{
  "manifest_version": "1.0.0",
  "template": {
    "id": "164da96a-3c28-4582-90b0-2e6694c15d15",
    "slug": "bifrost-gateway-go",
    "name": "Bifrost Gateway (Go)",
    "description": "Go LLM gateway with dashboard auth on, virtual keys, budgets and fallbacks",
    "url": "https://railway.com/deploy/bifrost-gateway-go",
    "upstream": {
      "image": "maximhq/bifrost:v2.2.1"
    }
  },
  "services": [
    {
      "name": "Bifrost",
      "source": {
        "image": "maximhq/bifrost:v2.2.1"
      },
      "needs_volume": true,
      "volume_mount_path": "/app/data",
      "http": true
    }
  ],
  "required_inputs": [
    {
      "key": "PORT",
      "service": "Bifrost",
      "description": "Port Railway's healthcheck and edge proxy probe. Must equal APP_PORT (8080).",
      "secret": false,
      "strategy": "default",
      "default": "8080"
    },
    {
      "key": "APP_DIR",
      "service": "Bifrost",
      "description": "Application data directory (config.db, logs.db, optional config.json). Must match the volume mount path.",
      "secret": false,
      "strategy": "default",
      "default": "/app/data"
    },
    {
      "key": "APP_HOST",
      "service": "Bifrost",
      "description": "Bind address passed as -host. '::' binds dual-stack so other Railway services can reach http://bifrost.railway.internal:8080 over IPv6. Use 0.0.0.0 (upstream default) if you only need IPv4.",
      "secret": false,
      "strategy": "default",
      "default": "::"
    },
    {
      "key": "APP_PORT",
      "service": "Bifrost",
      "description": "Port the Bifrost gateway, dashboard, and /health listen on. The image entrypoint passes it as -port. Keep equal to PORT.",
      "secret": false,
      "strategy": "default",
      "default": "8080"
    },
    {
      "key": "LOG_LEVEL",
      "service": "Bifrost",
      "description": "Optional. Process log level: debug, info, warn, or error.",
      "secret": false,
      "strategy": "default",
      "default": "info"
    },
    {
      "key": "LOG_STYLE",
      "service": "Bifrost",
      "description": "Optional. Process log format: json or pretty.",
      "secret": false,
      "strategy": "default",
      "default": "json"
    },
    {
      "key": "RAILWAY_RUN_UID",
      "service": "Bifrost",
      "description": "Run the container as root. Required because the image runs as UID 1000 and Railway volumes mount root-owned; without this Bifrost exits with 'APP_DIR is not writable'.",
      "secret": false,
      "strategy": "default",
      "default": "0"
    },
    {
      "key": "BIFROST_SETUP_TOKEN",
      "service": "Bifrost",
      "description": "Only needed if you turn dashboard auth off and later create the first admin through the UI. Auth is already on by default in this template.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "BIFROST_ADMIN_PASSWORD",
      "service": "Bifrost",
      "description": "Dashboard and admin API password, generated at deploy. Bifrost requires 12+ characters with upper case, lower case, a number and a symbol; the Aa1! suffix guarantees that. Change it in Workspace, Config, Security.",
      "secret": true,
      "strategy": "generate",
      "generate": "strong_password"
    },
    {
      "key": "BIFROST_ADMIN_USERNAME",
      "service": "Bifrost",
      "description": "Dashboard and admin API username. Referenced from config.json as env.BIFROST_ADMIN_USERNAME, so the credential itself is never written to the config file.",
      "secret": false,
      "strategy": "default",
      "default": "admin"
    },
    {
      "key": "BIFROST_ENCRYPTION_KEY",
      "service": "Bifrost",
      "description": "Encrypts provider keys and other secrets at rest (Argon2id-derived AES-256). Set once; changing it makes stored secrets unreadable.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS",
      "service": "Bifrost",
      "description": "Optional. Seconds Railway waits after SIGTERM so in-flight streamed responses can finish. Bifrost allows up to 30s of internal cleanup.",
      "secret": false,
      "strategy": "default",
      "default": "60"
    }
  ],
  "deploy": {
    "mcp": {
      "server": "railway",
      "tool": "deploy_template",
      "args": {
        "template_code": "bifrost-gateway-go"
      }
    },
    "cli": "railway deploy --template bifrost-gateway-go",
    "api": {
      "method": "POST",
      "path": "/graphql/v2",
      "body": {
        "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }",
        "variables": {
          "input": {
            "templateId": "164da96a-3c28-4582-90b0-2e6694c15d15",
            "serializedConfig": {
              "services": {
                "45d9b481-ca05-42db-89b3-ffa9bdc0dc59": {
                  "icon": "https://avatars.githubusercontent.com/u/139708451?v=4",
                  "name": "Bifrost",
                  "build": {},
                  "deploy": {
                    "startCommand": "sh -c 'mkdir -p \"$APP_DIR\" && printf %s \"{\\\"client\\\":{\\\"enforce_auth_on_inference\\\":true},\\\"governance\\\":{\\\"auth_config\\\":{\\\"is_enabled\\\":true,\\\"admin_username\\\":\\\"env.BIFROST_ADMIN_USERNAME\\\",\\\"admin_password\\\":\\\"env.BIFROST_ADMIN_PASSWORD\\\",\\\"disable_auth_on_inference\\\":false}}}\" > \"$APP_DIR/config.json\" && exec /app/docker-entrypoint.sh'",
                    "healthcheckPath": "/health",
                    "requiredMountPath": "/app/data",
                    "restartPolicyType": "ON_FAILURE",
                    "healthcheckTimeout": 300,
                    "restartPolicyMaxRetries": 5
                  },
                  "source": {
                    "image": "maximhq/bifrost:v2.2.1"
                  },
                  "variables": {
                    "PORT": {
                      "description": "Port Railway's healthcheck and edge proxy probe. Must equal APP_PORT (8080).",
                      "defaultValue": "8080"
                    },
                    "APP_DIR": {
                      "description": "Application data directory (config.db, logs.db, optional config.json). Must match the volume mount path.",
                      "defaultValue": "/app/data"
                    },
                    "APP_HOST": {
                      "description": "Bind address passed as -host. '::' binds dual-stack so other Railway services can reach http://bifrost.railway.internal:8080 over IPv6. Use 0.0.0.0 (upstream default) if you only need IPv4.",
                      "defaultValue": "::"
                    },
                    "APP_PORT": {
                      "description": "Port the Bifrost gateway, dashboard, and /health listen on. The image entrypoint passes it as -port. Keep equal to PORT.",
                      "defaultValue": "8080"
                    },
                    "LOG_LEVEL": {
                      "isOptional": true,
                      "description": "Optional. Process log level: debug, info, warn, or error.",
                      "defaultValue": "info"
                    },
                    "LOG_STYLE": {
                      "isOptional": true,
                      "description": "Optional. Process log format: json or pretty.",
                      "defaultValue": "json"
                    },
                    "OPENAI_API_KEY": {
                      "isOptional": true,
                      "description": "Optional. If set on first boot, Bifrost auto-registers an OpenAI provider using this variable. You can also add providers later in the dashboard.",
                      "defaultValue": ""
                    },
                    "RAILWAY_RUN_UID": {
                      "description": "Run the container as root. Required because the image runs as UID 1000 and Railway volumes mount root-owned; without this Bifrost exits with 'APP_DIR is not writable'.",
                      "defaultValue": "0"
                    },
                    "ANTHROPIC_API_KEY": {
                      "isOptional": true,
                      "description": "Optional. If set on first boot, Bifrost auto-registers an Anthropic provider using this variable. You can also add providers later in the dashboard.",
                      "defaultValue": ""
                    },
                    "BIFROST_SETUP_TOKEN": {
                      "isOptional": true,
                      "description": "Only needed if you turn dashboard auth off and later create the first admin through the UI. Auth is already on by default in this template.",
                      "defaultValue": "{{BIFROST_SETUP_TOKEN}}"
                    },
                    "BIFROST_ADMIN_PASSWORD": {
                      "description": "Dashboard and admin API password, generated at deploy. Bifrost requires 12+ characters with upper case, lower case, a number and a symbol; the Aa1! suffix guarantees that. Change it in Workspace, Config, Security.",
                      "defaultValue": "{{BIFROST_ADMIN_PASSWORD}}"
                    },
                    "BIFROST_ADMIN_USERNAME": {
                      "description": "Dashboard and admin API username. Referenced from config.json as env.BIFROST_ADMIN_USERNAME, so the credential itself is never written to the config file.",
                      "defaultValue": "admin"
                    },
                    "BIFROST_ENCRYPTION_KEY": {
                      "description": "Encrypts provider keys and other secrets at rest (Argon2id-derived AES-256). Set once; changing it makes stored secrets unreadable.",
                      "defaultValue": "{{BIFROST_ENCRYPTION_KEY}}"
                    },
                    "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": {
                      "isOptional": true,
                      "description": "Optional. Seconds Railway waits after SIGTERM so in-flight streamed responses can finish. Bifrost allows up to 30s of internal cleanup.",
                      "defaultValue": "60"
                    }
                  },
                  "networking": {
                    "tcpProxies": {},
                    "serviceDomains": {
                      "bifrost-dom": {
                        "port": 8080
                      }
                    }
                  },
                  "volumeMounts": {
                    "a9a3b954-23e0-4b0f-83e7-cefbda76dffc": {
                      "mountPath": "/app/data"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "post_deploy": {
    "healthcheck": {
      "service": "Bifrost",
      "method": "GET",
      "path": "/health",
      "expect_status": 200
    }
  },
  "resources": {
    "expected_services": 1,
    "needs_volume": true
  },
  "generated_at": "2026-09-20T16:14:49.616Z",
  "generator_version": "0.1.0",
  "status": "validated",
  "validated_at": "2026-09-20T13:22:41.348Z",
  "success_rate_30d": 1,
  "validation": {
    "last_run_id": "run_86c43302633842d2874c",
    "checks": [
      {
        "name": "workflow_completed",
        "passed": true
      },
      {
        "name": "all_services_deployed",
        "passed": true
      },
      {
        "name": "healthcheck",
        "passed": true
      },
      {
        "name": "stays_up",
        "passed": true
      }
    ],
    "typical_ready_seconds": 27,
    "typical_build_seconds": 0,
    "typical_start_seconds": 10,
    "slowest_service": "Bifrost"
  }
}