{
  "manifest_version": "1.0.0",
  "template": {
    "id": "64202b11-3bdc-4822-aaa5-b1c05baae2fc",
    "slug": "keycloak-sso",
    "name": "Keycloak | Open-Source SSO & Identity Provider (OIDC, SAML)",
    "description": "Single sign-on and identity on Postgres 17, admin created on first boot",
    "url": "https://railway.com/deploy/keycloak-sso",
    "upstream": {
      "repo_url": "https://github.com/two-workspaces/keycloak"
    }
  },
  "status": "unvalidated",
  "validated_at": null,
  "success_rate_30d": null,
  "services": [
    {
      "name": "Keycloak",
      "source": {
        "repo": "https://github.com/two-workspaces/keycloak"
      },
      "needs_volume": false,
      "http": true
    },
    {
      "name": "Postgres",
      "source": {
        "image": "postgres:17.11-alpine"
      },
      "needs_volume": true,
      "volume_mount_path": "/var/lib/postgresql/data",
      "http": false
    }
  ],
  "required_inputs": [
    {
      "key": "PORT",
      "service": "Keycloak",
      "description": "HTTP port Railway routes to - leave as is.",
      "secret": false,
      "strategy": "default",
      "default": "8080"
    },
    {
      "key": "KC_DB_URL",
      "service": "Keycloak",
      "description": "Postgres JDBC URL (private network)",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "KC_HOSTNAME",
      "service": "Keycloak",
      "description": "Public URL Keycloak puts in tokens and redirects. Change it if you add a custom domain.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "KC_HTTP_PORT",
      "service": "Keycloak",
      "description": "HTTP port - leave as is.",
      "secret": false,
      "strategy": "default",
      "default": "8080"
    },
    {
      "key": "KC_DB_PASSWORD",
      "service": "Keycloak",
      "description": "Postgres password",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "KC_DB_USERNAME",
      "service": "Keycloak",
      "description": "Postgres user",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "KC_HTTP_ENABLED",
      "service": "Keycloak",
      "description": "Plain HTTP behind Railway's TLS proxy - leave as is.",
      "secret": false,
      "strategy": "default",
      "default": "true"
    },
    {
      "key": "KC_PROXY_HEADERS",
      "service": "Keycloak",
      "description": "Trust Railway's X-Forwarded-* headers (TLS ends at Railway's edge) - leave as is.",
      "secret": false,
      "strategy": "default",
      "default": "xforwarded"
    },
    {
      "key": "JAVA_OPTS_KC_HEAP",
      "service": "Keycloak",
      "description": "JVM heap: capped at 768 MB and handed back when idle. Raise -Xmx for many realms or heavy traffic.",
      "secret": false,
      "strategy": "default",
      "default": "-Xms64m -Xmx768m -XX:MaxHeapFreeRatio=20 -XX:MinHeapFreeRatio=10 -XX:G1PeriodicGCInterval=60000"
    },
    {
      "key": "KC_BOOTSTRAP_ADMIN_PASSWORD",
      "service": "Keycloak",
      "description": "Bootstrap admin password, generated at deploy time and used on the first boot only.",
      "secret": true,
      "strategy": "generate",
      "generate": "strong_password"
    },
    {
      "key": "KC_BOOTSTRAP_ADMIN_USERNAME",
      "service": "Keycloak",
      "description": "Username of the bootstrap admin in the master realm, created on the first boot only.",
      "secret": false,
      "strategy": "default",
      "default": "admin"
    },
    {
      "key": "PGDATA",
      "service": "Postgres",
      "description": "Data subdirectory - keeps Postgres happy on Railway volumes",
      "secret": false,
      "strategy": "default",
      "default": "/var/lib/postgresql/data/pgdata"
    },
    {
      "key": "POSTGRES_DB",
      "service": "Postgres",
      "description": "Database name",
      "secret": false,
      "strategy": "default",
      "default": "keycloak"
    },
    {
      "key": "POSTGRES_USER",
      "service": "Postgres",
      "description": "Database user",
      "secret": false,
      "strategy": "default",
      "default": "keycloak"
    },
    {
      "key": "POSTGRES_PASSWORD",
      "service": "Postgres",
      "description": "Auto-generated database password",
      "secret": true,
      "strategy": "generate",
      "generate": "strong_password"
    },
    {
      "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS",
      "service": "Postgres",
      "description": "Time for Postgres to shut down cleanly on redeploy",
      "secret": false,
      "strategy": "default",
      "default": "60"
    }
  ],
  "deploy": {
    "mcp": {
      "server": "railway",
      "tool": "deploy_template",
      "args": {
        "template_code": "keycloak-sso"
      }
    },
    "cli": "railway deploy --template keycloak-sso",
    "api": {
      "method": "POST",
      "path": "/graphql/v2",
      "body": {
        "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }",
        "variables": {
          "input": {
            "templateId": "64202b11-3bdc-4822-aaa5-b1c05baae2fc",
            "serializedConfig": {
              "buckets": {},
              "services": {
                "6c86d34c-0a66-48cb-8d03-12640d70729c": {
                  "icon": "https://raw.githubusercontent.com/two-workspaces/keycloak/main/icon.svg",
                  "name": "Keycloak",
                  "build": {
                    "dockerfilePath": "Dockerfile"
                  },
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": "/realms/master/.well-known/openid-configuration",
                    "restartPolicyType": "ON_FAILURE",
                    "healthcheckTimeout": 300,
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "repo": "https://github.com/two-workspaces/keycloak",
                    "rootDirectory": null
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "HTTP port Railway routes to - leave as is.",
                      "defaultValue": "8080"
                    },
                    "KC_DB_URL": {
                      "isOptional": false,
                      "description": "Postgres JDBC URL (private network)",
                      "defaultValue": "jdbc:postgresql://${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/${{Postgres.POSTGRES_DB}}"
                    },
                    "KC_HOSTNAME": {
                      "isOptional": false,
                      "description": "Public URL Keycloak puts in tokens and redirects. Change it if you add a custom domain.",
                      "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "KC_HTTP_PORT": {
                      "isOptional": false,
                      "description": "HTTP port - leave as is.",
                      "defaultValue": "8080"
                    },
                    "KC_DB_PASSWORD": {
                      "isOptional": false,
                      "description": "Postgres password",
                      "defaultValue": "${{Postgres.POSTGRES_PASSWORD}}"
                    },
                    "KC_DB_USERNAME": {
                      "isOptional": false,
                      "description": "Postgres user",
                      "defaultValue": "${{Postgres.POSTGRES_USER}}"
                    },
                    "KC_HTTP_ENABLED": {
                      "isOptional": false,
                      "description": "Plain HTTP behind Railway's TLS proxy - leave as is.",
                      "defaultValue": "true"
                    },
                    "KC_PROXY_HEADERS": {
                      "isOptional": false,
                      "description": "Trust Railway's X-Forwarded-* headers (TLS ends at Railway's edge) - leave as is.",
                      "defaultValue": "xforwarded"
                    },
                    "JAVA_OPTS_KC_HEAP": {
                      "isOptional": false,
                      "description": "JVM heap: capped at 768 MB and handed back when idle. Raise -Xmx for many realms or heavy traffic.",
                      "defaultValue": "-Xms64m -Xmx768m -XX:MaxHeapFreeRatio=20 -XX:MinHeapFreeRatio=10 -XX:G1PeriodicGCInterval=60000"
                    },
                    "KC_BOOTSTRAP_ADMIN_PASSWORD": {
                      "isOptional": false,
                      "description": "Bootstrap admin password, generated at deploy time and used on the first boot only.",
                      "defaultValue": "{{KC_BOOTSTRAP_ADMIN_PASSWORD}}"
                    },
                    "KC_BOOTSTRAP_ADMIN_USERNAME": {
                      "isOptional": false,
                      "description": "Username of the bootstrap admin in the master realm, created on the first boot only.",
                      "defaultValue": "admin"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>": {}
                    }
                  },
                  "volumeMounts": {}
                },
                "7229acfb-b23d-4ca3-a8a6-35cf36cf3b6c": {
                  "icon": "https://devicons.railway.app/i/postgresql.svg",
                  "name": "Postgres",
                  "build": {},
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "postgres:17.11-alpine"
                  },
                  "variables": {
                    "PGDATA": {
                      "isOptional": false,
                      "description": "Data subdirectory - keeps Postgres happy on Railway volumes",
                      "defaultValue": "/var/lib/postgresql/data/pgdata"
                    },
                    "POSTGRES_DB": {
                      "isOptional": false,
                      "description": "Database name",
                      "defaultValue": "keycloak"
                    },
                    "POSTGRES_USER": {
                      "isOptional": false,
                      "description": "Database user",
                      "defaultValue": "keycloak"
                    },
                    "POSTGRES_PASSWORD": {
                      "isOptional": false,
                      "description": "Auto-generated database password",
                      "defaultValue": "{{POSTGRES_PASSWORD}}"
                    },
                    "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": {
                      "isOptional": false,
                      "description": "Time for Postgres to shut down cleanly on redeploy",
                      "defaultValue": "60"
                    }
                  },
                  "networking": {
                    "serviceDomains": {}
                  },
                  "volumeMounts": {
                    "cd26a979-dde8-4a3e-b976-b33d9eced2b1": {
                      "mountPath": "/var/lib/postgresql/data"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "post_deploy": {
    "healthcheck": {
      "service": "Keycloak",
      "method": "GET",
      "path": "/realms/master/.well-known/openid-configuration",
      "expect_status": 200
    }
  },
  "resources": {
    "expected_services": 2,
    "needs_volume": true
  },
  "generated_at": "2026-10-27T04:14:46.034Z",
  "generator_version": "0.1.0"
}