{ "manifest_version": "1.0.0", "template": { "id": "88ece4c5-3d43-428a-b473-0c35ea4e3047", "slug": "infisical-secrets-management", "name": "Infisical", "description": "HashiCorp Vault alternative. Central secrets, rotation, dynamic credentials", "url": "https://railway.com/deploy/infisical-secrets-management", "upstream": { "image": "infisical/infisical:latest" } }, "services": [ { "name": "Infisical", "source": { "image": "infisical/infisical:latest" }, "needs_volume": false, "http": true }, { "name": "Redis", "source": { "image": "redis:8.2" }, "needs_volume": true, "volume_mount_path": "/data", "http": false }, { "name": "Postgres", "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:18" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "http": false } ], "required_inputs": [ { "key": "PORT", "service": "Infisical", "description": "HTTP listening port", "secret": false, "strategy": "default", "default": "8080" }, { "key": "SITE_URL", "service": "Infisical", "description": "Absolute public instance URL", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "REDIS_URL", "service": "Infisical", "description": "Redis connection string", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "AUTH_SECRET", "service": "Infisical", "description": "Signs session and auth tokens", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "HTTPS_ENABLED", "service": "Infisical", "description": "Marks session cookies Secure", "secret": false, "strategy": "default", "default": "true" }, { "key": "ENCRYPTION_KEY", "service": "Infisical", "description": "Root key encrypting stored secrets", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "DB_CONNECTION_URI", "service": "Infisical", "description": "Postgres connection string", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DISABLE_UPDATE_CHECK", "service": "Infisical", "description": "Weekly upstream release check", "secret": false, "strategy": "default", "default": "false" }, { "key": "REDISHOST", "service": "Redis", "description": "Private hostname, reachable only inside the project", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "REDISPORT", "service": "Redis", "description": "Standard Redis port", "secret": false, "strategy": "default", "default": "6379" }, { "key": "REDISUSER", "service": "Redis", "description": "Default ACL user created on first boot", "secret": false, "strategy": "default", "default": "default" }, { "key": "REDIS_URL", "service": "Redis", "description": "Private connection string, use this from other services", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "REDISPASSWORD", "service": "Redis", "description": "Convenience alias of the generated password", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "REDIS_PASSWORD", "service": "Redis", "description": "Generated password for the default user", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "PGDATA", "service": "Postgres", "description": "Data directory, a subdirectory of the volume mount", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "PGHOST", "service": "Postgres", "description": "Private hostname, reachable only inside the project", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PGPORT", "service": "Postgres", "description": "Standard PostgreSQL port", "secret": false, "strategy": "default", "default": "5432" }, { "key": "PGUSER", "service": "Postgres", "description": "libpq alias of the superuser name", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGDATABASE", "service": "Postgres", "description": "libpq alias of the default database", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGPASSWORD", "service": "Postgres", "description": "libpq alias of the superuser password", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_DB", "service": "Postgres", "description": "Default database created on first boot", "secret": false, "strategy": "default", "default": "rRAILWAY_PRIVATE_DOMAINailway" }, { "key": "DATABASE_URL", "service": "Postgres", "description": "Private connection string, use this from other services", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_USER", "service": "Postgres", "description": "Superuser created on first boot", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "SSL_CERT_DAYS", "service": "Postgres", "description": "Validity window of the generated self-signed TLS certificate", "secret": false, "strategy": "default", "default": "820" }, { "key": "POSTGRES_PASSWORD", "service": "Postgres", "description": "Generated superuser password", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "DATABASE_PUBLIC_URL", "service": "Postgres", "description": "Public connection string over the TCP proxy, for external tools", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS", "service": "Postgres", "description": "Grace period for in-flight connections on redeploy", "secret": false, "strategy": "default", "default": "60" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "infisical-secrets-management" } }, "cli": "railway deploy --template infisical-secrets-management", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "88ece4c5-3d43-428a-b473-0c35ea4e3047", "serializedConfig": { "buckets": {}, "services": { "1ea89ea3-7412-4061-be5a-7557f17817a7": { "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/infisical.svg", "name": "Infisical", "deploy": { "startCommand": null, "healthcheckPath": "/api/status", "restartPolicyType": "ALWAYS", "restartPolicyMaxRetries": 10 }, "source": { "image": "infisical/infisical:latest" }, "variables": { "PORT": { "isOptional": false, "description": "HTTP listening port", "defaultValue": "8080" }, "SITE_URL": { "isOptional": false, "description": "Absolute public instance URL", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "REDIS_URL": { "isOptional": false, "description": "Redis connection string", "defaultValue": "${{Redis.REDIS_URL}}" }, "AUTH_SECRET": { "isOptional": false, "description": "Signs session and auth tokens", "defaultValue": "{{AUTH_SECRET}}" }, "HTTPS_ENABLED": { "isOptional": false, "description": "Marks session cookies Secure", "defaultValue": "true" }, "ENCRYPTION_KEY": { "isOptional": false, "description": "Root key encrypting stored secrets", "defaultValue": "{{ENCRYPTION_KEY}}" }, "DB_CONNECTION_URI": { "isOptional": false, "description": "Postgres connection string", "defaultValue": "${{Postgres.DATABASE_URL}}" }, "DISABLE_UPDATE_CHECK": { "isOptional": false, "description": "Weekly upstream release check", "defaultValue": "false" } }, "networking": { "serviceDomains": { ":8080": { "port": 8080 } } } }, "58e5804b-78ac-43f4-86a5-2d367a7540c4": { "icon": "https://cdn.sanity.io/images/sy1jschh/production/0ce0bfdcfbdbf69662b1116671f97c2dd788b655-157x157.svg", "name": "Redis", "deploy": { "startCommand": "/bin/sh -c \"rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH\"", "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "redis:8.2" }, "variables": { "REDISHOST": { "isOptional": false, "description": "Private hostname, reachable only inside the project", "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}" }, "REDISPORT": { "isOptional": false, "description": "Standard Redis port", "defaultValue": "6379" }, "REDISUSER": { "isOptional": false, "description": "Default ACL user created on first boot", "defaultValue": "default" }, "REDIS_URL": { "isOptional": false, "description": "Private connection string, use this from other services", "defaultValue": "redis://${{REDISUSER}}:${{REDIS_PASSWORD}}@${{REDISHOST}}:${{REDISPORT}}" }, "REDISPASSWORD": { "isOptional": false, "description": "Convenience alias of the generated password", "defaultValue": "${{REDIS_PASSWORD}}" }, "REDIS_PASSWORD": { "isOptional": false, "description": "Generated password for the default user", "defaultValue": "{{REDIS_PASSWORD}}" } }, "volumeMounts": { "58e5804b-78ac-43f4-86a5-2d367a7540c4": { "mountPath": "/data" } } }, "f74d9926-3300-4410-a2f1-3b107ad2d942": { "icon": "https://devicons.railway.app/i/postgresql.svg", "name": "Postgres", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:18" }, "variables": { "PGDATA": { "isOptional": false, "description": "Data directory, a subdirectory of the volume mount", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "PGHOST": { "isOptional": false, "description": "Private hostname, reachable only inside the project", "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}" }, "PGPORT": { "isOptional": false, "description": "Standard PostgreSQL port", "defaultValue": "5432" }, "PGUSER": { "isOptional": false, "description": "libpq alias of the superuser name", "defaultValue": "${{POSTGRES_USER}}" }, "PGDATABASE": { "isOptional": false, "description": "libpq alias of the default database", "defaultValue": "${{POSTGRES_DB}}" }, "PGPASSWORD": { "isOptional": false, "description": "libpq alias of the superuser password", "defaultValue": "${{POSTGRES_PASSWORD}}" }, "POSTGRES_DB": { "isOptional": false, "description": "Default database created on first boot", "defaultValue": "rRAILWAY_PRIVATE_DOMAINailway" }, "DATABASE_URL": { "isOptional": false, "description": "Private connection string, use this from other services", "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{PGDATABASE}}" }, "POSTGRES_USER": { "isOptional": false, "description": "Superuser created on first boot", "defaultValue": "postgres" }, "SSL_CERT_DAYS": { "isOptional": false, "description": "Validity window of the generated self-signed TLS certificate", "defaultValue": "820" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Generated superuser password", "defaultValue": "{{POSTGRES_PASSWORD}}" }, "DATABASE_PUBLIC_URL": { "description": "Public connection string over the TCP proxy, for external tools", "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_TCP_PROXY_DOMAIN}}:${{RAILWAY_TCP_PROXY_PORT}}/${{PGDATABASE}}" }, "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": { "isOptional": false, "description": "Grace period for in-flight connections on redeploy", "defaultValue": "60" } }, "volumeMounts": { "f74d9926-3300-4410-a2f1-3b107ad2d942": { "mountPath": "/var/lib/postgresql/data" } } } } } } } } } }, "post_deploy": { "healthcheck": { "service": "Infisical", "method": "GET", "path": "/api/status", "expect_status": 200 } }, "resources": { "expected_services": 3, "needs_volume": true }, "generated_at": "2026-09-10T10:14:45.332Z", "generator_version": "0.1.0", "status": "validated", "validated_at": "2026-09-04T14:02:15.257Z", "success_rate_30d": 1, "validation": { "last_run_id": "run_d071019a609f4e398784", "checks": [ { "name": "workflow_completed", "passed": true }, { "name": "all_services_deployed", "passed": true }, { "name": "healthcheck", "passed": true }, { "name": "stays_up", "passed": true } ], "typical_ready_seconds": 148, "typical_build_seconds": 0, "typical_start_seconds": 51, "slowest_service": "Infisical" } }