{
  "manifest_version": "1.0.0",
  "template": {
    "id": "145e3aaf-5c31-4db1-8110-1f7508160b47",
    "slug": "buzz-relay-workspace",
    "name": "Buzz | Open Source Slack Alternative with AI Agents",
    "description": "Self-hosted team chat with AI agents, git repos and QR pairing",
    "url": "https://railway.com/deploy/buzz-relay-workspace",
    "upstream": {
      "image": "ghcr.io/block/buzz:0.2.1"
    }
  },
  "services": [
    {
      "name": "Pairing",
      "source": {
        "image": "ghcr.io/block/buzz:0.2.1"
      },
      "needs_volume": false,
      "http": true
    },
    {
      "name": "Buzz",
      "source": {
        "image": "ghcr.io/block/buzz:0.2.1"
      },
      "needs_volume": false,
      "http": true
    },
    {
      "name": "Redis",
      "source": {
        "image": "redis:8.10.1-alpine"
      },
      "needs_volume": false,
      "http": false
    },
    {
      "name": "Postgres",
      "source": {
        "image": "postgres:18.6-alpine"
      },
      "needs_volume": true,
      "volume_mount_path": "/var/lib/postgresql",
      "http": false
    }
  ],
  "required_inputs": [
    {
      "key": "PORT",
      "service": "Pairing",
      "description": "Port Railway routes traffic to. Must match BUZZ_PAIR_RELAY_BIND_ADDR.",
      "secret": false,
      "strategy": "default",
      "default": "5000"
    },
    {
      "key": "BUZZ_PAIR_RELAY_BIND_ADDR",
      "service": "Pairing",
      "description": "Listen address for the pairing sidecar. Parsed strictly as a socket address, so the brackets are required.",
      "secret": false,
      "strategy": "default",
      "default": "[::]:5000"
    },
    {
      "key": "PORT",
      "service": "Buzz",
      "description": "Port Railway routes traffic and health checks to. Must match BUZZ_BIND_ADDR.",
      "secret": false,
      "strategy": "default",
      "default": "3000"
    },
    {
      "key": "RUST_LOG",
      "service": "Buzz",
      "description": "Log filters. tower_http=warn keeps one line per request out of the log; raise it to info while debugging a client.",
      "secret": false,
      "strategy": "default",
      "default": "buzz_relay=info,buzz_db=info,buzz_auth=info,buzz_pubsub=info,tower_http=warn"
    },
    {
      "key": "REDIS_URL",
      "service": "Buzz",
      "description": "Redis connection string, wired to the cache in this project.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "RELAY_URL",
      "service": "Buzz",
      "description": "Public WebSocket URL clients connect to. The relay derives its workspace from the host here - point it somewhere else and the relay serves a brand-new empty workspace instead of yours.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "DATABASE_URL",
      "service": "Buzz",
      "description": "Postgres connection string, wired to the database in this project.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "DB_WAIT_HOST",
      "service": "Buzz",
      "description": "Read by the start command, which waits for Postgres before starting the relay.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "DB_WAIT_PORT",
      "service": "Buzz",
      "description": "Port the start command waits on before starting the relay.",
      "secret": false,
      "strategy": "default",
      "default": "5432"
    },
    {
      "key": "BUZZ_BIND_ADDR",
      "service": "Buzz",
      "description": "Listen address. The brackets are required - the relay parses this as a socket address, and a bare :: is a parse error. The IPv6 wildcard stays dual-stack, so IPv4 health checks are answered too.",
      "secret": false,
      "strategy": "default",
      "default": "[::]:3000"
    },
    {
      "key": "BUZZ_S3_BUCKET",
      "service": "Buzz",
      "description": "Bucket holding media and git objects.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "BUZZ_S3_REGION",
      "service": "Buzz",
      "description": "Bucket region.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "REDIS_WAIT_HOST",
      "service": "Buzz",
      "description": "Read by the start command, which waits for Redis before starting the relay.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "REDIS_WAIT_PORT",
      "service": "Buzz",
      "description": "Port the start command waits on before starting the relay.",
      "secret": false,
      "strategy": "default",
      "default": "6379"
    },
    {
      "key": "BUZZ_S3_ENDPOINT",
      "service": "Buzz",
      "description": "Object storage endpoint. Media and every git repository live here.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "BUZZ_AUTO_MIGRATE",
      "service": "Buzz",
      "description": "Runs database migrations on start. Off by default upstream, which leaves a fresh database with no schema.",
      "secret": false,
      "strategy": "default",
      "default": "true"
    },
    {
      "key": "BUZZ_CORS_ORIGINS",
      "service": "Buzz",
      "description": "Browser origins allowed to call the REST API. The two tauri:// entries are the desktop app - remove them and the app connects but every request is blocked.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "BUZZ_GIT_REPO_PATH",
      "service": "Buzz",
      "description": "Scratch directory git repositories are hydrated into on demand. Not where they are stored - that is the bucket - so nothing here needs to survive a restart.",
      "secret": false,
      "strategy": "default",
      "default": "/data/git"
    },
    {
      "key": "BUZZ_S3_ACCESS_KEY",
      "service": "Buzz",
      "description": "Bucket access key.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "BUZZ_S3_SECRET_KEY",
      "service": "Buzz",
      "description": "Bucket secret key.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "RELAY_OWNER_PUBKEY",
      "service": "Buzz",
      "description": "Your Nostr public key - the account that owns this workspace and can invite everyone else. Paste either the npub1... form the Buzz app shows you or a 64-character hex key; this template converts npub to hex for you. It cannot be generated here because it is your identity, not the server's.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "BUZZ_MEDIA_BASE_URL",
      "service": "Buzz",
      "description": "Public URL prefix that uploaded media is served from.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "BUZZ_ALLOW_NIP_OA_AUTH",
      "service": "Buzz",
      "description": "Allows NIP-OA authentication, which is how agents attach to the workspace.",
      "secret": false,
      "strategy": "default",
      "default": "true"
    },
    {
      "key": "BUZZ_PAIRING_RELAY_URL",
      "service": "Buzz",
      "description": "Advertised in the relay's NIP-11 document so phones find the pairing sidecar. Without it clients guess at a /pair path that does not exist and QR pairing fails with a 404.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "BUZZ_RELAY_PRIVATE_KEY",
      "service": "Buzz",
      "description": "The relay's own signing identity, generated once for this deployment. Changing it invalidates every outstanding invite and makes already-signed membership events unverifiable.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "BUZZ_REQUIRE_AUTH_TOKEN",
      "service": "Buzz",
      "description": "Requires a token on REST calls. Turn it off only for local debugging.",
      "secret": true,
      "strategy": "default",
      "default": "true"
    },
    {
      "key": "BUZZ_MEDIA_SERVER_DOMAIN",
      "service": "Buzz",
      "description": "Domain advertised to clients for media uploads.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "BUZZ_S3_ADDRESSING_STYLE",
      "service": "Buzz",
      "description": "Railway buckets serve virtual-hosted URLs. Set this to path and every object read returns 404, which fails the git storage probe at boot.",
      "secret": false,
      "strategy": "default",
      "default": "virtual"
    },
    {
      "key": "BUZZ_GIT_HOOK_HMAC_SECRET",
      "service": "Buzz",
      "description": "Signs git hook callbacks. Generated once for this deployment.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "BUZZ_GIT_CONFORMANCE_PROBE",
      "service": "Buzz",
      "description": "Tests the bucket's conditional-write behaviour on start and refuses to serve git if it fails, instead of discovering the problem during a push.",
      "secret": false,
      "strategy": "default",
      "default": "true"
    },
    {
      "key": "BUZZ_REQUIRE_RELAY_MEMBERSHIP",
      "service": "Buzz",
      "description": "Restricts the workspace to invited members. Setting this to false makes every message readable by anyone who finds the URL.",
      "secret": false,
      "strategy": "default",
      "default": "true"
    },
    {
      "key": "PORT",
      "service": "Redis",
      "description": "Port Redis listens on inside the private network.",
      "secret": false,
      "strategy": "default",
      "default": "6379"
    },
    {
      "key": "PORT",
      "service": "Postgres",
      "description": "Port Postgres listens on inside the private network.",
      "secret": false,
      "strategy": "default",
      "default": "5432"
    },
    {
      "key": "POSTGRES_DB",
      "service": "Postgres",
      "description": "Database name. It is baked into the relay's connection string - renaming it here alone breaks the relay.",
      "secret": false,
      "strategy": "default",
      "default": "buzz"
    },
    {
      "key": "POSTGRES_USER",
      "service": "Postgres",
      "description": "Database user.",
      "secret": false,
      "strategy": "default",
      "default": "postgres"
    },
    {
      "key": "POSTGRES_PASSWORD",
      "service": "Postgres",
      "description": "Generated once for this deployment. Letters and digits only, because it is embedded in a connection URL.",
      "secret": true,
      "strategy": "generate",
      "generate": "strong_password"
    }
  ],
  "deploy": {
    "mcp": {
      "server": "railway",
      "tool": "deploy_template",
      "args": {
        "template_code": "buzz-relay-workspace"
      }
    },
    "cli": "railway deploy --template buzz-relay-workspace",
    "api": {
      "method": "POST",
      "path": "/graphql/v2",
      "body": {
        "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }",
        "variables": {
          "input": {
            "templateId": "145e3aaf-5c31-4db1-8110-1f7508160b47",
            "serializedConfig": {
              "buckets": {
                "fdbae948-3a26-4752-ac6e-0c33d4bd8529": {
                  "name": "Bucket"
                }
              },
              "services": {
                "4ac04131-b229-4e05-8ac5-d2b6c03bbcdb": {
                  "icon": "https://cdn.jsdelivr.net/gh/block/buzz@6e5c462ac524de60d7edb46c66130fd779cc9006/desktop/src-tauri/icons/icon.png",
                  "name": "Pairing",
                  "deploy": {
                    "startCommand": "/usr/local/bin/buzz-pair-relay",
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 2
                  },
                  "source": {
                    "image": "ghcr.io/block/buzz:0.2.1"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Port Railway routes traffic to. Must match BUZZ_PAIR_RELAY_BIND_ADDR.",
                      "defaultValue": "5000"
                    },
                    "BUZZ_PAIR_RELAY_BIND_ADDR": {
                      "isOptional": false,
                      "description": "Listen address for the pairing sidecar. Parsed strictly as a socket address, so the brackets are required.",
                      "defaultValue": "[::]:5000"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>:5000": {
                        "port": 5000
                      }
                    }
                  }
                },
                "530e1e54-94eb-49f4-8507-2db2a8b0034e": {
                  "icon": "https://cdn.jsdelivr.net/gh/block/buzz@6e5c462ac524de60d7edb46c66130fd779cc9006/desktop/src-tauri/icons/icon.png",
                  "name": "Buzz",
                  "deploy": {
                    "startCommand": "bash -c 'for i in $(seq 1 90); do (echo > /dev/tcp/$DB_WAIT_HOST/$DB_WAIT_PORT) 2>/dev/null && break; echo \"waiting for postgres ($i/90)\"; sleep 2; done; for i in $(seq 1 90); do (echo > /dev/tcp/$REDIS_WAIT_HOST/$REDIS_WAIT_PORT) 2>/dev/null && break; echo \"waiting for redis ($i/90)\"; sleep 2; done; o=$(printf %s \"$RELAY_OWNER_PUBKEY\" | tr \"[:upper:]\" \"[:lower:]\" | tr -d \"[:space:]\"); if [ -n \"$o\" ] && [ -z \"${o##npub1*}\" ]; then d=${o#npub1}; d=${d:0:${#d}-6}; cs=qpzry9x8gf2tvdw0s3jn54khce6mua7l; a=0; b=0; h=; for ((i=0;i<${#d};i++)); do c=${d:i:1}; t=${cs%%\"$c\"*}; if [ \"$t\" = \"$cs\" ]; then h=; break; fi; a=$(( (a<<5) | ${#t} )); b=$((b+5)); while [ $b -ge 8 ]; do b=$((b-8)); printf -v x \"%02x\" $(( (a>>b) & 255 )); h=$h$x; done; done; if [ ${#h} -eq 64 ]; then echo \"RELAY_OWNER_PUBKEY: decoded npub to hex\"; RELAY_OWNER_PUBKEY=$h; else echo \"RELAY_OWNER_PUBKEY: starts with npub1 but did not decode - passing it through unchanged\"; fi; else RELAY_OWNER_PUBKEY=$o; fi; export RELAY_OWNER_PUBKEY; exec /usr/local/bin/buzz-relay'",
                    "healthcheckPath": "/_readiness",
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "ghcr.io/block/buzz:0.2.1"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Port Railway routes traffic and health checks to. Must match BUZZ_BIND_ADDR.",
                      "defaultValue": "3000"
                    },
                    "RUST_LOG": {
                      "isOptional": false,
                      "description": "Log filters. tower_http=warn keeps one line per request out of the log; raise it to info while debugging a client.",
                      "defaultValue": "buzz_relay=info,buzz_db=info,buzz_auth=info,buzz_pubsub=info,tower_http=warn"
                    },
                    "REDIS_URL": {
                      "isOptional": false,
                      "description": "Redis connection string, wired to the cache in this project.",
                      "defaultValue": "redis://${{Redis.RAILWAY_PRIVATE_DOMAIN}}:6379"
                    },
                    "RELAY_URL": {
                      "isOptional": false,
                      "description": "Public WebSocket URL clients connect to. The relay derives its workspace from the host here - point it somewhere else and the relay serves a brand-new empty workspace instead of yours.",
                      "defaultValue": "wss://${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "DATABASE_URL": {
                      "isOptional": false,
                      "description": "Postgres connection string, wired to the database in this project.",
                      "defaultValue": "postgresql://postgres:${{Postgres.POSTGRES_PASSWORD}}@${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/buzz"
                    },
                    "DB_WAIT_HOST": {
                      "isOptional": false,
                      "description": "Read by the start command, which waits for Postgres before starting the relay.",
                      "defaultValue": "${{Postgres.RAILWAY_PRIVATE_DOMAIN}}"
                    },
                    "DB_WAIT_PORT": {
                      "isOptional": false,
                      "description": "Port the start command waits on before starting the relay.",
                      "defaultValue": "5432"
                    },
                    "BUZZ_BIND_ADDR": {
                      "isOptional": false,
                      "description": "Listen address. The brackets are required - the relay parses this as a socket address, and a bare :: is a parse error. The IPv6 wildcard stays dual-stack, so IPv4 health checks are answered too.",
                      "defaultValue": "[::]:3000"
                    },
                    "BUZZ_S3_BUCKET": {
                      "isOptional": false,
                      "description": "Bucket holding media and git objects.",
                      "defaultValue": "${{Bucket.BUCKET}}"
                    },
                    "BUZZ_S3_REGION": {
                      "isOptional": false,
                      "description": "Bucket region.",
                      "defaultValue": "${{Bucket.REGION}}"
                    },
                    "REDIS_WAIT_HOST": {
                      "isOptional": false,
                      "description": "Read by the start command, which waits for Redis before starting the relay.",
                      "defaultValue": "${{Redis.RAILWAY_PRIVATE_DOMAIN}}"
                    },
                    "REDIS_WAIT_PORT": {
                      "isOptional": false,
                      "description": "Port the start command waits on before starting the relay.",
                      "defaultValue": "6379"
                    },
                    "BUZZ_S3_ENDPOINT": {
                      "isOptional": false,
                      "description": "Object storage endpoint. Media and every git repository live here.",
                      "defaultValue": "${{Bucket.ENDPOINT}}"
                    },
                    "BUZZ_AUTO_MIGRATE": {
                      "isOptional": false,
                      "description": "Runs database migrations on start. Off by default upstream, which leaves a fresh database with no schema.",
                      "defaultValue": "true"
                    },
                    "BUZZ_CORS_ORIGINS": {
                      "isOptional": false,
                      "description": "Browser origins allowed to call the REST API. The two tauri:// entries are the desktop app - remove them and the app connects but every request is blocked.",
                      "defaultValue": "tauri://localhost,http://tauri.localhost,https://${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "BUZZ_GIT_REPO_PATH": {
                      "isOptional": false,
                      "description": "Scratch directory git repositories are hydrated into on demand. Not where they are stored - that is the bucket - so nothing here needs to survive a restart.",
                      "defaultValue": "/data/git"
                    },
                    "BUZZ_S3_ACCESS_KEY": {
                      "isOptional": false,
                      "description": "Bucket access key.",
                      "defaultValue": "${{Bucket.ACCESS_KEY_ID}}"
                    },
                    "BUZZ_S3_SECRET_KEY": {
                      "isOptional": false,
                      "description": "Bucket secret key.",
                      "defaultValue": "${{Bucket.SECRET_ACCESS_KEY}}"
                    },
                    "RELAY_OWNER_PUBKEY": {
                      "isOptional": false,
                      "description": "Your Nostr public key - the account that owns this workspace and can invite everyone else. Paste either the npub1... form the Buzz app shows you or a 64-character hex key; this template converts npub to hex for you. It cannot be generated here because it is your identity, not the server's.",
                      "defaultValue": "{{RELAY_OWNER_PUBKEY}}"
                    },
                    "BUZZ_MEDIA_BASE_URL": {
                      "isOptional": false,
                      "description": "Public URL prefix that uploaded media is served from.",
                      "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}/media"
                    },
                    "BUZZ_ALLOW_NIP_OA_AUTH": {
                      "isOptional": false,
                      "description": "Allows NIP-OA authentication, which is how agents attach to the workspace.",
                      "defaultValue": "true"
                    },
                    "BUZZ_PAIRING_RELAY_URL": {
                      "isOptional": false,
                      "description": "Advertised in the relay's NIP-11 document so phones find the pairing sidecar. Without it clients guess at a /pair path that does not exist and QR pairing fails with a 404.",
                      "defaultValue": "wss://${{Pairing.RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "BUZZ_RELAY_PRIVATE_KEY": {
                      "isOptional": false,
                      "description": "The relay's own signing identity, generated once for this deployment. Changing it invalidates every outstanding invite and makes already-signed membership events unverifiable.",
                      "defaultValue": "{{BUZZ_RELAY_PRIVATE_KEY}}"
                    },
                    "BUZZ_REQUIRE_AUTH_TOKEN": {
                      "isOptional": false,
                      "description": "Requires a token on REST calls. Turn it off only for local debugging.",
                      "defaultValue": "true"
                    },
                    "BUZZ_MEDIA_SERVER_DOMAIN": {
                      "isOptional": false,
                      "description": "Domain advertised to clients for media uploads.",
                      "defaultValue": "${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "BUZZ_S3_ADDRESSING_STYLE": {
                      "isOptional": false,
                      "description": "Railway buckets serve virtual-hosted URLs. Set this to path and every object read returns 404, which fails the git storage probe at boot.",
                      "defaultValue": "virtual"
                    },
                    "BUZZ_GIT_HOOK_HMAC_SECRET": {
                      "isOptional": false,
                      "description": "Signs git hook callbacks. Generated once for this deployment.",
                      "defaultValue": "{{BUZZ_GIT_HOOK_HMAC_SECRET}}"
                    },
                    "BUZZ_GIT_CONFORMANCE_PROBE": {
                      "isOptional": false,
                      "description": "Tests the bucket's conditional-write behaviour on start and refuses to serve git if it fails, instead of discovering the problem during a push.",
                      "defaultValue": "true"
                    },
                    "BUZZ_REQUIRE_RELAY_MEMBERSHIP": {
                      "isOptional": false,
                      "description": "Restricts the workspace to invited members. Setting this to false makes every message readable by anyone who finds the URL.",
                      "defaultValue": "true"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>:3000": {
                        "port": 3000
                      }
                    }
                  }
                },
                "77de8aba-ea06-4db8-9fab-28ea3082a3d9": {
                  "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/redis.svg",
                  "name": "Redis",
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 2
                  },
                  "source": {
                    "image": "redis:8.10.1-alpine"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Port Redis listens on inside the private network.",
                      "defaultValue": "6379"
                    }
                  },
                  "haTemplateCode": "redis-ha",
                  "haConversionConfig": {
                    "edge": {
                      "label": "Reverse Proxies",
                      "options": [
                        1,
                        2
                      ],
                      "nodeLabel": "HAProxy",
                      "description": "HAProxy instances routing writes to the primary",
                      "defaultValue": 2
                    },
                    "replica": {
                      "label": "Redis Replicas",
                      "options": [
                        2,
                        3,
                        4,
                        5
                      ],
                      "nodeLabel": "Redis",
                      "description": "Nodes running Redis + colocated Sentinel",
                      "defaultValue": 2
                    },
                    "internal": null,
                    "description": "This will convert your Redis instance to an HA cluster with Sentinel failover and HAProxy routing to the primary."
                  }
                },
                "e0b40e27-5bc5-47c6-a654-793cd31b6293": {
                  "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/postgresql.svg",
                  "name": "Postgres",
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 2
                  },
                  "source": {
                    "image": "postgres:18.6-alpine"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Port Postgres listens on inside the private network.",
                      "defaultValue": "5432"
                    },
                    "POSTGRES_DB": {
                      "isOptional": false,
                      "description": "Database name. It is baked into the relay's connection string - renaming it here alone breaks the relay.",
                      "defaultValue": "buzz"
                    },
                    "POSTGRES_USER": {
                      "isOptional": false,
                      "description": "Database user.",
                      "defaultValue": "postgres"
                    },
                    "POSTGRES_PASSWORD": {
                      "isOptional": false,
                      "description": "Generated once for this deployment. Letters and digits only, because it is embedded in a connection URL.",
                      "defaultValue": "{{POSTGRES_PASSWORD}}"
                    }
                  },
                  "volumeMounts": {
                    "e0b40e27-5bc5-47c6-a654-793cd31b6293": {
                      "mountPath": "/var/lib/postgresql"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "post_deploy": {
    "healthcheck": {
      "service": "Buzz",
      "method": "GET",
      "path": "/_readiness",
      "expect_status": 200
    }
  },
  "resources": {
    "expected_services": 4,
    "needs_volume": true
  },
  "generated_at": "2026-09-19T22:14:40.433Z",
  "generator_version": "0.1.0",
  "status": "degraded",
  "validated_at": "2026-09-19T19:19:50.133Z",
  "success_rate_30d": 0,
  "validation": {
    "last_run_id": "run_88bb047ff46c49839adf",
    "checks": [
      {
        "name": "workflow_completed",
        "passed": false,
        "detail": "Your workspace has been restricted. Please contact support to resolve this."
      }
    ]
  }
}