{
  "manifest_version": "1.0.0",
  "template": {
    "id": "8906dd6a-3532-45ab-904a-f08f807a80df",
    "slug": "alquimia-stack-2",
    "name": "Alquimia Stack",
    "description": "Deploy Alquimia Stack on Railway",
    "url": "https://railway.com/deploy/alquimia-stack-2",
    "upstream": {
      "image": "alquimiaai/prometheus:railway-v2"
    }
  },
  "services": [
    {
      "name": "minio-init",
      "source": {
        "image": "minio/mc:latest"
      },
      "needs_volume": false,
      "http": false
    },
    {
      "name": "redis",
      "source": {
        "image": "redis:7"
      },
      "needs_volume": false,
      "http": false
    },
    {
      "name": "oras-registry",
      "source": {
        "image": "ghcr.io/oras-project/registry"
      },
      "needs_volume": true,
      "volume_mount_path": "/var/lib/registry",
      "http": false
    },
    {
      "name": "runtime-postgres",
      "source": {
        "image": "postgres:latest"
      },
      "needs_volume": true,
      "volume_mount_path": "/var/lib/postgresql/data",
      "http": false
    },
    {
      "name": "kafka",
      "source": {
        "image": "redpandadata/redpanda:latest"
      },
      "needs_volume": false,
      "http": false
    },
    {
      "name": "prometheus",
      "source": {
        "image": "alquimiaai/prometheus:railway-v2"
      },
      "needs_volume": true,
      "volume_mount_path": "/prometheus",
      "http": true
    },
    {
      "name": "vault",
      "source": {
        "image": "alquimiaai/vault-railway:20260529"
      },
      "needs_volume": false,
      "http": false
    },
    {
      "name": "trustlens",
      "source": {
        "image": "alquimiaai/trustlens:stable-20260714-1613"
      },
      "needs_volume": false,
      "http": false
    },
    {
      "name": "studio",
      "source": {
        "image": "alquimiaai/studio:latest"
      },
      "needs_volume": true,
      "volume_mount_path": "/app/.data",
      "http": true
    },
    {
      "name": "runtime",
      "source": {
        "image": "alquimiaai/runtime:dev"
      },
      "needs_volume": true,
      "volume_mount_path": "/data",
      "http": true
    },
    {
      "name": "qdrant",
      "source": {
        "image": "qdrant/qdrant:latest"
      },
      "needs_volume": true,
      "volume_mount_path": "/qdrant/storage",
      "http": false
    },
    {
      "name": "minio",
      "source": {
        "image": "quay.io/minio/minio:latest"
      },
      "needs_volume": true,
      "volume_mount_path": "/data",
      "http": false
    },
    {
      "name": "trustlens-postgres",
      "source": {
        "image": "ghcr.io/railwayapp-templates/postgres-ssl:18"
      },
      "needs_volume": true,
      "volume_mount_path": "/var/lib/postgresql/data",
      "tcp_ports": [
        5432
      ],
      "http": false
    }
  ],
  "required_inputs": [
    {
      "key": "MINIO_ROOT_USER",
      "service": "minio-init",
      "description": "MinIO root user reference.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "MINIO_ROOT_PASSWORD",
      "service": "minio-init",
      "description": "MinIO root password reference.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "PORT",
      "service": "redis",
      "description": "Internal Redis port.",
      "secret": false,
      "strategy": "default",
      "default": "6379"
    },
    {
      "key": "PORT",
      "service": "oras-registry",
      "description": "Internal ORAS registry port.",
      "secret": false,
      "strategy": "default",
      "default": "5000"
    },
    {
      "key": "PORT",
      "service": "runtime-postgres",
      "description": "Internal Postgres port for Runtime database.",
      "secret": false,
      "strategy": "default",
      "default": "5432"
    },
    {
      "key": "PGDATA",
      "service": "runtime-postgres",
      "description": "Postgres data directory mounted on the Railway volume.",
      "secret": false,
      "strategy": "default",
      "default": "/var/lib/postgresql/data/pgdata"
    },
    {
      "key": "POSTGRES_DB",
      "service": "runtime-postgres",
      "description": "Runtime database name.",
      "secret": false,
      "strategy": "default",
      "default": "alquimia_runtime"
    },
    {
      "key": "POSTGRES_USER",
      "service": "runtime-postgres",
      "description": "Runtime Postgres username.",
      "secret": false,
      "strategy": "default",
      "default": "postgres"
    },
    {
      "key": "POSTGRES_PASSWORD",
      "service": "runtime-postgres",
      "description": "Runtime Postgres password used by Runtime.",
      "secret": true,
      "strategy": "default",
      "default": "alquimia_runtime_railway_2026"
    },
    {
      "key": "PORT",
      "service": "kafka",
      "description": "Kafka broker port exposed on Railway private networking.",
      "secret": false,
      "strategy": "default",
      "default": "9092"
    },
    {
      "key": "PORT",
      "service": "prometheus",
      "description": "Provide a value for PORT.",
      "secret": false,
      "strategy": "default",
      "default": "9090"
    },
    {
      "key": "PROMETHEUS_STORAGE_PATH",
      "service": "prometheus",
      "description": "Provide a value for PROMETHEUS_STORAGE_PATH.",
      "secret": false,
      "strategy": "default",
      "default": "/prometheus"
    },
    {
      "key": "PROMETHEUS_TRUSTLENS_TARGET",
      "service": "prometheus",
      "description": "Provide a value for PROMETHEUS_TRUSTLENS_TARGET.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "PORT",
      "service": "vault",
      "description": "Internal Vault HTTP API port.",
      "secret": false,
      "strategy": "default",
      "default": "8200"
    },
    {
      "key": "VAULT_DEV_ROOT_TOKEN_ID",
      "service": "vault",
      "description": "Generated Vault root token.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "VAULT_ADDR",
      "service": "trustlens",
      "description": "Provide a value for VAULT_ADDR.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "VAULT_TOKEN",
      "service": "trustlens",
      "description": "Provide a value for VAULT_TOKEN.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "DATABASE_URL",
      "service": "trustlens",
      "description": "Provide a value for DATABASE_URL.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "VAULT_MOUNT_POINT",
      "service": "trustlens",
      "description": "Provide a value for VAULT_MOUNT_POINT.",
      "secret": false,
      "strategy": "default",
      "default": "secret"
    },
    {
      "key": "TRUSTLENS_API_TOKEN",
      "service": "trustlens",
      "description": "Provide a value for TRUSTLENS_API_TOKEN.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "TRUSTLENS_ENVIRONMENT",
      "service": "trustlens",
      "description": "Provide a value for TRUSTLENS_ENVIRONMENT.",
      "secret": false,
      "strategy": "default",
      "default": "staging"
    },
    {
      "key": "TRUSTLENS_PROVIDER_ID",
      "service": "trustlens",
      "description": "Provide a value for TRUSTLENS_PROVIDER_ID.",
      "secret": false,
      "strategy": "default",
      "default": "trustlens-gaussia"
    },
    {
      "key": "TRUSTLENS_WEBHOOK_URL",
      "service": "trustlens",
      "description": "Provide a value for TRUSTLENS_WEBHOOK_URL.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "TRUSTLENS_RUNTIME_BASE_URL",
      "service": "trustlens",
      "description": "Provide a value for TRUSTLENS_RUNTIME_BASE_URL.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "TRUSTLENS_RUNTIME_API_TOKEN",
      "service": "trustlens",
      "description": "Provide a value for TRUSTLENS_RUNTIME_API_TOKEN.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "TRUSTLENS_WORKER_CONCURRENCY",
      "service": "trustlens",
      "description": "Provide a value for TRUSTLENS_WORKER_CONCURRENCY.",
      "secret": false,
      "strategy": "default",
      "default": "2"
    },
    {
      "key": "TRUSTLENS_WEBHOOK_SIGNING_KEY",
      "service": "trustlens",
      "description": "Provide a value for TRUSTLENS_WEBHOOK_SIGNING_KEY.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "PORT",
      "service": "studio",
      "description": "Internal HTTP port exposed by InsightHub.",
      "secret": false,
      "strategy": "default",
      "default": "3000"
    },
    {
      "key": "NODE_ENV",
      "service": "studio",
      "description": "Runs InsightHub in production mode.",
      "secret": false,
      "strategy": "default",
      "default": "production"
    },
    {
      "key": "API_TOKEN",
      "service": "studio",
      "description": "Shared internal token generated by Runtime.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "DB_STRATEGY",
      "service": "studio",
      "description": "Uses local Lite persistence for InsightHub.",
      "secret": false,
      "strategy": "default",
      "default": "lite"
    },
    {
      "key": "DATABASE_URL",
      "service": "studio",
      "description": "SQLite database path mounted on the Railway volume.",
      "secret": false,
      "strategy": "default",
      "default": "file:/app/.data/lite.db"
    },
    {
      "key": "NEXTAUTH_URL",
      "service": "studio",
      "description": "Public Railway URL for InsightHub auth callbacks.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "TWYD_API_KEY",
      "service": "studio",
      "description": "Twyd API token reference used by InsightHub.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "TWYD_BASEURL",
      "service": "studio",
      "description": "Private Railway URL for Twyd API.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "AUTH_STRATEGY",
      "service": "studio",
      "description": "Enables Lite authentication for Railway deployments.",
      "secret": false,
      "strategy": "default",
      "default": "lite"
    },
    {
      "key": "KAPSO_API_KEY",
      "service": "studio",
      "description": "Provide a value for KAPSO_API_KEY.",
      "secret": true,
      "strategy": "default",
      "default": "c10ebbdf525b4679ff2509cb84ce67d71cee71b6ae24efe4"
    },
    {
      "key": "NEDB_DATA_DIR",
      "service": "studio",
      "description": "Mounted persistence directory for InsightHub Lite data.",
      "secret": false,
      "strategy": "default",
      "default": "/app/.data"
    },
    {
      "key": "AUTH_LITE_USERS",
      "service": "studio",
      "description": "Lite auth users JSON provided by the deployer.",
      "secret": false,
      "strategy": "default",
      "default": "[{\"email\":\"admin@alquimia.ai\",\"name\":\"Alquimia Admin\",\"password_hash\":\"JDJiJDEwJDFzZ2tVMDQwV0VsUHR3dFlhalMvWWVUeWJnRUg3c2NQZ2RaSmZaODFXLlVHaWt3RWF6dE9h\"}]"
    },
    {
      "key": "METRICS_API_URL",
      "service": "studio",
      "description": "Provide a value for METRICS_API_URL.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "NEXTAUTH_SECRET",
      "service": "studio",
      "description": "Generated NextAuth secret.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "NEXT_PUBLIC_ENV",
      "service": "studio",
      "description": "Environment label shown by InsightHub.",
      "secret": false,
      "strategy": "default",
      "default": "staging"
    },
    {
      "key": "ASSISTANT_BASEURL",
      "service": "studio",
      "description": "Private Railway URL for Runtime.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "TRUSTLENS_API_URL",
      "service": "studio",
      "description": "Provide a value for TRUSTLENS_API_URL.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "WHATSAPP_PROVIDER",
      "service": "studio",
      "description": "Provide a value for WHATSAPP_PROVIDER.",
      "secret": false,
      "strategy": "default",
      "default": "kapso"
    },
    {
      "key": "KAPSO_API_BASE_URL",
      "service": "studio",
      "description": "Provide a value for KAPSO_API_BASE_URL.",
      "secret": false,
      "strategy": "default",
      "default": "https://kapso-proxy-production.up.railway.app"
    },
    {
      "key": "NEXT_PUBLIC_APP_URL",
      "service": "studio",
      "description": "Public Railway URL exposed to InsightHub frontend.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "TRUSTLENS_API_TOKEN",
      "service": "studio",
      "description": "Provide a value for TRUSTLENS_API_TOKEN.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "EXTERNAL_REGISTRY_URL",
      "service": "studio",
      "description": "Provide a value for EXTERNAL_REGISTRY_URL.",
      "secret": false,
      "strategy": "default",
      "default": "registry-proxy-production.up.railway.app/alquimia-hub"
    },
    {
      "key": "RUNTIME_PUBLIC_BASE_URL",
      "service": "studio",
      "description": "Provide a value for RUNTIME_PUBLIC_BASE_URL.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "NEXT_PUBLIC_AUTH_STRATEGY",
      "service": "studio",
      "description": "Exposes Lite auth strategy to the InsightHub frontend.",
      "secret": false,
      "strategy": "default",
      "default": "lite"
    },
    {
      "key": "ALQUIMIA_ASSISTANT_API_KEY",
      "service": "studio",
      "description": "Runtime API token reference used by InsightHub.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "NEXT_PUBLIC_DEFAULT_TENANT",
      "service": "studio",
      "description": "Default tenant used by InsightHub.",
      "secret": false,
      "strategy": "default",
      "default": "alquimia"
    },
    {
      "key": "PORT",
      "service": "runtime",
      "description": "Internal HTTP port exposed by Runtime.",
      "secret": false,
      "strategy": "default",
      "default": "8080"
    },
    {
      "key": "API_TOKEN",
      "service": "runtime",
      "description": "Shared internal API token generated by Runtime.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "REDIS_URL",
      "service": "runtime",
      "description": "Redis URL used by Runtime.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "QDRANT_URL",
      "service": "runtime",
      "description": "Private Railway URL for Qdrant vector storage.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "VAULT_ADDR",
      "service": "runtime",
      "description": "Private Railway URL for Vault.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "KAFKA_TOPIC",
      "service": "runtime",
      "description": "Kafka topic used by Runtime.",
      "secret": false,
      "strategy": "default",
      "default": "alquimia.events"
    },
    {
      "key": "POSTGRES_DB",
      "service": "runtime",
      "description": "Runtime database name.",
      "secret": false,
      "strategy": "default",
      "default": "alquimia_runtime"
    },
    {
      "key": "VAULT_TOKEN",
      "service": "runtime",
      "description": "Vault token reference used by Runtime.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "AUTH_PROVIDER",
      "service": "runtime",
      "description": "Authentication provider used by Runtime.",
      "secret": false,
      "strategy": "default",
      "default": "api_token"
    },
    {
      "key": "DOCKER_CONFIG",
      "service": "runtime",
      "description": "Provide a value for DOCKER_CONFIG.",
      "secret": false,
      "strategy": "default",
      "default": "/root/.docker"
    },
    {
      "key": "KAPSO_API_KEY",
      "service": "runtime",
      "description": "Provide a value for KAPSO_API_KEY.",
      "secret": true,
      "strategy": "default",
      "default": "c10ebbdf525b4679ff2509cb84ce67d71cee71b6ae24efe4"
    },
    {
      "key": "ORAS_INSECURE",
      "service": "runtime",
      "description": "Provide a value for ORAS_INSECURE.",
      "secret": false,
      "strategy": "default",
      "default": "false"
    },
    {
      "key": "POSTGRES_HOST",
      "service": "runtime",
      "description": "Private Railway hostname for Runtime Postgres.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "POSTGRES_PORT",
      "service": "runtime",
      "description": "Runtime Postgres port.",
      "secret": false,
      "strategy": "default",
      "default": "5432"
    },
    {
      "key": "BLOB_S3_SECURE",
      "service": "runtime",
      "description": "Disables HTTPS for private MinIO traffic.",
      "secret": false,
      "strategy": "default",
      "default": "False"
    },
    {
      "key": "QDRANT_API_KEY",
      "service": "runtime",
      "description": "Optional Qdrant API key placeholder.",
      "secret": true,
      "strategy": "default",
      "default": "unused"
    },
    {
      "key": "ALLOWED_ORIGINS",
      "service": "runtime",
      "description": "CORS allowed origins for Runtime.",
      "secret": false,
      "strategy": "default",
      "default": "[\"*\"]"
    },
    {
      "key": "ORAS_PLAIN_HTTP",
      "service": "runtime",
      "description": "Provide a value for ORAS_PLAIN_HTTP.",
      "secret": false,
      "strategy": "default",
      "default": "false"
    },
    {
      "key": "RAILWAY_RUN_UID",
      "service": "runtime",
      "description": "Runs Runtime as root so it can write to the Railway mounted volume.",
      "secret": false,
      "strategy": "default",
      "default": "0"
    },
    {
      "key": "KAFKA_SIGNING_KEY",
      "service": "runtime",
      "description": "32-byte hex signing key for Kafka events.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "POSTGRES_PASSWORD",
      "service": "runtime",
      "description": "Runtime Postgres password reference.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "POSTGRES_USERNAME",
      "service": "runtime",
      "description": "Runtime database username.",
      "secret": false,
      "strategy": "default",
      "default": "postgres"
    },
    {
      "key": "VAULT_MOUNT_POINT",
      "service": "runtime",
      "description": "Vault KV mount point.",
      "secret": false,
      "strategy": "default",
      "default": "secret"
    },
    {
      "key": "BLOB_S3_ACCESS_KEY",
      "service": "runtime",
      "description": "MinIO root user reference.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "BLOB_S3_SECRET_KEY",
      "service": "runtime",
      "description": "MinIO root password reference.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "KAPSO_API_BASE_URL",
      "service": "runtime",
      "description": "Provide a value for KAPSO_API_BASE_URL.",
      "secret": false,
      "strategy": "default",
      "default": "https://kapso-proxy-production.up.railway.app"
    },
    {
      "key": "BACKEND_SERVER_HOST",
      "service": "runtime",
      "description": "Host address Runtime binds to inside Railway.",
      "secret": false,
      "strategy": "default",
      "default": "0.0.0.0"
    },
    {
      "key": "BACKEND_SERVER_PORT",
      "service": "runtime",
      "description": "Runtime backend port.",
      "secret": false,
      "strategy": "default",
      "default": "8080"
    },
    {
      "key": "BLOB_S3_BUCKET_NAME",
      "service": "runtime",
      "description": "MinIO bucket used by Alquimia.",
      "secret": false,
      "strategy": "default",
      "default": "alquimia"
    },
    {
      "key": "REGISTRY_PROXY_HOST",
      "service": "runtime",
      "description": "Provide a value for REGISTRY_PROXY_HOST.",
      "secret": false,
      "strategy": "default",
      "default": "registry-proxy-production.up.railway.app"
    },
    {
      "key": "BLOB_S3_ENDPOINT_URL",
      "service": "runtime",
      "description": "Private Railway URL for MinIO S3-compatible storage.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "DB_CREATE_ON_STARTUP",
      "service": "runtime",
      "description": "Allows Runtime to create database schema on startup.",
      "secret": false,
      "strategy": "default",
      "default": "True"
    },
    {
      "key": "KAFKA_CONSUMER_GROUP",
      "service": "runtime",
      "description": "Kafka consumer group used by Runtime workers.",
      "secret": false,
      "strategy": "default",
      "default": "alquimia-workers"
    },
    {
      "key": "ALQUIMIA_REGISTRY_DIR",
      "service": "runtime",
      "description": "Local registry artifact path mounted as a Railway volume.",
      "secret": false,
      "strategy": "default",
      "default": "/data"
    },
    {
      "key": "ALQUIMIA_RUNTIME_MODE",
      "service": "runtime",
      "description": "Provide a value for ALQUIMIA_RUNTIME_MODE.",
      "secret": false,
      "strategy": "default",
      "default": "all"
    },
    {
      "key": "BACKEND_SERVER_WORKERS",
      "service": "runtime",
      "description": "Number of Runtime backend workers.",
      "secret": false,
      "strategy": "default",
      "default": "1"
    },
    {
      "key": "IS_ALLOWED_CREDENTIALS",
      "service": "runtime",
      "description": "Disables credentialed CORS for wildcard origins.",
      "secret": false,
      "strategy": "default",
      "default": "False"
    },
    {
      "key": "KAFKA_BOOTSTRAP_SERVERS",
      "service": "runtime",
      "description": "Kafka broker used by Runtime event publishing.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "KAFKA_SECURITY_PROTOCOL",
      "service": "runtime",
      "description": "Private Railway Kafka protocol.",
      "secret": false,
      "strategy": "default",
      "default": "PLAINTEXT"
    },
    {
      "key": "REGISTRY_PROXY_PASSWORD",
      "service": "runtime",
      "description": "Provide a value for REGISTRY_PROXY_PASSWORD.",
      "secret": true,
      "strategy": "default",
      "default": "cP+eq04roLjYfLCo1//uWTY4ChMIPeqOic778kvnpaFUVWlicumwUX9fzAZGC6nB"
    },
    {
      "key": "REGISTRY_PROXY_USERNAME",
      "service": "runtime",
      "description": "Provide a value for REGISTRY_PROXY_USERNAME.",
      "secret": false,
      "strategy": "default",
      "default": "alquimia-proxy"
    },
    {
      "key": "ALQUIMIA_LOCAL_SESSIONS_DIR",
      "service": "runtime",
      "description": "Local Runtime session directory.",
      "secret": false,
      "strategy": "default",
      "default": "/tmp/alquimia-sessions"
    },
    {
      "key": "ALQUIMIA_OCI_REGISTRY_DEFAULT",
      "service": "runtime",
      "description": "Provide a value for ALQUIMIA_OCI_REGISTRY_DEFAULT.",
      "secret": false,
      "strategy": "default",
      "default": "registry-proxy-production.up.railway.app"
    },
    {
      "key": "ALQUIMIA_REGISTRY_SECRET_RESOLVER",
      "service": "runtime",
      "description": "Secret resolver used by Runtime.",
      "secret": true,
      "strategy": "default",
      "default": "vault"
    },
    {
      "key": "PORT",
      "service": "qdrant",
      "description": "Internal Qdrant HTTP API port.",
      "secret": false,
      "strategy": "default",
      "default": "6333"
    },
    {
      "key": "PORT",
      "service": "minio",
      "description": "Internal MinIO S3 API port.",
      "secret": false,
      "strategy": "default",
      "default": "9000"
    },
    {
      "key": "MINIO_ROOT_USER",
      "service": "minio",
      "description": "MinIO root user.",
      "secret": false,
      "strategy": "default",
      "default": "alquimia"
    },
    {
      "key": "MINIO_ROOT_PASSWORD",
      "service": "minio",
      "description": "Generated MinIO root password.",
      "secret": true,
      "strategy": "generate",
      "generate": "strong_password"
    },
    {
      "key": "PORT",
      "service": "trustlens-postgres",
      "description": "Provide a value for PORT.",
      "secret": false,
      "strategy": "default",
      "default": "5432"
    },
    {
      "key": "PGDATA",
      "service": "trustlens-postgres",
      "description": "Provide a value for PGDATA.",
      "secret": false,
      "strategy": "default",
      "default": "/var/lib/postgresql/data/pgdata"
    },
    {
      "key": "PGHOST",
      "service": "trustlens-postgres",
      "description": "Railway Private Domain Name.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "PGPORT",
      "service": "trustlens-postgres",
      "description": "Port to connect to Postgres.",
      "secret": false,
      "strategy": "default",
      "default": "5432"
    },
    {
      "key": "PGUSER",
      "service": "trustlens-postgres",
      "description": "Required variable for Data panel",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "PGDATABASE",
      "service": "trustlens-postgres",
      "description": "Required variable for the data panel.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "PGPASSWORD",
      "service": "trustlens-postgres",
      "description": "Required variable for Data panel",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "POSTGRES_DB",
      "service": "trustlens-postgres",
      "description": "Provide a value for POSTGRES_DB.",
      "secret": false,
      "strategy": "default",
      "default": "trustlens"
    },
    {
      "key": "DATABASE_URL",
      "service": "trustlens-postgres",
      "description": "URL to connect to Postgres database.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "POSTGRES_USER",
      "service": "trustlens-postgres",
      "description": "User to connect to Postgres DB",
      "secret": false,
      "strategy": "default",
      "default": "postgres"
    },
    {
      "key": "SSL_CERT_DAYS",
      "service": "trustlens-postgres",
      "description": "SSL certificate expiry in days.",
      "secret": false,
      "strategy": "default",
      "default": "820"
    },
    {
      "key": "POSTGRES_PASSWORD",
      "service": "trustlens-postgres",
      "description": "Provide a value for POSTGRES_PASSWORD.",
      "secret": true,
      "strategy": "generate",
      "generate": "strong_password"
    },
    {
      "key": "DATABASE_PUBLIC_URL",
      "service": "trustlens-postgres",
      "description": "Public URL to connect to Postgres database, used by the Data panel.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS",
      "service": "trustlens-postgres",
      "description": "Allow Postgres to cleanly shut down",
      "secret": false,
      "strategy": "default",
      "default": "60"
    }
  ],
  "deploy": {
    "mcp": {
      "server": "railway",
      "tool": "deploy_template",
      "args": {
        "template_code": "alquimia-stack-2"
      }
    },
    "cli": "railway deploy --template alquimia-stack-2",
    "api": {
      "method": "POST",
      "path": "/graphql/v2",
      "body": {
        "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }",
        "variables": {
          "input": {
            "templateId": "8906dd6a-3532-45ab-904a-f08f807a80df",
            "serializedConfig": {
              "buckets": {},
              "services": {
                "1160a830-1404-4436-af06-61bc8412212b": {
                  "icon": "https://cdn.simpleicons.org/minio/white",
                  "name": "minio-init",
                  "deploy": {
                    "startCommand": "sh -lc 'until mc alias set minio http://minio.railway.internal:9000 \"$MINIO_ROOT_USER\" \"$MINIO_ROOT_PASSWORD\"; do sleep 2; done; mc mb --ignore-existing minio/alquimia'",
                    "healthcheckPath": null,
                    "restartPolicyType": "NEVER",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "minio/mc:latest"
                  },
                  "variables": {
                    "MINIO_ROOT_USER": {
                      "isOptional": false,
                      "description": "MinIO root user reference.",
                      "defaultValue": "${{minio.MINIO_ROOT_USER}}"
                    },
                    "MINIO_ROOT_PASSWORD": {
                      "isOptional": false,
                      "description": "MinIO root password reference.",
                      "defaultValue": "${{minio.MINIO_ROOT_PASSWORD}}"
                    }
                  }
                },
                "3410e9d3-17bd-4c29-83c0-d5e69c79928f": {
                  "icon": "https://cdn.simpleicons.org/redis/white",
                  "name": "redis",
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "redis:7"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Internal Redis port.",
                      "defaultValue": "6379"
                    }
                  },
                  "haTemplateCode": "redis-ha",
                  "haConversionConfig": {
                    "edge": {
                      "label": "Reverse Proxies",
                      "options": [
                        1,
                        2
                      ],
                      "nodeLabel": "HAProxy",
                      "description": "HAProxy instances routing writes to the primary",
                      "defaultValue": 2
                    },
                    "replica": {
                      "label": "Redis Replicas",
                      "options": [
                        2,
                        3,
                        4,
                        5
                      ],
                      "nodeLabel": "Redis",
                      "description": "Nodes running Redis + colocated Sentinel",
                      "defaultValue": 2
                    },
                    "internal": null,
                    "description": "This will convert your Redis instance to an HA cluster with Sentinel failover and HAProxy routing to the primary."
                  }
                },
                "39b461a1-3cba-4f3e-98e7-4be27d14e2ac": {
                  "icon": "https://cdn.simpleicons.org/opencontainersinitiative/white",
                  "name": "oras-registry",
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "ghcr.io/oras-project/registry"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Internal ORAS registry port.",
                      "defaultValue": "5000"
                    }
                  },
                  "volumeMounts": {
                    "39b461a1-3cba-4f3e-98e7-4be27d14e2ac": {
                      "mountPath": "/var/lib/registry"
                    }
                  }
                },
                "48fcbec4-55a7-4dcf-9587-09d73d534265": {
                  "icon": "https://cdn.simpleicons.org/postgresql/white",
                  "name": "runtime-postgres",
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "postgres:latest"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Internal Postgres port for Runtime database.",
                      "defaultValue": "5432"
                    },
                    "PGDATA": {
                      "isOptional": false,
                      "description": "Postgres data directory mounted on the Railway volume.",
                      "defaultValue": "/var/lib/postgresql/data/pgdata"
                    },
                    "POSTGRES_DB": {
                      "isOptional": false,
                      "description": "Runtime database name.",
                      "defaultValue": "alquimia_runtime"
                    },
                    "POSTGRES_USER": {
                      "isOptional": false,
                      "description": "Runtime Postgres username.",
                      "defaultValue": "postgres"
                    },
                    "POSTGRES_PASSWORD": {
                      "isOptional": false,
                      "description": "Runtime Postgres password used by Runtime.",
                      "defaultValue": "alquimia_runtime_railway_2026"
                    }
                  },
                  "volumeMounts": {
                    "48fcbec4-55a7-4dcf-9587-09d73d534265": {
                      "mountPath": "/var/lib/postgresql/data"
                    }
                  }
                },
                "7d30e43f-e4c2-4c8d-8457-91a11f3b9dc3": {
                  "name": "kafka",
                  "deploy": {
                    "startCommand": "/usr/bin/rpk redpanda start --mode dev-container --smp 1 --memory 512M --overprovisioned --node-id 0 --check=false --kafka-addr 0.0.0.0:9092 --advertise-kafka-addr kafka.railway.internal:9092"
                  },
                  "source": {
                    "image": "redpandadata/redpanda:latest"
                  },
                  "variables": {
                    "PORT": {
                      "description": "Kafka broker port exposed on Railway private networking.",
                      "defaultValue": "9092"
                    }
                  }
                },
                "9f6cc835-1942-4c91-a711-a69a7acd46e9": {
                  "name": "prometheus",
                  "deploy": {
                    "healthcheckPath": "/-/ready"
                  },
                  "source": {
                    "image": "alquimiaai/prometheus:railway-v2",
                    "hasHiddenRegistryCredentials": true
                  },
                  "variables": {
                    "PORT": {
                      "defaultValue": "9090"
                    },
                    "PROMETHEUS_STORAGE_PATH": {
                      "defaultValue": "/prometheus"
                    },
                    "PROMETHEUS_TRUSTLENS_TARGET": {
                      "defaultValue": "${{trustlens.RAILWAY_PRIVATE_DOMAIN}}:8080"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>:9090": {
                        "port": 9090
                      }
                    }
                  },
                  "volumeMounts": {
                    "9f6cc835-1942-4c91-a711-a69a7acd46e9": {
                      "mountPath": "/prometheus"
                    }
                  }
                },
                "a5d1f48a-2ea7-48a1-a25f-dd43d538c003": {
                  "icon": "https://cdn.simpleicons.org/vault/white",
                  "name": "vault",
                  "deploy": {
                    "startCommand": "sh -lc 'vault server -dev -dev-listen-address=0.0.0.0:8200 -dev-root-token-id=\"$VAULT_DEV_ROOT_TOKEN_ID\"'",
                    "healthcheckPath": "/v1/sys/health",
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "alquimiaai/vault-railway:20260529",
                    "hasHiddenRegistryCredentials": true
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Internal Vault HTTP API port.",
                      "defaultValue": "8200"
                    },
                    "VAULT_DEV_ROOT_TOKEN_ID": {
                      "isOptional": false,
                      "description": "Generated Vault root token.",
                      "defaultValue": "{{VAULT_DEV_ROOT_TOKEN_ID}}"
                    }
                  }
                },
                "b0bbd573-01e7-474d-b097-4d92e13ed56e": {
                  "name": "trustlens",
                  "deploy": {
                    "healthcheckPath": "/health/readiness"
                  },
                  "source": {
                    "image": "alquimiaai/trustlens:stable-20260714-1613",
                    "hasHiddenRegistryCredentials": true
                  },
                  "variables": {
                    "VAULT_ADDR": {
                      "defaultValue": "http://${{vault.RAILWAY_PRIVATE_DOMAIN}}:8200"
                    },
                    "VAULT_TOKEN": {
                      "defaultValue": "${{vault.VAULT_DEV_ROOT_TOKEN_ID}}"
                    },
                    "DATABASE_URL": {
                      "defaultValue": "postgresql+asyncpg://postgres:${{trustlens-postgres.POSTGRES_PASSWORD}}@${{trustlens-postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/trustlens"
                    },
                    "VAULT_MOUNT_POINT": {
                      "defaultValue": "secret"
                    },
                    "TRUSTLENS_API_TOKEN": {
                      "defaultValue": "{{TRUSTLENS_API_TOKEN}}"
                    },
                    "TRUSTLENS_ENVIRONMENT": {
                      "description": "",
                      "defaultValue": "staging"
                    },
                    "TRUSTLENS_PROVIDER_ID": {
                      "defaultValue": "trustlens-gaussia"
                    },
                    "TRUSTLENS_WEBHOOK_URL": {
                      "defaultValue": "http://${{trustlens.RAILWAY_PRIVATE_DOMAIN}}:8080/webhooks/runtime"
                    },
                    "TRUSTLENS_RUNTIME_BASE_URL": {
                      "defaultValue": "http://${{runtime.RAILWAY_PRIVATE_DOMAIN}}:8080"
                    },
                    "TRUSTLENS_RUNTIME_API_TOKEN": {
                      "defaultValue": "${{runtime.API_TOKEN}}"
                    },
                    "TRUSTLENS_WORKER_CONCURRENCY": {
                      "defaultValue": "2"
                    },
                    "TRUSTLENS_WEBHOOK_SIGNING_KEY": {
                      "defaultValue": "{{TRUSTLENS_WEBHOOK_SIGNING_KEY}}"
                    }
                  }
                },
                "c4825e83-4549-4104-ad49-b5e17a8baf1c": {
                  "icon": "https://docs.alquimia.ai/favicon.ico",
                  "name": "studio",
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": "/",
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "alquimiaai/studio:latest",
                    "hasHiddenRegistryCredentials": true
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Internal HTTP port exposed by InsightHub.",
                      "defaultValue": "3000"
                    },
                    "NODE_ENV": {
                      "isOptional": false,
                      "description": "Runs InsightHub in production mode.",
                      "defaultValue": "production"
                    },
                    "API_TOKEN": {
                      "isOptional": false,
                      "description": "Shared internal token generated by Runtime.",
                      "defaultValue": "${{runtime.API_TOKEN}}"
                    },
                    "DB_STRATEGY": {
                      "isOptional": false,
                      "description": "Uses local Lite persistence for InsightHub.",
                      "defaultValue": "lite"
                    },
                    "DATABASE_URL": {
                      "isOptional": false,
                      "description": "SQLite database path mounted on the Railway volume.",
                      "defaultValue": "file:/app/.data/lite.db"
                    },
                    "NEXTAUTH_URL": {
                      "isOptional": false,
                      "description": "Public Railway URL for InsightHub auth callbacks.",
                      "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "TWYD_API_KEY": {
                      "isOptional": false,
                      "description": "Twyd API token reference used by InsightHub.",
                      "defaultValue": "${{runtime.API_TOKEN}}"
                    },
                    "TWYD_BASEURL": {
                      "isOptional": false,
                      "description": "Private Railway URL for Twyd API.",
                      "defaultValue": "http://${{twyd-api.RAILWAY_PRIVATE_DOMAIN}}:8000"
                    },
                    "AUTH_STRATEGY": {
                      "isOptional": false,
                      "description": "Enables Lite authentication for Railway deployments.",
                      "defaultValue": "lite"
                    },
                    "KAPSO_API_KEY": {
                      "isOptional": true,
                      "defaultValue": "c10ebbdf525b4679ff2509cb84ce67d71cee71b6ae24efe4"
                    },
                    "NEDB_DATA_DIR": {
                      "isOptional": false,
                      "description": "Mounted persistence directory for InsightHub Lite data.",
                      "defaultValue": "/app/.data"
                    },
                    "AUTH_LITE_USERS": {
                      "isOptional": false,
                      "description": "Lite auth users JSON provided by the deployer.",
                      "defaultValue": "[{\"email\":\"admin@alquimia.ai\",\"name\":\"Alquimia Admin\",\"password_hash\":\"JDJiJDEwJDFzZ2tVMDQwV0VsUHR3dFlhalMvWWVUeWJnRUg3c2NQZ2RaSmZaODFXLlVHaWt3RWF6dE9h\"}]"
                    },
                    "METRICS_API_URL": {
                      "defaultValue": "http://${{prometheus.RAILWAY_PRIVATE_DOMAIN}}:9090/api/v1"
                    },
                    "NEXTAUTH_SECRET": {
                      "isOptional": false,
                      "description": "Generated NextAuth secret.",
                      "defaultValue": "{{NEXTAUTH_SECRET}}"
                    },
                    "NEXT_PUBLIC_ENV": {
                      "isOptional": false,
                      "description": "Environment label shown by InsightHub.",
                      "defaultValue": "staging"
                    },
                    "ASSISTANT_BASEURL": {
                      "isOptional": false,
                      "description": "Private Railway URL for Runtime.",
                      "defaultValue": "http://${{runtime.RAILWAY_PRIVATE_DOMAIN}}:8080"
                    },
                    "TRUSTLENS_API_URL": {
                      "defaultValue": "http://${{trustlens.RAILWAY_PRIVATE_DOMAIN}}:8080"
                    },
                    "WHATSAPP_PROVIDER": {
                      "defaultValue": "kapso"
                    },
                    "KAPSO_API_BASE_URL": {
                      "defaultValue": "https://kapso-proxy-production.up.railway.app"
                    },
                    "NEXT_PUBLIC_APP_URL": {
                      "isOptional": false,
                      "description": "Public Railway URL exposed to InsightHub frontend.",
                      "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "TRUSTLENS_API_TOKEN": {
                      "defaultValue": "${{trustlens.TRUSTLENS_API_TOKEN}}"
                    },
                    "EXTERNAL_REGISTRY_URL": {
                      "defaultValue": "registry-proxy-production.up.railway.app/alquimia-hub"
                    },
                    "RUNTIME_PUBLIC_BASE_URL": {
                      "defaultValue": "https://${{runtime.RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "NEXT_PUBLIC_AUTH_STRATEGY": {
                      "isOptional": false,
                      "description": "Exposes Lite auth strategy to the InsightHub frontend.",
                      "defaultValue": "lite"
                    },
                    "ALQUIMIA_ASSISTANT_API_KEY": {
                      "isOptional": false,
                      "description": "Runtime API token reference used by InsightHub.",
                      "defaultValue": "${{runtime.API_TOKEN}}"
                    },
                    "NEXT_PUBLIC_DEFAULT_TENANT": {
                      "isOptional": false,
                      "description": "Default tenant used by InsightHub.",
                      "defaultValue": "alquimia"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>": {}
                    }
                  },
                  "volumeMounts": {
                    "c4825e83-4549-4104-ad49-b5e17a8baf1c": {
                      "mountPath": "/app/.data"
                    }
                  }
                },
                "cb1bafbb-5046-4317-ab22-2f8437ded92e": {
                  "icon": "https://docs.alquimia.ai/favicon.ico",
                  "name": "runtime",
                  "deploy": {
                    "startCommand": "sh -lc 'mkdir -p /data \"$DOCKER_CONFIG\" && printf \"%s\\n\" \"provider_id: inmemory\" \"params: {}\" > /data/embeddings.yaml && AUTH=\"$(printf \"%s:%s\" \"$REGISTRY_PROXY_USERNAME\" \"$REGISTRY_PROXY_PASSWORD\" | base64 | tr -d \"\\n\")\" && printf \"{\\\"auths\\\":{\\\"%s\\\":{\\\"username\\\":\\\"%s\\\",\\\"password\\\":\\\"%s\\\",\\\"auth\\\":\\\"%s\\\"}}}\\n\" \"$REGISTRY_PROXY_HOST\" \"$REGISTRY_PROXY_USERNAME\" \"$REGISTRY_PROXY_PASSWORD\" \"$AUTH\" > \"$DOCKER_CONFIG/config.json\" && chmod 600 \"$DOCKER_CONFIG/config.json\" && exec uv run --no-sync python src/main.py'",
                    "healthcheckPath": "/health/liveness",
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "alquimiaai/runtime:dev",
                    "hasHiddenRegistryCredentials": true
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Internal HTTP port exposed by Runtime.",
                      "defaultValue": "8080"
                    },
                    "API_TOKEN": {
                      "isOptional": false,
                      "description": "Shared internal API token generated by Runtime.",
                      "defaultValue": "{{API_TOKEN}}"
                    },
                    "REDIS_URL": {
                      "isOptional": false,
                      "description": "Redis URL used by Runtime.",
                      "defaultValue": "redis://${{redis.RAILWAY_PRIVATE_DOMAIN}}:6379/0"
                    },
                    "QDRANT_URL": {
                      "isOptional": false,
                      "description": "Private Railway URL for Qdrant vector storage.",
                      "defaultValue": "http://${{qdrant.RAILWAY_PRIVATE_DOMAIN}}:6333"
                    },
                    "VAULT_ADDR": {
                      "isOptional": false,
                      "description": "Private Railway URL for Vault.",
                      "defaultValue": "http://${{vault.RAILWAY_PRIVATE_DOMAIN}}:8200"
                    },
                    "KAFKA_TOPIC": {
                      "description": "Kafka topic used by Runtime.",
                      "defaultValue": "alquimia.events"
                    },
                    "POSTGRES_DB": {
                      "isOptional": false,
                      "description": "Runtime database name.",
                      "defaultValue": "alquimia_runtime"
                    },
                    "VAULT_TOKEN": {
                      "isOptional": false,
                      "description": "Vault token reference used by Runtime.",
                      "defaultValue": "${{vault.VAULT_DEV_ROOT_TOKEN_ID}}"
                    },
                    "AUTH_PROVIDER": {
                      "isOptional": false,
                      "description": "Authentication provider used by Runtime.",
                      "defaultValue": "api_token"
                    },
                    "DOCKER_CONFIG": {
                      "defaultValue": "/root/.docker"
                    },
                    "KAPSO_API_KEY": {
                      "isOptional": true,
                      "defaultValue": "c10ebbdf525b4679ff2509cb84ce67d71cee71b6ae24efe4"
                    },
                    "ORAS_INSECURE": {
                      "isOptional": false,
                      "defaultValue": "false"
                    },
                    "POSTGRES_HOST": {
                      "isOptional": false,
                      "description": "Private Railway hostname for Runtime Postgres.",
                      "defaultValue": "${{runtime-postgres.RAILWAY_PRIVATE_DOMAIN}}"
                    },
                    "POSTGRES_PORT": {
                      "isOptional": false,
                      "description": "Runtime Postgres port.",
                      "defaultValue": "5432"
                    },
                    "BLOB_S3_SECURE": {
                      "isOptional": false,
                      "description": "Disables HTTPS for private MinIO traffic.",
                      "defaultValue": "False"
                    },
                    "QDRANT_API_KEY": {
                      "isOptional": false,
                      "description": "Optional Qdrant API key placeholder.",
                      "defaultValue": "unused"
                    },
                    "ALLOWED_ORIGINS": {
                      "isOptional": false,
                      "description": "CORS allowed origins for Runtime.",
                      "defaultValue": "[\"*\"]"
                    },
                    "ORAS_PLAIN_HTTP": {
                      "isOptional": false,
                      "defaultValue": "false"
                    },
                    "RAILWAY_RUN_UID": {
                      "isOptional": false,
                      "description": "Runs Runtime as root so it can write to the Railway mounted volume.",
                      "defaultValue": "0"
                    },
                    "KAFKA_SIGNING_KEY": {
                      "description": "32-byte hex signing key for Kafka events.",
                      "defaultValue": "{{KAFKA_SIGNING_KEY}}"
                    },
                    "POSTGRES_PASSWORD": {
                      "isOptional": false,
                      "description": "Runtime Postgres password reference.",
                      "defaultValue": "${{runtime-postgres.POSTGRES_PASSWORD}}"
                    },
                    "POSTGRES_USERNAME": {
                      "isOptional": false,
                      "description": "Runtime database username.",
                      "defaultValue": "postgres"
                    },
                    "VAULT_MOUNT_POINT": {
                      "isOptional": false,
                      "description": "Vault KV mount point.",
                      "defaultValue": "secret"
                    },
                    "BLOB_S3_ACCESS_KEY": {
                      "isOptional": false,
                      "description": "MinIO root user reference.",
                      "defaultValue": "${{minio.MINIO_ROOT_USER}}"
                    },
                    "BLOB_S3_SECRET_KEY": {
                      "isOptional": false,
                      "description": "MinIO root password reference.",
                      "defaultValue": "${{minio.MINIO_ROOT_PASSWORD}}"
                    },
                    "KAPSO_API_BASE_URL": {
                      "defaultValue": "https://kapso-proxy-production.up.railway.app"
                    },
                    "BACKEND_SERVER_HOST": {
                      "isOptional": false,
                      "description": "Host address Runtime binds to inside Railway.",
                      "defaultValue": "0.0.0.0"
                    },
                    "BACKEND_SERVER_PORT": {
                      "isOptional": false,
                      "description": "Runtime backend port.",
                      "defaultValue": "8080"
                    },
                    "BLOB_S3_BUCKET_NAME": {
                      "isOptional": false,
                      "description": "MinIO bucket used by Alquimia.",
                      "defaultValue": "alquimia"
                    },
                    "REGISTRY_PROXY_HOST": {
                      "defaultValue": "registry-proxy-production.up.railway.app"
                    },
                    "BLOB_S3_ENDPOINT_URL": {
                      "isOptional": false,
                      "description": "Private Railway URL for MinIO S3-compatible storage.",
                      "defaultValue": "http://${{minio.RAILWAY_PRIVATE_DOMAIN}}:9000"
                    },
                    "DB_CREATE_ON_STARTUP": {
                      "isOptional": false,
                      "description": "Allows Runtime to create database schema on startup.",
                      "defaultValue": "True"
                    },
                    "KAFKA_CONSUMER_GROUP": {
                      "description": "Kafka consumer group used by Runtime workers.",
                      "defaultValue": "alquimia-workers"
                    },
                    "ALQUIMIA_REGISTRY_DIR": {
                      "isOptional": false,
                      "description": "Local registry artifact path mounted as a Railway volume.",
                      "defaultValue": "/data"
                    },
                    "ALQUIMIA_RUNTIME_MODE": {
                      "defaultValue": "all"
                    },
                    "BACKEND_SERVER_WORKERS": {
                      "isOptional": false,
                      "description": "Number of Runtime backend workers.",
                      "defaultValue": "1"
                    },
                    "IS_ALLOWED_CREDENTIALS": {
                      "isOptional": false,
                      "description": "Disables credentialed CORS for wildcard origins.",
                      "defaultValue": "False"
                    },
                    "KAFKA_BOOTSTRAP_SERVERS": {
                      "description": "Kafka broker used by Runtime event publishing.",
                      "defaultValue": "${{kafka.RAILWAY_PRIVATE_DOMAIN}}:9092"
                    },
                    "KAFKA_SECURITY_PROTOCOL": {
                      "description": "Private Railway Kafka protocol.",
                      "defaultValue": "PLAINTEXT"
                    },
                    "REGISTRY_PROXY_PASSWORD": {
                      "defaultValue": "cP+eq04roLjYfLCo1//uWTY4ChMIPeqOic778kvnpaFUVWlicumwUX9fzAZGC6nB"
                    },
                    "REGISTRY_PROXY_USERNAME": {
                      "defaultValue": "alquimia-proxy"
                    },
                    "ALQUIMIA_LOCAL_SESSIONS_DIR": {
                      "isOptional": false,
                      "description": "Local Runtime session directory.",
                      "defaultValue": "/tmp/alquimia-sessions"
                    },
                    "ALQUIMIA_OCI_REGISTRY_DEFAULT": {
                      "isOptional": false,
                      "defaultValue": "registry-proxy-production.up.railway.app"
                    },
                    "ALQUIMIA_REGISTRY_SECRET_RESOLVER": {
                      "isOptional": false,
                      "description": "Secret resolver used by Runtime.",
                      "defaultValue": "vault"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>": {}
                    }
                  },
                  "volumeMounts": {
                    "cb1bafbb-5046-4317-ab22-2f8437ded92e": {
                      "mountPath": "/data"
                    }
                  }
                },
                "da80d625-8349-4cb1-aad3-8b45db03d823": {
                  "icon": "https://cdn.simpleicons.org/qdrant/white",
                  "name": "qdrant",
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "qdrant/qdrant:latest"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Internal Qdrant HTTP API port.",
                      "defaultValue": "6333"
                    }
                  },
                  "volumeMounts": {
                    "da80d625-8349-4cb1-aad3-8b45db03d823": {
                      "mountPath": "/qdrant/storage"
                    }
                  }
                },
                "e5ed42d5-5eb7-43fd-8e35-c54f75531a44": {
                  "icon": "https://cdn.simpleicons.org/minio/white",
                  "name": "minio",
                  "deploy": {
                    "startCommand": "minio server --console-address :9001 /data",
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "quay.io/minio/minio:latest"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Internal MinIO S3 API port.",
                      "defaultValue": "9000"
                    },
                    "MINIO_ROOT_USER": {
                      "isOptional": false,
                      "description": "MinIO root user.",
                      "defaultValue": "alquimia"
                    },
                    "MINIO_ROOT_PASSWORD": {
                      "isOptional": false,
                      "description": "Generated MinIO root password.",
                      "defaultValue": "{{MINIO_ROOT_PASSWORD}}"
                    }
                  },
                  "volumeMounts": {
                    "e5ed42d5-5eb7-43fd-8e35-c54f75531a44": {
                      "mountPath": "/data"
                    }
                  }
                },
                "ee8a7605-01c2-480f-a16e-5a4e5ea41fab": {
                  "icon": "https://devicons.railway.app/i/postgresql.svg",
                  "name": "trustlens-postgres",
                  "build": {},
                  "deploy": {
                    "requiredMountPath": "/var/lib/postgresql/data"
                  },
                  "source": {
                    "image": "ghcr.io/railwayapp-templates/postgres-ssl:18"
                  },
                  "variables": {
                    "PORT": {
                      "defaultValue": "5432"
                    },
                    "PGDATA": {
                      "isOptional": false,
                      "defaultValue": "/var/lib/postgresql/data/pgdata"
                    },
                    "PGHOST": {
                      "isOptional": false,
                      "description": "Railway Private Domain Name.",
                      "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}"
                    },
                    "PGPORT": {
                      "isOptional": false,
                      "description": "Port to connect to Postgres.",
                      "defaultValue": "5432"
                    },
                    "PGUSER": {
                      "isOptional": false,
                      "description": "Required variable for Data panel",
                      "defaultValue": "${{ POSTGRES_USER }}"
                    },
                    "PGDATABASE": {
                      "isOptional": false,
                      "description": "Required variable for the data panel.",
                      "defaultValue": "${{POSTGRES_DB}}"
                    },
                    "PGPASSWORD": {
                      "isOptional": false,
                      "description": "Required variable for Data panel",
                      "defaultValue": "${{POSTGRES_PASSWORD}}"
                    },
                    "POSTGRES_DB": {
                      "isOptional": false,
                      "defaultValue": "trustlens"
                    },
                    "DATABASE_URL": {
                      "isOptional": false,
                      "description": "URL to connect to Postgres database.",
                      "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{PGDATABASE}}"
                    },
                    "POSTGRES_USER": {
                      "isOptional": false,
                      "description": "User to connect to Postgres DB",
                      "defaultValue": "postgres"
                    },
                    "SSL_CERT_DAYS": {
                      "isOptional": true,
                      "description": "SSL certificate expiry in days.",
                      "defaultValue": "820"
                    },
                    "POSTGRES_PASSWORD": {
                      "isOptional": false,
                      "defaultValue": "{{POSTGRES_PASSWORD}}"
                    },
                    "DATABASE_PUBLIC_URL": {
                      "description": "Public URL to connect to Postgres database, used by the Data panel.",
                      "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_TCP_PROXY_DOMAIN}}:${{RAILWAY_TCP_PROXY_PORT}}/${{PGDATABASE}}"
                    },
                    "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": {
                      "isOptional": false,
                      "description": "Allow Postgres to cleanly shut down",
                      "defaultValue": "60"
                    }
                  },
                  "networking": {
                    "tcpProxies": {
                      "5432": {}
                    },
                    "serviceDomains": {}
                  },
                  "volumeMounts": {
                    "ee8a7605-01c2-480f-a16e-5a4e5ea41fab": {
                      "mountPath": "/var/lib/postgresql/data"
                    }
                  },
                  "haTemplateCode": "postgres-ha",
                  "haConversionConfig": {
                    "edge": {
                      "label": "Reverse Proxy",
                      "options": [
                        2,
                        3,
                        4,
                        5
                      ],
                      "nodeLabel": "HAProxy",
                      "description": "Routes traffic to the primary",
                      "defaultValue": 3
                    },
                    "replica": {
                      "label": "Replicas",
                      "options": [
                        2,
                        3,
                        4,
                        5,
                        6,
                        7
                      ],
                      "nodeLabel": "Postgres",
                      "description": "Streaming replicas for automatic failover",
                      "defaultValue": 2
                    },
                    "internal": {
                      "label": "Coordinator Nodes",
                      "options": [
                        3,
                        5,
                        7,
                        9
                      ],
                      "nodeLabel": "etcd",
                      "defaultValue": 3
                    },
                    "description": "This will convert your Postgres database to an HA cluster with Patroni failover and etcd consensus."
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "post_deploy": {
    "healthcheck": {
      "service": "prometheus",
      "method": "GET",
      "path": "/-/ready",
      "expect_status": 200
    }
  },
  "resources": {
    "expected_services": 13,
    "needs_volume": true
  },
  "generated_at": "2026-09-20T10:14:37.339Z",
  "generator_version": "0.1.0",
  "status": "degraded",
  "validated_at": "2026-09-20T10:36:02.434Z",
  "success_rate_30d": 0.2,
  "validation": {
    "last_run_id": "run_baf60b243cd748edaf8f",
    "checks": [
      {
        "name": "workflow_completed",
        "passed": true
      },
      {
        "name": "all_services_deployed",
        "passed": false,
        "detail": "FAILED,SUCCESS,SUCCESS,DEPLOYING,QUEUED,SUCCESS,QUEUED,SUCCESS,SUCCESS,SUCCESS,QUEUED,SUCCESS,SUCCESS"
      }
    ],
    "typical_ready_seconds": 130,
    "typical_build_seconds": 0,
    "typical_start_seconds": 20,
    "slowest_service": "studio"
  }
}
