{ "manifest_version": "1.0.0", "template": { "id": "96ce12ff-acc0-4b47-bf4f-db735f1808d9", "slug": "infisical-secrets-manager", "name": "Infisical — Open Source Doppler, HashiCorp Vault Alternative", "description": "Self Host Infisical, Manage API keys, certs, & other secrets on Railway", "url": "https://railway.com/deploy/infisical-secrets-manager", "upstream": { "image": "infisical/infisical:latest" } }, "services": [ { "name": "Infisical", "source": { "image": "infisical/infisical:latest" }, "needs_volume": false, "http": true }, { "name": "Redis", "source": { "image": "redis:8.2.1" }, "needs_volume": true, "volume_mount_path": "/data", "http": false }, { "name": "Postgres", "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:18" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "http": false } ], "required_inputs": [ { "key": "NODE_ENV", "service": "Infisical", "description": "Application runtime environment mode", "secret": false, "strategy": "default", "default": "production" }, { "key": "SITE_URL", "service": "Infisical", "description": "Public URL of Infisical instance", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "REDIS_URL", "service": "Infisical", "description": "Redis connection URL for caching", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "AUTH_SECRET", "service": "Infisical", "description": "Authentication signing secret key", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "ENCRYPTION_KEY", "service": "Infisical", "description": "Key for encrypting stored secrets", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "DB_CONNECTION_URI", "service": "Infisical", "description": "Postgres database connection URI", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "REDISHOST", "service": "Redis", "description": "Internal Redis service hostname", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "REDISPORT", "service": "Redis", "description": "Redis server listening port", "secret": false, "strategy": "default", "default": "6379" }, { "key": "REDISUSER", "service": "Redis", "description": "Redis default authentication user", "secret": false, "strategy": "default", "default": "default" }, { "key": "REDIS_URL", "service": "Redis", "description": "Internal Redis connection string", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "REDISPASSWORD", "service": "Redis", "description": "Redis password environment reference", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "REDIS_PASSWORD", "service": "Redis", "description": "Password for Redis authentication", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "REDIS_PUBLIC_URL", "service": "Redis", "description": "Public Redis connection URL", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGDATA", "service": "Postgres", "description": "Postgres data storage directory", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "PGHOST", "service": "Postgres", "description": "Internal Postgres host address", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PGPORT", "service": "Postgres", "description": "Postgres server listening port", "secret": false, "strategy": "default", "default": "5432" }, { "key": "PGUSER", "service": "Postgres", "description": "Default Postgres username", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGDATABASE", "service": "Postgres", "description": "Default database name", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGPASSWORD", "service": "Postgres", "description": "Password for Postgres user", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_DB", "service": "Postgres", "description": "Initial database created on startup", "secret": false, "strategy": "default", "default": "railway" }, { "key": "DATABASE_URL", "service": "Postgres", "description": "Internal Postgres connection string", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_USER", "service": "Postgres", "description": "Default database superuser name", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "SSL_CERT_DAYS", "service": "Postgres", "description": "Self-signed SSL certificate validity", "secret": false, "strategy": "default", "default": "820" }, { "key": "POSTGRES_PASSWORD", "service": "Postgres", "description": "Postgres database user password", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "DATABASE_PUBLIC_URL", "service": "Postgres", "description": "Public Postgres connection string", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS", "service": "Postgres", "description": "Graceful shutdown draining duration", "secret": false, "strategy": "default", "default": "60" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "infisical-secrets-manager" } }, "cli": "railway deploy --template infisical-secrets-manager", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "96ce12ff-acc0-4b47-bf4f-db735f1808d9", "serializedConfig": { "buckets": {}, "services": { "0ac8a480-0dec-4a4c-9ac5-36d955088ff9": { "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/infisical.svg", "name": "Infisical", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "infisical/infisical:latest" }, "variables": { "NODE_ENV": { "isOptional": false, "description": "Application runtime environment mode", "defaultValue": "production" }, "SITE_URL": { "isOptional": false, "description": "Public URL of Infisical instance", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "REDIS_URL": { "isOptional": false, "description": "Redis connection URL for caching", "defaultValue": "${{Redis.REDIS_URL}}" }, "AUTH_SECRET": { "isOptional": false, "description": "Authentication signing secret key", "defaultValue": "{{AUTH_SECRET}}" }, "ENCRYPTION_KEY": { "isOptional": false, "description": "Key for encrypting stored secrets", "defaultValue": "{{ENCRYPTION_KEY}}" }, "DB_CONNECTION_URI": { "isOptional": false, "description": "Postgres database connection URI", "defaultValue": "${{Postgres.DATABASE_URL}}" } }, "networking": { "serviceDomains": { "": {} } } }, "7ef3d00a-3eeb-46ea-af4a-5d0fe63b36fa": { "icon": "https://cdn.sanity.io/images/sy1jschh/production/0ce0bfdcfbdbf69662b1116671f97c2dd788b655-157x157.svg", "name": "Redis", "deploy": { "startCommand": "/bin/sh -c \"rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH\"", "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "redis:8.2.1" }, "variables": { "REDISHOST": { "isOptional": false, "description": "Internal Redis service hostname", "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}" }, "REDISPORT": { "isOptional": false, "description": "Redis server listening port", "defaultValue": "6379" }, "REDISUSER": { "isOptional": false, "description": "Redis default authentication user", "defaultValue": "default" }, "REDIS_URL": { "isOptional": false, "description": "Internal Redis connection string", "defaultValue": "redis://${{REDISUSER}}:${{REDIS_PASSWORD}}@${{REDISHOST}}:${{REDISPORT}}" }, "REDISPASSWORD": { "isOptional": false, "description": "Redis password environment reference", "defaultValue": "${{REDIS_PASSWORD}}" }, "REDIS_PASSWORD": { "isOptional": false, "description": "Password for Redis authentication", "defaultValue": "{{REDIS_PASSWORD}}" }, "REDIS_PUBLIC_URL": { "isOptional": false, "description": "Public Redis connection URL", "defaultValue": "redis://default:${{REDIS_PASSWORD}}@${{RAILWAY_TCP_PROXY_DOMAIN}}:${{RAILWAY_TCP_PROXY_PORT}}" } }, "volumeMounts": { "7ef3d00a-3eeb-46ea-af4a-5d0fe63b36fa": { "mountPath": "/data" } }, "haTemplateCode": "redis-ha", "haConversionConfig": { "edge": { "label": "Reverse Proxies", "options": [ 1, 2 ], "nodeLabel": "HAProxy", "description": "HAProxy instances routing writes to the primary", "defaultValue": 2 }, "replica": { "label": "Redis Replicas", "options": [ 2, 3, 4, 5 ], "nodeLabel": "Redis", "description": "Nodes running Redis + colocated Sentinel", "defaultValue": 2 }, "internal": null, "description": "This will convert your Redis instance to an HA cluster with Sentinel failover and HAProxy routing to the primary." } }, "9222d366-868c-4d28-85a6-d31da3bb0177": { "icon": "https://devicons.railway.app/i/postgresql.svg", "name": "Postgres", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:18" }, "variables": { "PGDATA": { "isOptional": false, "description": "Postgres data storage directory", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "PGHOST": { "isOptional": false, "description": "Internal Postgres host address", "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}" }, "PGPORT": { "isOptional": false, "description": "Postgres server listening port", "defaultValue": "5432" }, "PGUSER": { "isOptional": false, "description": "Default Postgres username", "defaultValue": "${{POSTGRES_USER}}" }, "PGDATABASE": { "isOptional": false, "description": "Default database name", "defaultValue": "${{POSTGRES_DB}}" }, "PGPASSWORD": { "isOptional": false, "description": "Password for Postgres user", "defaultValue": "${{POSTGRES_PASSWORD}}" }, "POSTGRES_DB": { "isOptional": false, "description": "Initial database created on startup", "defaultValue": "railway" }, "DATABASE_URL": { "isOptional": false, "description": "Internal Postgres connection string", "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{PGDATABASE}}" }, "POSTGRES_USER": { "isOptional": false, "description": "Default database superuser name", "defaultValue": "postgres" }, "SSL_CERT_DAYS": { "isOptional": false, "description": "Self-signed SSL certificate validity", "defaultValue": "820" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Postgres database user password", "defaultValue": "{{POSTGRES_PASSWORD}}" }, "DATABASE_PUBLIC_URL": { "isOptional": false, "description": "Public Postgres connection string", "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_TCP_PROXY_DOMAIN}}:${{RAILWAY_TCP_PROXY_PORT}}/${{PGDATABASE}}" }, "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": { "isOptional": false, "description": "Graceful shutdown draining duration", "defaultValue": "60" } }, "volumeMounts": { "9222d366-868c-4d28-85a6-d31da3bb0177": { "mountPath": "/var/lib/postgresql/data" } }, "haTemplateCode": "postgres-ha", "haConversionConfig": { "edge": { "label": "Reverse Proxy", "options": [ 2, 3, 4, 5 ], "nodeLabel": "HAProxy", "description": "Routes traffic to the primary", "defaultValue": 3 }, "replica": { "label": "Replicas", "options": [ 2, 3, 4, 5, 6, 7 ], "nodeLabel": "Postgres", "description": "Streaming replicas for automatic failover", "defaultValue": 2 }, "internal": { "label": "Coordinator Nodes", "options": [ 3, 5, 7, 9 ], "nodeLabel": "etcd", "defaultValue": 3 }, "description": "This will convert your Postgres database to an HA cluster with Patroni failover and etcd consensus." } } } } } } } } }, "post_deploy": {}, "resources": { "expected_services": 3, "needs_volume": true }, "generated_at": "2026-09-21T16:15:12.787Z", "generator_version": "0.1.0", "status": "validated", "validated_at": "2026-09-20T17:24:23.284Z", "success_rate_30d": 1, "validation": { "last_run_id": "run_67e66ac08af34c62b50d", "checks": [ { "name": "workflow_completed", "passed": true }, { "name": "all_services_deployed", "passed": true }, { "name": "stays_up", "passed": true } ], "typical_ready_seconds": 81, "typical_build_seconds": 0, "typical_start_seconds": 10, "slowest_service": "Infisical" } }