{
  "manifest_version": "1.0.0",
  "template": {
    "id": "6fef8775-4761-4f60-b3f1-7803a8079d25",
    "slug": "cap-screen-recorder",
    "name": "Cap | Open Source Loom Alternative",
    "description": "Self-hosted Loom alternative: screen recording with shareable links",
    "url": "https://railway.com/deploy/cap-screen-recorder",
    "upstream": {
      "image": "ghcr.io/capsoftware/cap-web@sha256:8ee4cbd3fd87f88f538831aed06c954c525db9c2426a62abeaf0ca307c5e1ce9"
    }
  },
  "services": [
    {
      "name": "Web",
      "source": {
        "image": "ghcr.io/capsoftware/cap-web@sha256:8ee4cbd3fd87f88f538831aed06c954c525db9c2426a62abeaf0ca307c5e1ce9"
      },
      "needs_volume": false,
      "http": true
    },
    {
      "name": "MediaServer",
      "source": {
        "image": "ghcr.io/capsoftware/cap-media-server@sha256:2fb5f991e55a88ed625404e5dc073f143442571b54caa563cbbaf89b832199a4"
      },
      "needs_volume": false,
      "http": false
    },
    {
      "name": "MySQL",
      "source": {
        "image": "mysql:8.4.11"
      },
      "needs_volume": true,
      "volume_mount_path": "/var/lib/mysql",
      "http": false
    }
  ],
  "required_inputs": [
    {
      "key": "PORT",
      "service": "Web",
      "description": "Port the Next.js server listens on. Railway routes traffic and health checks here; changing it means changing the start command too.",
      "secret": false,
      "strategy": "default",
      "default": "3000"
    },
    {
      "key": "WEB_URL",
      "service": "Web",
      "description": "Public URL of this instance. Used for links, share URLs and OAuth callbacks. Set it to your own domain if you add one.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "BIND_HOST",
      "service": "Web",
      "description": "Address the web server binds. `::` is dual-stack, which is what lets the media server reach this container over the project's IPv6 private network while the IPv4 health check still answers. Do not set 0.0.0.0.",
      "secret": false,
      "strategy": "default",
      "default": "::"
    },
    {
      "key": "DB_WAIT_JS",
      "service": "Web",
      "description": "One-line Node probe the start command runs in a loop until MySQL accepts connections. Cap migrates the database on boot and gives up after three tries, so this is what keeps a cold start from racing the database.",
      "secret": false,
      "strategy": "default",
      "default": "const net = require(\"net\");const s = net.connect(Number(process.env.DB_WAIT_PORT), process.env.DB_WAIT_HOST);s.on(\"connect\", function () { s.end(); process.exit(0); });s.on(\"error\", function () { process.exit(1); });"
    },
    {
      "key": "DATABASE_URL",
      "service": "Web",
      "description": "MySQL connection string, over the private network. Cap requires MySQL — it is not Postgres-compatible.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "DB_WAIT_HOST",
      "service": "Web",
      "description": "Host the start command waits for before booting. Points at MySQL's private domain.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "DB_WAIT_PORT",
      "service": "Web",
      "description": "Port the start command waits for before booting.",
      "secret": false,
      "strategy": "default",
      "default": "3306"
    },
    {
      "key": "NEXTAUTH_URL",
      "service": "Web",
      "description": "Must match WEB_URL. NextAuth builds its callback URLs from this.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "S3_PATH_STYLE",
      "service": "Web",
      "description": "Keep this on. Railway storage answers both URL shapes but only sends CORS headers on the path-style one, and the browser uploads recordings directly to the bucket — with virtual-hosted URLs every upload fails in the browser while curl still reports 200.",
      "secret": false,
      "strategy": "default",
      "default": "true"
    },
    {
      "key": "CAP_AWS_BUCKET",
      "service": "Web",
      "description": "Railway Storage bucket holding recordings, thumbnails and exports.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "CAP_AWS_REGION",
      "service": "Web",
      "description": "Bucket region.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "NEXTAUTH_SECRET",
      "service": "Web",
      "description": "Signs session tokens. Changing it logs everyone out.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "MEDIA_SERVER_URL",
      "service": "Web",
      "description": "Private address of the media server that runs ffmpeg.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "CAP_AWS_ACCESS_KEY",
      "service": "Web",
      "description": "Bucket access key.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "CAP_AWS_SECRET_KEY",
      "service": "Web",
      "description": "Bucket secret key.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "S3_PUBLIC_ENDPOINT",
      "service": "Web",
      "description": "Endpoint used for the URLs the browser talks to.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "S3_INTERNAL_ENDPOINT",
      "service": "Web",
      "description": "Endpoint used for server-side calls. Same host here; the split exists for setups where internal traffic is cheaper.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "DATABASE_ENCRYPTION_KEY",
      "service": "Web",
      "description": "32 bytes of hex. Encrypts stored credentials, such as the S3 keys of a custom bucket a user connects. Losing it makes those unreadable — back it up before rotating.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "MEDIA_SERVER_WEBHOOK_URL",
      "service": "Web",
      "description": "Where the media server posts transcoding progress back to. This is the private address of this service — it only works because BIND_HOST is dual-stack.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "CAP_VIDEOS_DEFAULT_PUBLIC",
      "service": "Web",
      "description": "Whether a new recording is viewable by anyone holding its link. This is upstream's default; set it to false to make every recording private until it is shared.",
      "secret": false,
      "strategy": "default",
      "default": "true"
    },
    {
      "key": "MEDIA_SERVER_WEBHOOK_SECRET",
      "service": "Web",
      "description": "Shared secret authenticating the media server's callbacks. It must match the media server's copy exactly; if either side is missing it, every progress callback is rejected with 401 and processing silently never finishes.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "PORT",
      "service": "MediaServer",
      "description": "Port the media server listens on. Bun binds dual-stack by itself, so this one needs no start command of its own.",
      "secret": false,
      "strategy": "default",
      "default": "3456"
    },
    {
      "key": "MEDIA_SERVER_WEBHOOK_SECRET",
      "service": "MediaServer",
      "description": "Shared secret for calling back into the web service. Referenced from Web so the two always match — a mismatch means processing never reports finishing.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "PORT",
      "service": "MySQL",
      "description": "MySQL port, private to this project. No public TCP proxy is created.",
      "secret": false,
      "strategy": "default",
      "default": "3306"
    },
    {
      "key": "MYSQL_USER",
      "service": "MySQL",
      "description": "Application user created on first boot.",
      "secret": false,
      "strategy": "default",
      "default": "cap"
    },
    {
      "key": "MYSQL_DATABASE",
      "service": "MySQL",
      "description": "Database created on first boot. The web service's DATABASE_URL points at this name.",
      "secret": false,
      "strategy": "default",
      "default": "cap"
    },
    {
      "key": "MYSQL_PASSWORD",
      "service": "MySQL",
      "description": "Password for the application user. Letters and digits only, because it is embedded in a connection URL.",
      "secret": true,
      "strategy": "generate",
      "generate": "strong_password"
    },
    {
      "key": "MYSQL_ROOT_PASSWORD",
      "service": "MySQL",
      "description": "MySQL root password. Not used by the application.",
      "secret": true,
      "strategy": "generate",
      "generate": "strong_password"
    }
  ],
  "deploy": {
    "mcp": {
      "server": "railway",
      "tool": "deploy_template",
      "args": {
        "template_code": "cap-screen-recorder"
      }
    },
    "cli": "railway deploy --template cap-screen-recorder",
    "api": {
      "method": "POST",
      "path": "/graphql/v2",
      "body": {
        "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }",
        "variables": {
          "input": {
            "templateId": "6fef8775-4761-4f60-b3f1-7803a8079d25",
            "serializedConfig": {
              "buckets": {
                "b3ced5d6-9736-4322-9a34-abac5ec12da3": {
                  "name": "Bucket"
                }
              },
              "services": {
                "2fba02a3-a05c-411f-aa7a-b25cf270263d": {
                  "icon": "https://cdn.jsdelivr.net/gh/CapSoftware/Cap@dffb42fe0d151f08f31be0e9b535d5e4941c6760/apps/web/public/logos/logo-solo.svg",
                  "name": "Web",
                  "deploy": {
                    "startCommand": "sh -c 'for i in $(seq 1 90); do [ -n \"$DB_WAIT_JS\" ] && node -e \"$DB_WAIT_JS\" 2>/dev/null && break; echo \"waiting for mysql ($i/90)\"; sleep 2; done; exec env HOSTNAME=\"$BIND_HOST\" node apps/web/server.js'",
                    "healthcheckPath": "/login",
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "ghcr.io/capsoftware/cap-web@sha256:8ee4cbd3fd87f88f538831aed06c954c525db9c2426a62abeaf0ca307c5e1ce9"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Port the Next.js server listens on. Railway routes traffic and health checks here; changing it means changing the start command too.",
                      "defaultValue": "3000"
                    },
                    "WEB_URL": {
                      "isOptional": false,
                      "description": "Public URL of this instance. Used for links, share URLs and OAuth callbacks. Set it to your own domain if you add one.",
                      "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "BIND_HOST": {
                      "isOptional": false,
                      "description": "Address the web server binds. `::` is dual-stack, which is what lets the media server reach this container over the project's IPv6 private network while the IPv4 health check still answers. Do not set 0.0.0.0.",
                      "defaultValue": "::"
                    },
                    "DB_WAIT_JS": {
                      "isOptional": false,
                      "description": "One-line Node probe the start command runs in a loop until MySQL accepts connections. Cap migrates the database on boot and gives up after three tries, so this is what keeps a cold start from racing the database.",
                      "defaultValue": "const net = require(\"net\");const s = net.connect(Number(process.env.DB_WAIT_PORT), process.env.DB_WAIT_HOST);s.on(\"connect\", function () { s.end(); process.exit(0); });s.on(\"error\", function () { process.exit(1); });"
                    },
                    "DATABASE_URL": {
                      "isOptional": false,
                      "description": "MySQL connection string, over the private network. Cap requires MySQL — it is not Postgres-compatible.",
                      "defaultValue": "mysql://cap:${{MySQL.MYSQL_PASSWORD}}@${{MySQL.RAILWAY_PRIVATE_DOMAIN}}:3306/cap"
                    },
                    "DB_WAIT_HOST": {
                      "isOptional": false,
                      "description": "Host the start command waits for before booting. Points at MySQL's private domain.",
                      "defaultValue": "${{MySQL.RAILWAY_PRIVATE_DOMAIN}}"
                    },
                    "DB_WAIT_PORT": {
                      "isOptional": false,
                      "description": "Port the start command waits for before booting.",
                      "defaultValue": "3306"
                    },
                    "GROQ_API_KEY": {
                      "isOptional": true,
                      "description": "Groq key. Enables AI titles and summaries; Cap prefers this over OpenAI.",
                      "defaultValue": ""
                    },
                    "NEXTAUTH_URL": {
                      "isOptional": false,
                      "description": "Must match WEB_URL. NextAuth builds its callback URLs from this.",
                      "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "S3_PATH_STYLE": {
                      "isOptional": false,
                      "description": "Keep this on. Railway storage answers both URL shapes but only sends CORS headers on the path-style one, and the browser uploads recordings directly to the bucket — with virtual-hosted URLs every upload fails in the browser while curl still reports 200.",
                      "defaultValue": "true"
                    },
                    "CAP_AWS_BUCKET": {
                      "isOptional": false,
                      "description": "Railway Storage bucket holding recordings, thumbnails and exports.",
                      "defaultValue": "${{Bucket.BUCKET}}"
                    },
                    "CAP_AWS_REGION": {
                      "isOptional": false,
                      "description": "Bucket region.",
                      "defaultValue": "${{Bucket.REGION}}"
                    },
                    "OPENAI_API_KEY": {
                      "isOptional": true,
                      "description": "OpenAI key. Fallback for AI summaries.",
                      "defaultValue": ""
                    },
                    "RESEND_API_KEY": {
                      "isOptional": true,
                      "description": "Resend API key. Without it, login codes are printed to this service's deploy log instead of emailed — usable, but it means anyone with log access can sign in as anyone. Cap sends email through Resend only; there is no generic SMTP option.",
                      "defaultValue": ""
                    },
                    "NEXTAUTH_SECRET": {
                      "isOptional": false,
                      "description": "Signs session tokens. Changing it logs everyone out.",
                      "defaultValue": "{{NEXTAUTH_SECRET}}"
                    },
                    "ASSEMBLY_API_KEY": {
                      "isOptional": true,
                      "description": "AssemblyAI key. Enables automatic transcription and captions.",
                      "defaultValue": ""
                    },
                    "GOOGLE_CLIENT_ID": {
                      "isOptional": true,
                      "description": "Google OAuth client id, to offer Sign in with Google. The callback URL is WEB_URL + /api/auth/callback/google.",
                      "defaultValue": ""
                    },
                    "MEDIA_SERVER_URL": {
                      "isOptional": false,
                      "description": "Private address of the media server that runs ffmpeg.",
                      "defaultValue": "http://${{MediaServer.RAILWAY_PRIVATE_DOMAIN}}:3456"
                    },
                    "ANTHROPIC_API_KEY": {
                      "isOptional": true,
                      "description": "Anthropic key. Used for Cap's AI chat.",
                      "defaultValue": ""
                    },
                    "CAP_AWS_ACCESS_KEY": {
                      "isOptional": false,
                      "description": "Bucket access key.",
                      "defaultValue": "${{Bucket.ACCESS_KEY_ID}}"
                    },
                    "CAP_AWS_SECRET_KEY": {
                      "isOptional": false,
                      "description": "Bucket secret key.",
                      "defaultValue": "${{Bucket.SECRET_ACCESS_KEY}}"
                    },
                    "RESEND_FROM_DOMAIN": {
                      "isOptional": true,
                      "description": "Domain verified in Resend that login and notification email is sent from.",
                      "defaultValue": ""
                    },
                    "S3_PUBLIC_ENDPOINT": {
                      "isOptional": false,
                      "description": "Endpoint used for the URLs the browser talks to.",
                      "defaultValue": "${{Bucket.ENDPOINT}}"
                    },
                    "GOOGLE_CLIENT_SECRET": {
                      "isOptional": true,
                      "description": "Google OAuth client secret.",
                      "defaultValue": ""
                    },
                    "S3_INTERNAL_ENDPOINT": {
                      "isOptional": false,
                      "description": "Endpoint used for server-side calls. Same host here; the split exists for setups where internal traffic is cheaper.",
                      "defaultValue": "${{Bucket.ENDPOINT}}"
                    },
                    "DATABASE_ENCRYPTION_KEY": {
                      "isOptional": false,
                      "description": "32 bytes of hex. Encrypts stored credentials, such as the S3 keys of a custom bucket a user connects. Losing it makes those unreadable — back it up before rotating.",
                      "defaultValue": "{{DATABASE_ENCRYPTION_KEY}}"
                    },
                    "MEDIA_SERVER_WEBHOOK_URL": {
                      "isOptional": false,
                      "description": "Where the media server posts transcoding progress back to. This is the private address of this service — it only works because BIND_HOST is dual-stack.",
                      "defaultValue": "http://${{RAILWAY_PRIVATE_DOMAIN}}:3000"
                    },
                    "CAP_VIDEOS_DEFAULT_PUBLIC": {
                      "isOptional": false,
                      "description": "Whether a new recording is viewable by anyone holding its link. This is upstream's default; set it to false to make every recording private until it is shared.",
                      "defaultValue": "true"
                    },
                    "CAP_ALLOWED_SIGNUP_DOMAINS": {
                      "isOptional": true,
                      "description": "Comma-separated email domains permitted to register, e.g. `yourcompany.com`. Empty means anyone who reaches the login page may create an account — though they still need the code, which only appears in this service's logs until SMTP is configured.",
                      "defaultValue": ""
                    },
                    "MEDIA_SERVER_WEBHOOK_SECRET": {
                      "isOptional": false,
                      "description": "Shared secret authenticating the media server's callbacks. It must match the media server's copy exactly; if either side is missing it, every progress callback is rejected with 401 and processing silently never finishes.",
                      "defaultValue": "{{MEDIA_SERVER_WEBHOOK_SECRET}}"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>:3000": {
                        "port": 3000
                      }
                    }
                  }
                },
                "747e7936-ac38-41d0-a913-3662c4709511": {
                  "icon": "https://cdn.jsdelivr.net/gh/CapSoftware/Cap@dffb42fe0d151f08f31be0e9b535d5e4941c6760/apps/web/public/logos/logo-solo.svg",
                  "name": "MediaServer",
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": "/health",
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "ghcr.io/capsoftware/cap-media-server@sha256:2fb5f991e55a88ed625404e5dc073f143442571b54caa563cbbaf89b832199a4"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Port the media server listens on. Bun binds dual-stack by itself, so this one needs no start command of its own.",
                      "defaultValue": "3456"
                    },
                    "MEDIA_SERVER_WEBHOOK_SECRET": {
                      "isOptional": false,
                      "description": "Shared secret for calling back into the web service. Referenced from Web so the two always match — a mismatch means processing never reports finishing.",
                      "defaultValue": "${{Web.MEDIA_SERVER_WEBHOOK_SECRET}}"
                    }
                  }
                },
                "92e8b900-1a8e-41f1-ba71-06d95b4c72ea": {
                  "icon": "https://cdn.jsdelivr.net/gh/CapSoftware/Cap@dffb42fe0d151f08f31be0e9b535d5e4941c6760/apps/web/public/logos/logo-solo.svg",
                  "name": "MySQL",
                  "deploy": {
                    "startCommand": "docker-entrypoint.sh mysqld --innodb-use-native-aio=0 --skip-log-bin --performance-schema=OFF --max-connections=500 --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci",
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 2
                  },
                  "source": {
                    "image": "mysql:8.4.11"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "MySQL port, private to this project. No public TCP proxy is created.",
                      "defaultValue": "3306"
                    },
                    "MYSQL_USER": {
                      "isOptional": false,
                      "description": "Application user created on first boot.",
                      "defaultValue": "cap"
                    },
                    "MYSQL_DATABASE": {
                      "isOptional": false,
                      "description": "Database created on first boot. The web service's DATABASE_URL points at this name.",
                      "defaultValue": "cap"
                    },
                    "MYSQL_PASSWORD": {
                      "isOptional": false,
                      "description": "Password for the application user. Letters and digits only, because it is embedded in a connection URL.",
                      "defaultValue": "{{MYSQL_PASSWORD}}"
                    },
                    "MYSQL_ROOT_PASSWORD": {
                      "isOptional": false,
                      "description": "MySQL root password. Not used by the application.",
                      "defaultValue": "{{MYSQL_ROOT_PASSWORD}}"
                    }
                  },
                  "volumeMounts": {
                    "92e8b900-1a8e-41f1-ba71-06d95b4c72ea": {
                      "mountPath": "/var/lib/mysql"
                    }
                  },
                  "haTemplateCode": "mysql-ha",
                  "haConversionConfig": {
                    "edge": {
                      "label": "Reverse Proxies",
                      "options": [
                        1,
                        2
                      ],
                      "nodeLabel": "HAProxy",
                      "description": "HAProxy instances routing writes to the primary",
                      "defaultValue": 2
                    },
                    "replica": {
                      "label": "MySQL Replicas",
                      "options": [
                        2,
                        4,
                        6,
                        8
                      ],
                      "nodeLabel": "MySQL",
                      "description": "Requires odd count for quorum",
                      "defaultValue": 2
                    },
                    "internal": null,
                    "description": "This will convert your MySQL instance to an HA cluster with Group Replication failover and HAProxy routing to the primary.",
                    "supportedImageMajorVersions": [
                      8,
                      9
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "post_deploy": {
    "healthcheck": {
      "service": "Web",
      "method": "GET",
      "path": "/login",
      "expect_status": 200
    }
  },
  "resources": {
    "expected_services": 3,
    "needs_volume": true
  },
  "generated_at": "2026-09-19T22:14:40.433Z",
  "generator_version": "0.1.0",
  "status": "degraded",
  "validated_at": "2026-09-19T19:07:03.987Z",
  "success_rate_30d": 0.1667,
  "validation": {
    "last_run_id": "run_ada41bad64c34ac698c8",
    "checks": [
      {
        "name": "workflow_completed",
        "passed": false,
        "detail": "Your workspace has been restricted. Please contact support to resolve this."
      }
    ],
    "typical_ready_seconds": 29,
    "typical_build_seconds": 0,
    "typical_start_seconds": 10,
    "slowest_service": "MediaServer"
  }
}