{ "manifest_version": "1.0.0", "template": { "id": "ad616da7-7b23-4993-8a76-2c64b53f3817", "slug": "apache-kafka", "name": "Apache Kafka | Open Source Event Streaming (KRaft, no ZooKeeper)", "description": "Kafka in KRaft mode with a web console — no ZooKeeper, data on a volume", "url": "https://railway.com/deploy/apache-kafka", "upstream": { "image": "kafbat/kafka-ui:v1.5.0" } }, "services": [ { "name": "Kafka-UI", "source": { "image": "kafbat/kafka-ui:v1.5.0" }, "needs_volume": false, "http": true }, { "name": "Kafka", "source": { "image": "apache/kafka:4.3.1" }, "needs_volume": true, "volume_mount_path": "/var/lib/kafka/data", "http": false } ], "required_inputs": [ { "key": "PORT", "service": "Kafka-UI", "description": "The port Railway routes public traffic to. Kept in step with SERVER_PORT.", "secret": false, "strategy": "default", "default": "8080" }, { "key": "AUTH_TYPE", "service": "Kafka-UI", "description": "Puts a login form in front of the UI. Leaving this unset would publish a console that can read every message and delete every topic to anyone who finds the URL.", "secret": false, "strategy": "default", "default": "LOGIN_FORM" }, { "key": "SERVER_PORT", "service": "Kafka-UI", "description": "Port the UI listens on.", "secret": false, "strategy": "default", "default": "8080" }, { "key": "KAFKA_CLUSTERS_0_NAME", "service": "Kafka-UI", "description": "Display name of the cluster in the UI.", "secret": false, "strategy": "default", "default": "railway" }, { "key": "DYNAMIC_CONFIG_ENABLED", "service": "Kafka-UI", "description": "Lets topics and cluster settings be edited from the UI rather than only viewed.", "secret": false, "strategy": "default", "default": "true" }, { "key": "SPRING_SECURITY_USER_NAME", "service": "Kafka-UI", "description": "Username for the UI login form.", "secret": false, "strategy": "default", "default": "admin" }, { "key": "SPRING_SECURITY_USER_PASSWORD", "service": "Kafka-UI", "description": "Password for the UI login form. Generated at deploy — copy it from the service variables on first use.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS", "service": "Kafka-UI", "description": "Bootstrap address of the broker, over the Railway private network.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PORT", "service": "Kafka", "description": "The port the broker listens on. Railway routes by this variable; Kafka itself never reads it.", "secret": false, "strategy": "default", "default": "9092" }, { "key": "CLUSTER_ID", "service": "Kafka", "description": "KRaft cluster id, 22 characters. Generated once and written into the volume on the first boot; the image refuses to start without it. Do not change it afterwards — it identifies the data already on disk.", "secret": false, "strategy": "generate", "generate": "random_base64_32" }, { "key": "KAFKA_NODE_ID", "service": "Kafka", "description": "Node id of this broker. Single-node cluster, so it stays 1.", "secret": false, "strategy": "default", "default": "1" }, { "key": "KAFKA_LOG_DIRS", "service": "Kafka", "description": "Where partitions live. A subdirectory of the volume, not its root: Railway puts a `lost+found` entry at the mount point and Kafka treats every entry in a log dir as a partition directory, which aborts the boot.", "secret": false, "strategy": "default", "default": "/var/lib/kafka/data/logs" }, { "key": "KAFKA_HEAP_OPTS", "service": "Kafka", "description": "JVM heap for the broker. Raise it together with the service memory if you push real throughput through this.", "secret": false, "strategy": "default", "default": "-Xms512m -Xmx512m" }, { "key": "KAFKA_LISTENERS", "service": "Kafka", "description": "Bind addresses. The host is left empty on purpose — the JVM binds a dual-stack wildcard socket, which is what Railway's IPv6-only private network needs. Writing 0.0.0.0 here makes kafka.railway.internal unreachable.", "secret": false, "strategy": "default", "default": "PLAINTEXT://:9092,CONTROLLER://:9093" }, { "key": "RAILWAY_RUN_UID", "service": "Kafka", "description": "Runs the container as root. The apache/kafka image sets `USER appuser`, and a non-root process cannot take ownership of a freshly attached Railway volume — without this the broker fails to write its log directory.", "secret": false, "strategy": "default", "default": "0" }, { "key": "KAFKA_PROCESS_ROLES", "service": "Kafka", "description": "KRaft combined mode: one process is both broker and controller, so there is no ZooKeeper to run.", "secret": false, "strategy": "default", "default": "broker,controller" }, { "key": "KAFKA_ADVERTISED_LISTENERS", "service": "Kafka", "description": "What clients are told to reconnect to after bootstrap. Without the private domain here the broker advertises its container hostname: the first connection works and every one after it times out.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "KAFKA_CONTROLLER_QUORUM_VOTERS", "service": "Kafka", "description": "The controller quorum. One voter, reached over loopback, because broker and controller are the same process.", "secret": false, "strategy": "default", "default": "1@localhost:9093" }, { "key": "KAFKA_AUTO_CREATE_TOPICS_ENABLE", "service": "Kafka", "description": "Creates a topic on first produce. Convenient for development; set to false if you would rather manage topics explicitly.", "secret": false, "strategy": "default", "default": "true" }, { "key": "KAFKA_CONTROLLER_LISTENER_NAMES", "service": "Kafka", "description": "Which listener carries the KRaft controller protocol.", "secret": false, "strategy": "default", "default": "CONTROLLER" }, { "key": "KAFKA_INTER_BROKER_LISTENER_NAME", "service": "Kafka", "description": "Which listener brokers use to talk to each other.", "secret": false, "strategy": "default", "default": "PLAINTEXT" }, { "key": "KAFKA_TRANSACTION_STATE_LOG_MIN_ISR", "service": "Kafka", "description": "Minimum in-sync replicas for the transaction state log. Must be 1 on a single broker.", "secret": false, "strategy": "default", "default": "1" }, { "key": "KAFKA_LISTENER_SECURITY_PROTOCOL_MAP", "service": "Kafka", "description": "Security protocol per listener. Both are PLAINTEXT: the broker is only reachable inside the Railway private network.", "secret": false, "strategy": "default", "default": "CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT" }, { "key": "KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS", "service": "Kafka", "description": "How long the coordinator waits for more consumers before the first rebalance. Zero makes a single consumer start immediately instead of after three seconds.", "secret": false, "strategy": "default", "default": "0" }, { "key": "KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR", "service": "Kafka", "description": "Replication factor of the consumer offsets topic. Must be 1 on a single broker, or the topic is never created and the first consumer group hangs.", "secret": false, "strategy": "default", "default": "1" }, { "key": "KAFKA_SHARE_COORDINATOR_STATE_TOPIC_MIN_ISR", "service": "Kafka", "description": "Minimum in-sync replicas for the share coordinator topic.", "secret": false, "strategy": "default", "default": "1" }, { "key": "KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR", "service": "Kafka", "description": "Same for the transaction state log. Must be 1 on a single broker.", "secret": false, "strategy": "default", "default": "1" }, { "key": "KAFKA_SHARE_COORDINATOR_STATE_TOPIC_REPLICATION_FACTOR", "service": "Kafka", "description": "Replication factor for the share coordinator topic used by Kafka 4 share groups.", "secret": false, "strategy": "default", "default": "1" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "apache-kafka" } }, "cli": "railway deploy --template apache-kafka", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "ad616da7-7b23-4993-8a76-2c64b53f3817", "serializedConfig": { "buckets": {}, "services": { "b9f62b27-8bce-4205-8c42-d4c433b15bf9": { "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/kafka.svg", "name": "Kafka-UI", "deploy": { "startCommand": null, "healthcheckPath": "/actuator/health", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 2 }, "source": { "image": "kafbat/kafka-ui:v1.5.0" }, "variables": { "PORT": { "isOptional": false, "description": "The port Railway routes public traffic to. Kept in step with SERVER_PORT.", "defaultValue": "8080" }, "AUTH_TYPE": { "isOptional": false, "description": "Puts a login form in front of the UI. Leaving this unset would publish a console that can read every message and delete every topic to anyone who finds the URL.", "defaultValue": "LOGIN_FORM" }, "SERVER_PORT": { "isOptional": false, "description": "Port the UI listens on.", "defaultValue": "8080" }, "KAFKA_CLUSTERS_0_NAME": { "isOptional": false, "description": "Display name of the cluster in the UI.", "defaultValue": "railway" }, "DYNAMIC_CONFIG_ENABLED": { "isOptional": false, "description": "Lets topics and cluster settings be edited from the UI rather than only viewed.", "defaultValue": "true" }, "SPRING_SECURITY_USER_NAME": { "isOptional": false, "description": "Username for the UI login form.", "defaultValue": "admin" }, "SPRING_SECURITY_USER_PASSWORD": { "isOptional": false, "description": "Password for the UI login form. Generated at deploy — copy it from the service variables on first use.", "defaultValue": "{{SPRING_SECURITY_USER_PASSWORD}}" }, "KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS": { "isOptional": false, "description": "Bootstrap address of the broker, over the Railway private network.", "defaultValue": "${{Kafka.RAILWAY_PRIVATE_DOMAIN}}:9092" } }, "networking": { "serviceDomains": { ":8080": { "port": 8080 } } } }, "ca15ff13-0048-4a1d-8dad-8058ac5a10cb": { "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/kafka.svg", "name": "Kafka", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 2 }, "source": { "image": "apache/kafka:4.3.1" }, "variables": { "PORT": { "isOptional": false, "description": "The port the broker listens on. Railway routes by this variable; Kafka itself never reads it.", "defaultValue": "9092" }, "CLUSTER_ID": { "isOptional": false, "description": "KRaft cluster id, 22 characters. Generated once and written into the volume on the first boot; the image refuses to start without it. Do not change it afterwards — it identifies the data already on disk.", "defaultValue": "{{CLUSTER_ID}}" }, "KAFKA_NODE_ID": { "isOptional": false, "description": "Node id of this broker. Single-node cluster, so it stays 1.", "defaultValue": "1" }, "KAFKA_LOG_DIRS": { "isOptional": false, "description": "Where partitions live. A subdirectory of the volume, not its root: Railway puts a `lost+found` entry at the mount point and Kafka treats every entry in a log dir as a partition directory, which aborts the boot.", "defaultValue": "/var/lib/kafka/data/logs" }, "KAFKA_HEAP_OPTS": { "isOptional": false, "description": "JVM heap for the broker. Raise it together with the service memory if you push real throughput through this.", "defaultValue": "-Xms512m -Xmx512m" }, "KAFKA_LISTENERS": { "isOptional": false, "description": "Bind addresses. The host is left empty on purpose — the JVM binds a dual-stack wildcard socket, which is what Railway's IPv6-only private network needs. Writing 0.0.0.0 here makes kafka.railway.internal unreachable.", "defaultValue": "PLAINTEXT://:9092,CONTROLLER://:9093" }, "RAILWAY_RUN_UID": { "isOptional": false, "description": "Runs the container as root. The apache/kafka image sets `USER appuser`, and a non-root process cannot take ownership of a freshly attached Railway volume — without this the broker fails to write its log directory.", "defaultValue": "0" }, "KAFKA_PROCESS_ROLES": { "isOptional": false, "description": "KRaft combined mode: one process is both broker and controller, so there is no ZooKeeper to run.", "defaultValue": "broker,controller" }, "KAFKA_ADVERTISED_LISTENERS": { "isOptional": false, "description": "What clients are told to reconnect to after bootstrap. Without the private domain here the broker advertises its container hostname: the first connection works and every one after it times out.", "defaultValue": "PLAINTEXT://${{RAILWAY_PRIVATE_DOMAIN}}:9092" }, "KAFKA_CONTROLLER_QUORUM_VOTERS": { "isOptional": false, "description": "The controller quorum. One voter, reached over loopback, because broker and controller are the same process.", "defaultValue": "1@localhost:9093" }, "KAFKA_AUTO_CREATE_TOPICS_ENABLE": { "isOptional": false, "description": "Creates a topic on first produce. Convenient for development; set to false if you would rather manage topics explicitly.", "defaultValue": "true" }, "KAFKA_CONTROLLER_LISTENER_NAMES": { "isOptional": false, "description": "Which listener carries the KRaft controller protocol.", "defaultValue": "CONTROLLER" }, "KAFKA_INTER_BROKER_LISTENER_NAME": { "isOptional": false, "description": "Which listener brokers use to talk to each other.", "defaultValue": "PLAINTEXT" }, "KAFKA_TRANSACTION_STATE_LOG_MIN_ISR": { "isOptional": false, "description": "Minimum in-sync replicas for the transaction state log. Must be 1 on a single broker.", "defaultValue": "1" }, "KAFKA_LISTENER_SECURITY_PROTOCOL_MAP": { "isOptional": false, "description": "Security protocol per listener. Both are PLAINTEXT: the broker is only reachable inside the Railway private network.", "defaultValue": "CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT" }, "KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS": { "isOptional": false, "description": "How long the coordinator waits for more consumers before the first rebalance. Zero makes a single consumer start immediately instead of after three seconds.", "defaultValue": "0" }, "KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR": { "isOptional": false, "description": "Replication factor of the consumer offsets topic. Must be 1 on a single broker, or the topic is never created and the first consumer group hangs.", "defaultValue": "1" }, "KAFKA_SHARE_COORDINATOR_STATE_TOPIC_MIN_ISR": { "isOptional": false, "description": "Minimum in-sync replicas for the share coordinator topic.", "defaultValue": "1" }, "KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR": { "isOptional": false, "description": "Same for the transaction state log. Must be 1 on a single broker.", "defaultValue": "1" }, "KAFKA_SHARE_COORDINATOR_STATE_TOPIC_REPLICATION_FACTOR": { "isOptional": false, "description": "Replication factor for the share coordinator topic used by Kafka 4 share groups.", "defaultValue": "1" } }, "volumeMounts": { "ca15ff13-0048-4a1d-8dad-8058ac5a10cb": { "mountPath": "/var/lib/kafka/data" } } } } } } } } } }, "post_deploy": { "healthcheck": { "service": "Kafka-UI", "method": "GET", "path": "/actuator/health", "expect_status": 200 } }, "resources": { "expected_services": 2, "needs_volume": true }, "generated_at": "2026-09-19T04:14:37.968Z", "generator_version": "0.1.0", "status": "validated", "validated_at": "2026-09-17T10:06:06.355Z", "success_rate_30d": 1, "validation": { "last_run_id": "run_215d2a3fc35f4e6aa576", "checks": [ { "name": "workflow_completed", "passed": true }, { "name": "all_services_deployed", "passed": true }, { "name": "healthcheck", "passed": true }, { "name": "stays_up", "passed": true } ], "typical_ready_seconds": 64, "typical_build_seconds": 0, "typical_start_seconds": 10, "slowest_service": "Kafka-UI" } }