentication process, 2FAuth will trust him as long as headers are presents.", "secret": false, "strategy": "default", "default": "web-guard" }, { "key": "MAIL_VERIFY_SSL_PEER", "service": "2fauth", "description": "SSL peer verification. Set this to false to disable the SSL certificate validation. WARNING Disabling peer verification can result in a major security flaw. Change it only if you know what you're doing.", "secret": false, "strategy": "default", "default": "true" }, { "key": "CONTENT_SECURITY_POLICY", "service": "2fauth", "description": "Set this to true to enable Content-Security-Policy (CSP). CSP helps to prevent or minimize the risk of certain types of security threats. This is mainly used as a defense against cross-site scripting (XSS) attacks, in which an attacker is able to inject malicious code into the web app. ", "secret": false, "strategy": "default", "default": "false" }, { "key": "AUTH_PROXY_HEADER_FOR_USER", "service": "2fauth", "description": "Name of the HTTP headers sent by the reverse proxy that identifies the authenticated user at proxy level. Check your proxy documentation to find out how these headers are named (i.e 'REMOTE_USER', 'REMOTE_EMAIL', etc...) (only relevant when AUTHENTICATION_GUARD is set to 'reverse-proxy-guard')", "secret": false, "strategy": "default", "default": "null" }, { "key": "WEBAUTHN_USER_VERIFICATION", "service": "2fauth", "description": "Use this setting to control how user verification behave during the WebAuthn authentication flow. Most authenticators and smartphones will ask the user to actively verify themselves for log in. For example, through a touch plus pin code, password entry, or biometric recognition (e.g., presenting a fingerprint). The intent is to distinguish one user from any other. Supported: 'required': Will ALWAYS ask for user verification 'preferred' (default) : Will ask for user verification IF POSSIBLE 'discouraged' : Will NOT ask for user verification (for example, to minimize disruption to the user interaction flow)", "secret": false, "strategy": "default", "default": "preferred" }, { "key": "AUTH_PROXY_HEADER_FOR_EMAIL", "service": "2fauth", "description": "Name of the HTTP headers sent by the reverse proxy that identifies the authenticated user at proxy level. Check your proxy documentation to find out how these headers are named (i.e 'REMOTE_USER', 'REMOTE_EMAIL', etc...) (only relevant when AUTHENTICATION_GUARD is set to 'reverse-proxy-guard')", "secret": false, "strategy": "default", "default": "null" }, { "key": "PROXY_FOR_OUTGOING_REQUESTS", "service": "2fauth", "description": "Proxy for outgoing requests like new releases detection or logo fetching. You can provide a proxy URL that contains a scheme, username, and password. For example, \"http://username:password@192.168.16.1:10\".", "secret": false, "strategy": "default", "default": "null" }, { "key": "AUTHENTICATION_LOG_RETENTION", "service": "2fauth", "description": "Authentication log retention time, in days. Log entries older than that are automatically deleted.", "secret": false, "strategy": "default", "default": "AUTHENTICATION_LOG_RETENTION" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "2fauth" } }, "cli": "railway deploy --template 2fauth", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "f28857ac-fff9-41aa-9d42-9e1edf431c3e", "serializedConfig": { "services": { "200c629c-73bb-40a6-a43b-00359adfc5ea": { "icon": "https://devicons.railway.app/i/postgresql.svg", "name": "postgres", "build": {}, "deploy": { "requiredMountPath": "/var/lib/postgresql/data" }, "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:17" }, "variables": { "PGDATA": { "isOptional": false, "description": "Location where the database will be initialized", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "PGHOST": { "isOptional": false, "description": "Railway Private Domain Name.", "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}" }, "PGPORT": { "isOptional": false, "description": "Port to connect to Postgres.", "defaultValue": "5432" }, "PGUSER": { "isOptional": false, "description": "Required variable for Data panel", "defaultValue": "${{ POSTGRES_USER }}" }, "PGDATABASE": { "isOptional": false, "description": "Required variable for the data panel.", "defaultValue": "${{POSTGRES_DB}}" }, "PGPASSWORD": { "isOptional": false, "description": "Required variable for Data panel", "defaultValue": "${{POSTGRES_PASSWORD}}" }, "POSTGRES_DB": { "isOptional": false, "description": "Default database created when image is started.", "defaultValue": "railway" }, "DATABASE_URL": { "isOptional": false, "description": "URL to connect to Postgres database.", "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{PGDATABASE}}" }, "POSTGRES_USER": { "isOptional": false, "description": "User to connect to Postgres DB", "defaultValue": "postgres" }, "SSL_CERT_DAYS": { "isOptional": true, "description": "SSL certificate expiry in days.", "defaultValue": "820" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Password to connect to DB", "defaultValue": "{{POSTGRES_PASSWORD}}" }, "DATABASE_PUBLIC_URL": { "description": "Public URL to connect to Postgres database, used by the Data panel.", "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_TCP_PROXY_DOMAIN}}:${{RAILWAY_TCP_PROXY_PORT}}/${{PGDATABASE}}" }, "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": { "isOptional": false, "description": "Allow Postgres to cleanly shut down", "defaultValue": "60" } }, "networking": { "tcpProxies": { "5432": {} }, "serviceDomains": {} }, "volumeMounts": { "200c629c-73bb-40a6-a43b-00359adfc5ea": { "mountPath": "/var/lib/postgresql/data" } }, "haTemplateCode": "postgres-ha", "haConversionConfig": { "edge": { "label": "Reverse Proxy", "options": [ 2, 3, 4, 5 ], "nodeLabel": "HAProxy", "description": "Routes traffic to the primary", "defaultValue": 3 }, "replica": { "label": "Replicas", "options": [ 2, 3, 4, 5, 6, 7 ], "nodeLabel": "Postgres", "description": "Streaming replicas for automatic failover", "defaultValue": 2 }, "internal": { "label": "Coordinator Nodes", "options": [ 3, 5, 7, 9 ], "nodeLabel": "etcd", "defaultValue": 3 }, "description": "This will convert your Postgres database to an HA cluster with Patroni failover and etcd consensus." } }, "3a94f7b6-3ab2-4830-836d-b0474597a054": { "icon": "https://i.ibb.co/qL6FTtqZ/2fauth-light.png", "name": "2fauth", "source": { "image": "2fauth/2fauth" }, "variables": { "APP_ENV": { "isOptional": false, "description": "You can leave this on \"local\". If you change it to production most console commands will ask for extra confirmation.Never set it to \"testing\".", "defaultValue": "local" }, "APP_KEY": { "isOptional": false, "description": "The encryption key for our database and sessions. Keep this very secure. If you generate a new one all existing data must be considered LOST.", "defaultValue": "{{APP_KEY}}" }, "APP_URL": { "isOptional": false, "description": "This variable must match your installation's external address. Webauthn won't work otherwise.", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "DB_HOST": { "isOptional": false, "description": "", "defaultValue": "${{postgres.PGHOST}}" }, "DB_PORT": { "isOptional": false, "description": "", "defaultValue": "${{postgres.PGPORT}}" }, "APP_NAME": { "isOptional": false, "description": "You can change the name of the app", "defaultValue": "2FAuth" }, "APP_DEBUG": { "isOptional": false, "description": "Set to true if you want to see debug information in error screens.", "defaultValue": "false" }, "ASSET_URL": { "isOptional": true, "description": "If you want to serve js assets from a CDN (like https://cdn.example.com), uncomment the following line and set this var with the CDN url. Otherwise, let this line emptr.", "defaultValue": "" }, "LOG_LEVEL": { "isOptional": false, "description": "Log level. You can set this from least severe to most severe: debug, info, notice, warning, error, critical, alert, emergency If you set it to debug your logs will grow large, and fast. If you set it to emergency probably nothing will get logged, ever.", "defaultValue": "notice" }, "MAIL_PORT": { "isOptional": false, "description": "", "defaultValue": "2525" }, "SITE_OWNER": { "isOptional": false, "description": "This should be your email address", "defaultValue": "{{SITE_OWNER}}" }, "DB_DATABASE": { "isOptional": false, "description": "", "defaultValue": "${{postgres.PGDATABASE}}" }, "DB_PASSWORD": { "isOptional": false, "description": "", "defaultValue": "${{postgres.PGPASSWORD}}" }, "DB_USERNAME": { "isOptional": false, "description": "", "defaultValue": "${{postgres.PGUSER}}" }, "IS_DEMO_APP": { "isOptional": false, "description": "Turn this to true if you want your app to react like a demo. The Demo mode reset the app content every hours and set a generic demo user.", "defaultValue": "false" }, "LOG_CHANNEL": { "isOptional": false, "description": " The log channel defines where your log entries go to. 'daily' is the default logging mode giving you 7 daily rotated log files in /storage/logs/. Also available are 'errorlog', 'syslog', 'stderr', 'papertrail', 'slack' and a 'stack' channel to combine multiple channels into a single one.", "defaultValue": "daily" }, "MAIL_MAILER": { "isOptional": false, "description": "", "defaultValue": "log" }, "WEBAUTHN_ID": { "isOptional": false, "description": "Relying Party ID, should equal the site domain (i.e 2fauth.example.com). If null, the device will fill it internally (recommended) See https://webauthn-doc.spomky-labs.com/prerequisites/the-relying-party#how-to-determine-the-relying-party-id", "defaultValue": "null" }, "APP_TIMEZONE": { "isOptional": false, "description": "The timezone for your application, which is used to record dates and times to database. This global setting can be overridden by users via in-app settings for a personalised dates and times display. If this setting is changed while the application is already running, existing records in the database won't be updated", "defaultValue": "UTC" }, "CACHE_DRIVER": { "isOptional": false, "description": "If you're looking for performance improvements, you could install memcached.", "defaultValue": "file" }, "THROTTLE_API": { "isOptional": false, "description": " API settings The maximum number of API calls in a minute from the same IP. Once reached, all requests from this IP will be rejected until the minute has elapsed. Set to null to disable the API throttling.", "defaultValue": "60" }, "DB_CONNECTION": { "isOptional": false, "description": "", "defaultValue": "pgsql" }, "MAIL_PASSWORD": { "isOptional": false, "description": "", "defaultValue": "null" }, "MAIL_USERNAME": { "isOptional": false, "description": "", "defaultValue": "null" }, "WEBAUTHN_NAME": { "isOptional": false, "description": "WebAuthn settings Relying Party name, aka the name of the application. If blank, defaults to APP_NAME. Do not set to null.", "defaultValue": "2FAuth" }, "LOGIN_THROTTLE": { "isOptional": false, "description": "Authentication settings The number of times per minute a user can fail to log in before being locked out. Once reached, all login attempts will be rejected until the minute has elapsed. This setting applies to both email/password and webauthn login attemps.", "defaultValue": "5" }, "MAIL_FROM_NAME": { "isOptional": false, "description": "", "defaultValue": "MAIL_FROM_NAME" }, "SESSION_DRIVER": { "isOptional": false, "description": "", "defaultValue": "file" }, "MAIL_ENCRYPTION": { "isOptional": false, "description": "", "defaultValue": "null" }, "TRUSTED_PROXIES": { "isOptional": false, "description": "Use this setting to declare trusted proxied. Supported: '*': to trust any proxy A comma separated IP list: The list of proxies IP to trust. ", "defaultValue": "null" }, "PROXY_LOGOUT_URL": { "isOptional": false, "description": "Custom logout URL to open when using an auth proxy.", "defaultValue": "null" }, "MAIL_FROM_ADDRESS": { "isOptional": false, "description": "", "defaultValue": "null" }, "AUTHENTICATION_GUARD": { "isOptional": false, "description": "The default authentication guard Supported: 'web-guard' : The Laravel built-in auth system (default if nulled) 'reverse-proxy-guard' : When 2FAuth is deployed behind a reverse-proxy that handle authentication WARNING When using 'reverse-proxy-guard' 2FAuth only look for the dedicated headers and skip all other built-in authentication checks. That means your proxy is fully responsible of the authentication process, 2FAuth will trust him as long as headers are presents.", "defaultValue": "web-guard" }, "MAIL_VERIFY_SSL_PEER": { "isOptional": false, "description": "SSL peer verification. Set this to false to disable the SSL certificate validation. WARNING Disabling peer verification can result in a major security flaw. Change it only if you know what you're doing.", "defaultValue": "true" }, "CONTENT_SECURITY_POLICY": { "isOptional": false, "description": "Set this to true to enable Content-Security-Policy (CSP). CSP helps to prevent or minimize the risk of certain types of security threats. This is mainly used as a defense against cross-site scripting (XSS) attacks, in which an attacker is able to inject malicious code into the web app. ", "defaultValue": "false" }, "AUTH_PROXY_HEADER_FOR_USER": { "isOptional": false, "description": "Name of the HTTP headers sent by the reverse proxy that identifies the authenticated user at proxy level. Check your proxy documentation to find out how these headers are named (i.e 'REMOTE_USER', 'REMOTE_EMAIL', etc...) (only relevant when AUTHENTICATION_GUARD is set to 'reverse-proxy-guard')", "defaultValue": "null" }, "WEBAUTHN_USER_VERIFICATION": { "isOptional": false, "description": "Use this setting to control how user verification behave during the WebAuthn authentication flow. Most authenticators and smartphones will ask the user to actively verify themselves for log in. For example, through a touch plus pin code, password entry, or biometric recognition (e.g., presenting a fingerprint). The intent is to distinguish one user from any other. Supported: 'required': Will ALWAYS ask for user verification 'preferred' (default) : Will ask for user verification IF POSSIBLE 'discouraged' : Will NOT ask for user verification (for example, to minimize disruption to the user interaction flow)", "defaultValue": "preferred" }, "AUTH_PROXY_HEADER_FOR_EMAIL": { "isOptional": false, "description": "Name of the HTTP headers sent by the reverse proxy that identifies the authenticated user at proxy level. Check your proxy documentation to find out how these headers are named (i.e 'REMOTE_USER', 'REMOTE_EMAIL', etc...) (only relevant when AUTHENTICATION_GUARD is set to 'reverse-proxy-guard')", "defaultValue": "null" }, "PROXY_FOR_OUTGOING_REQUESTS": { "isOptional": false, "description": "Proxy for outgoing requests like new releases detection or logo fetching. You can provide a proxy URL that contains a scheme, username, and password. For example, \"http://username:password@192.168.16.1:10\".", "defaultValue": "null" }, "AUTHENTICATION_LOG_RETENTION": { "isOptional": false, "description": "Authentication log retention time, in days. Log entries older than that are automatically deleted.", "defaultValue": "AUTHENTICATION_LOG_RETENTION" } }, "networking": { "serviceDomains": { ":8000": { "port": 8000 } } }, "volumeMounts": { "3a94f7b6-3ab2-4830-836d-b0474597a054": { "mountPath": "/2fauth" } } } } } } } } } }, "post_deploy": {}, "resources": { "expected_services": 2, "needs_volume": true }, "generated_at": "2026-09-14T10:14:50.742Z", "generator_version": "0.1.0" }