{ "manifest_version": "1.0.0", "template": { "id": "a2cea30f-12d8-4107-b0d7-089733951743", "slug": "kong-gateway-oss", "name": "Kong Gateway OSS", "description": "A Kong Gateway OSS deployment running in hybrid mode", "url": "https://railway.com/deploy/kong-gateway-oss", "upstream": { "image": "kong/kong:3.9.1" } }, "status": "unvalidated", "validated_at": null, "success_rate_30d": null, "services": [ { "name": "kong-cp", "source": { "image": "kong/kong:3.9.1" }, "needs_volume": false, "tcp_ports": [ 8001 ], "http": true }, { "name": "kong-db", "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:17" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "http": false }, { "name": "kong-dp", "source": { "image": "kong/kong:3.9.1" }, "needs_volume": false, "http": true } ], "required_inputs": [ { "key": "KONG_ROLE", "service": "kong-cp", "description": "Role that this kong node would assume", "secret": false, "strategy": "default", "default": "control_plane" }, { "key": "KONG_PG_HOST", "service": "kong-cp", "description": "PostgreSQL database host", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "KONG_PG_PORT", "service": "kong-cp", "description": "PostgreSQL database port", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "KONG_PG_USER", "service": "kong-cp", "description": "PostgreSQL username", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "KONG_DATABASE", "service": "kong-cp", "description": "Database strategy (Postgres)", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "KONG_PG_DATABASE", "service": "kong-cp", "description": "PostgreSQL database name", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "KONG_PG_PASSWORD", "service": "kong-cp", "description": "PostgreSQL password", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "KONG_ADMIN_LISTEN", "service": "kong-cp", "description": "Admin API listen interface/port", "secret": false, "strategy": "default", "default": "0.0.0.0:8001, [::]:8001" }, { "key": "KONG_CLUSTER_CERT", "service": "kong-cp", "description": "Base64-encoded certificate for cluster mTLS (required)", "secret": false, "strategy": "ask_user" }, { "key": "KONG_PROXY_LISTEN", "service": "kong-cp", "description": "Disable data-plane proxy ports on Control Plane", "secret": false, "strategy": "default", "default": "off" }, { "key": "KONG_ADMIN_GUI_URL", "service": "kong-cp", "description": "Public URL for Kong Manager GUI", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "KONG_CLUSTER_LISTEN", "service": "kong-cp", "description": "CP ↔ DP cluster communication endpoint", "secret": false, "strategy": "default", "default": "0.0.0.0:8005 ssl, [::]:8005 ssl" }, { "key": "KONG_ADMIN_ERROR_LOG", "service": "kong-cp", "description": "Admin API error logs destination", "secret": false, "strategy": "default", "default": "/dev/stderr" }, { "key": "KONG_PROXY_ERROR_LOG", "service": "kong-cp", "description": "Proxy error logs (mostly unused on CP)", "secret": false, "strategy": "default", "default": "/dev/stderr" }, { "key": "KONG_ADMIN_ACCESS_LOG", "service": "kong-cp", "description": "Admin API access logs", "secret": false, "strategy": "default", "default": "/dev/stdout" }, { "key": "KONG_ADMIN_API_LISTEN", "service": "kong-cp", "description": "Admin API listen settings", "secret": false, "strategy": "default", "default": "0.0.0.0:8001 reuseport backlog=16384" }, { "key": "KONG_ADMIN_GUI_LISTEN", "service": "kong-cp", "description": "Kong Manager GUI port bindings", "secret": false, "strategy": "default", "default": "0.0.0.0:8002, [::]:8002" }, { "key": "KONG_CLUSTER_CERT_KEY", "service": "kong-cp", "description": "Base64-encoded private key for cluster mTLS (required)", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "KONG_ADMIN_GUI_API_URL", "service": "kong-cp", "description": "API endpoint used by GUI", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "KONG_LUA_SSL_VERIFY_DEPTH", "service": "kong-cp", "description": "SSL certificate chain validation depth", "secret": false, "strategy": "default", "default": "2" }, { "key": "KONG_NGINX_WORKER_PROCESSES", "service": "kong-cp", "description": "Number of Nginx worker processes (IMPORTANT: Fine tune this variable depending on your needs. Setting this to the default value of `auto` will essentially eat the container's resources indefinitely. I recommend setting it to be the same as this node's max num vCPU cores)", "secret": false, "strategy": "default", "default": "2" }, { "key": "KONG_CLUSTER_TELEMETRY_LISTEN", "service": "kong-cp", "description": "Telemetry channel for hybrid mode", "secret": false, "strategy": "default", "default": "0.0.0.0:8006 ssl, [::]:8006 ssl" }, { "key": "KONG_LUA_SSL_TRUSTED_CERTIFICATE", "service": "kong-cp", "description": "Trusted CA bundle for Lua SSL", "secret": false, "strategy": "default", "default": "/etc/ssl/certs/ca-certificates.crt" }, { "key": "PGDATA", "service": "kong-db", "description": "Location where the database will be initialized", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "PGHOST", "service": "kong-db", "description": "Railway Private Domain Name.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PGPORT", "service": "kong-db", "description": "Port to connect to Postgres.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "PGUSER", "service": "kong-db", "description": "Required variable for Data panel", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGDATABASE", "service": "kong-db", "description": "Required variable for the data panel.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGPASSWORD", "service": "kong-db", "description": "Required variable for Data panel", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_DB", "service": "kong-db", "description": "Default database created when image is started.", "secret": false, "strategy": "default", "default": "kong" }, { "key": "DATABASE_URL", "service": "kong-db", "description": "URL to connect to Postgres database.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_USER", "service": "kong-db", "description": "User to connect to Postgres DB", "secret": false, "strategy": "default", "default": "kong" }, { "key": "SSL_CERT_DAYS", "service": "kong-db", "description": "SSL certificate expiry in days.", "secret": false, "strategy": "default", "default": "820" }, { "key": "POSTGRES_PASSWORD", "service": "kong-db", "description": "Password to connect to DB", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS", "service": "kong-db", "description": "Allow Postgres to cleanly shut down", "secret": false, "strategy": "default", "default": "60" }, { "key": "KONG_ROLE", "service": "kong-dp", "description": "Role that this kong node would assume", "secret": false, "strategy": "default", "default": "data_plane" }, { "key": "KONG_DATABASE", "service": "kong-dp", "description": "Disable local database; DP receives config from CP", "secret": false, "strategy": "default", "default": "off" }, { "key": "KONG_PROXY_URL", "service": "kong-dp", "description": "Public URL where the DP proxy is exposed", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "KONG_ADMIN_LISTEN", "service": "kong-dp", "description": "Disable Admin API on the Data Plane for security", "secret": false, "strategy": "default", "default": "off" }, { "key": "KONG_CLUSTER_CERT", "service": "kong-dp", "description": "Base64-encoded certificate for cluster mTLS (required)", "secret": false, "strategy": "ask_user" }, { "key": "KONG_PROXY_LISTEN", "service": "kong-dp", "description": "Proxy listener for incoming traffic", "secret": false, "strategy": "default", "default": "0.0.0.0:8000, [::]:8000" }, { "key": "KONG_PROXY_ERROR_LOG", "service": "kong-dp", "description": "Error logs for the proxy", "secret": false, "strategy": "default", "default": "/dev/stderr" }, { "key": "KONG_ADMIN_GUI_LISTEN", "service": "kong-dp", "description": "Disable Manager GUI on the DP (only on CP)", "secret": false, "strategy": "default", "default": "off" }, { "key": "KONG_CLUSTER_CERT_KEY", "service": "kong-dp", "description": "Base64-encoded private key for cluster mTLS (required)", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "KONG_PROXY_ACCESS_LOG", "service": "kong-dp", "description": "Access logs for proxied requests", "secret": false, "strategy": "default", "default": "/dev/stdout" }, { "key": "KONG_LUA_SSL_VERIFY_DEPTH", "service": "kong-dp", "description": "SSL certificate chain verification depth", "secret": false, "strategy": "default", "default": "2" }, { "key": "KONG_CLUSTER_CONTROL_PLANE", "service": "kong-dp", "description": "Address of CP for config sync", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "KONG_NGINX_WORKER_PROCESSES", "service": "kong-dp", "description": "Number of Nginx worker processes (IMPORTANT: Fine tune this variable depending on your needs. Setting this to the default value of `auto` will essentially eat the container's resources indefinitely. I recommend setting it to be the same as this node's max num vCPU cores)", "secret": false, "strategy": "default", "default": "2" }, { "key": "KONG_CLUSTER_TELEMETRY_ENDPOINT", "service": "kong-dp", "description": "Telemetry channel to CP", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "KONG_LUA_SSL_TRUSTED_CERTIFICATE", "service": "kong-dp", "description": "Trusted CA bundle for SSL", "secret": false, "strategy": "default", "default": "/etc/ssl/certs/ca-certificates.crt" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "kong-gateway-oss" } }, "cli": "railway deploy --template kong-gateway-oss", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "a2cea30f-12d8-4107-b0d7-089733951743", "serializedConfig": { "services": { "50c51db4-2c02-46b9-84bf-30ea9f31c9cc": { "icon": "https://developer.konghq.com/assets/logos/konglogo-gradient-secondary.svg", "name": "kong-cp", "deploy": { "healthcheckPath": "", "preDeployCommand": [ "kong migrations bootstrap" ] }, "source": { "image": "kong/kong:3.9.1" }, "variables": { "KONG_ROLE": { "description": "Role that this kong node would assume", "defaultValue": "control_plane" }, "KONG_PG_HOST": { "description": "PostgreSQL database host", "defaultValue": "${{kong-db.PGHOST}}" }, "KONG_PG_PORT": { "description": "PostgreSQL database port", "defaultValue": "${{kong-db.PGPORT}}" }, "KONG_PG_USER": { "description": "PostgreSQL username", "defaultValue": "${{kong-db.PGUSER}}" }, "KONG_DATABASE": { "description": "Database strategy (Postgres)", "defaultValue": "postgres" }, "KONG_PG_DATABASE": { "description": "PostgreSQL database name", "defaultValue": "${{kong-db.PGDATABASE}}" }, "KONG_PG_PASSWORD": { "description": "PostgreSQL password", "defaultValue": "${{kong-db.PGPASSWORD}}" }, "KONG_ADMIN_LISTEN": { "description": "Admin API listen interface/port", "defaultValue": "0.0.0.0:8001, [::]:8001" }, "KONG_CLUSTER_CERT": { "isOptional": false, "description": "Base64-encoded certificate for cluster mTLS (required)", "defaultValue": "{{KONG_CLUSTER_CERT}}" }, "KONG_PROXY_LISTEN": { "description": "Disable data-plane proxy ports on Control Plane", "defaultValue": "off" }, "KONG_ADMIN_GUI_URL": { "isOptional": true, "description": "Public URL for Kong Manager GUI", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "KONG_CLUSTER_LISTEN": { "description": "CP ↔ DP cluster communication endpoint", "defaultValue": "0.0.0.0:8005 ssl, [::]:8005 ssl" }, "KONG_ADMIN_ERROR_LOG": { "description": "Admin API error logs destination", "defaultValue": "/dev/stderr" }, "KONG_PROXY_ERROR_LOG": { "description": "Proxy error logs (mostly unused on CP)", "defaultValue": "/dev/stderr" }, "KONG_ADMIN_ACCESS_LOG": { "description": "Admin API access logs", "defaultValue": "/dev/stdout" }, "KONG_ADMIN_API_LISTEN": { "description": "Admin API listen settings", "defaultValue": "0.0.0.0:8001 reuseport backlog=16384" }, "KONG_ADMIN_GUI_LISTEN": { "description": "Kong Manager GUI port bindings", "defaultValue": "0.0.0.0:8002, [::]:8002" }, "KONG_CLUSTER_CERT_KEY": { "isOptional": false, "description": "Base64-encoded private key for cluster mTLS (required)", "defaultValue": "{{KONG_CLUSTER_CERT_KEY}}" }, "KONG_ADMIN_GUI_API_URL": { "isOptional": true, "description": "API endpoint used by GUI", "defaultValue": "http://${{RAILWAY_TCP_PROXY_DOMAIN}}:${{RAILWAY_TCP_PROXY_PORT}}" }, "KONG_LUA_SSL_VERIFY_DEPTH": { "description": "SSL certificate chain validation depth", "defaultValue": "2" }, "KONG_NGINX_WORKER_PROCESSES": { "description": "Number of Nginx worker processes (IMPORTANT: Fine tune this variable depending on your needs. Setting this to the default value of `auto` will essentially eat the container's resources indefinitely. I recommend setting it to be the same as this node's max num vCPU cores)", "defaultValue": "2" }, "KONG_CLUSTER_TELEMETRY_LISTEN": { "description": "Telemetry channel for hybrid mode", "defaultValue": "0.0.0.0:8006 ssl, [::]:8006 ssl" }, "KONG_LUA_SSL_TRUSTED_CERTIFICATE": { "description": "Trusted CA bundle for Lua SSL", "defaultValue": "/etc/ssl/certs/ca-certificates.crt" } }, "networking": { "tcpProxies": { "8001": {} }, "serviceDomains": { ":8002": { "port": 8002 } } } }, "e210e8b6-bba1-4f31-bde3-b7e7eaa36e60": { "icon": "https://devicons.railway.app/i/postgresql.svg", "name": "kong-db", "build": {}, "deploy": { "requiredMountPath": "/var/lib/postgresql/data" }, "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:17" }, "variables": { "PGDATA": { "isOptional": false, "description": "Location where the database will be initialized", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "PGHOST": { "isOptional": false, "description": "Railway Private Domain Name.", "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}" }, "PGPORT": { "isOptional": false, "description": "Port to connect to Postgres.", "defaultValue": "5432" }, "PGUSER": { "isOptional": false, "description": "Required variable for Data panel", "defaultValue": "${{ POSTGRES_USER }}" }, "PGDATABASE": { "isOptional": false, "description": "Required variable for the data panel.", "defaultValue": "${{POSTGRES_DB}}" }, "PGPASSWORD": { "isOptional": false, "description": "Required variable for Data panel", "defaultValue": "${{POSTGRES_PASSWORD}}" }, "POSTGRES_DB": { "isOptional": false, "description": "Default database created when image is started.", "defaultValue": "kong" }, "DATABASE_URL": { "isOptional": false, "description": "URL to connect to Postgres database.", "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{PGDATABASE}}" }, "POSTGRES_USER": { "isOptional": false, "description": "User to connect to Postgres DB", "defaultValue": "kong" }, "SSL_CERT_DAYS": { "isOptional": true, "description": "SSL certificate expiry in days.", "defaultValue": "820" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Password to connect to DB", "defaultValue": "{{POSTGRES_PASSWORD}}" }, "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": { "isOptional": false, "description": "Allow Postgres to cleanly shut down", "defaultValue": "60" } }, "networking": {}, "volumeMounts": { "e210e8b6-bba1-4f31-bde3-b7e7eaa36e60": { "mountPath": "/var/lib/postgresql/data" } }, "haTemplateCode": "postgres-ha", "haConversionConfig": { "edge": { "label": "Reverse Proxy", "options": [ 2, 3, 4, 5 ], "nodeLabel": "HAProxy", "description": "Routes traffic to the primary", "defaultValue": 3 }, "replica": { "label": "Replicas", "options": [ 2, 3, 4, 5, 6, 7 ], "nodeLabel": "Postgres", "description": "Streaming replicas for automatic failover", "defaultValue": 2 }, "internal": { "label": "Coordinator Nodes", "options": [ 3, 5, 7, 9 ], "nodeLabel": "etcd", "defaultValue": 3 }, "description": "This will convert your Postgres database to an HA cluster with Patroni failover and etcd consensus." } }, "f8b8f0da-09d0-4b39-9e51-98ac53024edd": { "icon": "https://developer.konghq.com/assets/logos/konglogo-gradient-secondary.svg", "name": "kong-dp", "deploy": { "healthcheckPath": "" }, "source": { "image": "kong/kong:3.9.1" }, "variables": { "KONG_ROLE": { "description": "Role that this kong node would assume", "defaultValue": "data_plane" }, "KONG_DATABASE": { "description": "Disable local database; DP receives config from CP", "defaultValue": "off" }, "KONG_PROXY_URL": { "description": "Public URL where the DP proxy is exposed", "defaultValue": "https://${{kong-dp.RAILWAY_PUBLIC_DOMAIN}}" }, "KONG_ADMIN_LISTEN": { "description": "Disable Admin API on the Data Plane for security", "defaultValue": "off" }, "KONG_CLUSTER_CERT": { "isOptional": false, "description": "Base64-encoded certificate for cluster mTLS (required)", "defaultValue": "{{KONG_CLUSTER_CERT}}" }, "KONG_PROXY_LISTEN": { "description": "Proxy listener for incoming traffic", "defaultValue": "0.0.0.0:8000, [::]:8000" }, "KONG_PROXY_ERROR_LOG": { "description": "Error logs for the proxy", "defaultValue": "/dev/stderr" }, "KONG_ADMIN_GUI_LISTEN": { "description": "Disable Manager GUI on the DP (only on CP)", "defaultValue": "off" }, "KONG_CLUSTER_CERT_KEY": { "isOptional": false, "description": "Base64-encoded private key for cluster mTLS (required)", "defaultValue": "{{KONG_CLUSTER_CERT_KEY}}" }, "KONG_PROXY_ACCESS_LOG": { "description": "Access logs for proxied requests", "defaultValue": "/dev/stdout" }, "KONG_LUA_SSL_VERIFY_DEPTH": { "description": "SSL certificate chain verification depth", "defaultValue": "2" }, "KONG_CLUSTER_CONTROL_PLANE": { "description": "Address of CP for config sync", "defaultValue": "${{kong-cp.RAILWAY_PRIVATE_DOMAIN}}:8005" }, "KONG_NGINX_WORKER_PROCESSES": { "description": "Number of Nginx worker processes (IMPORTANT: Fine tune this variable depending on your needs. Setting this to the default value of `auto` will essentially eat the container's resources indefinitely. I recommend setting it to be the same as this node's max num vCPU cores)", "defaultValue": "2" }, "KONG_CLUSTER_TELEMETRY_ENDPOINT": { "description": "Telemetry channel to CP", "defaultValue": "${{kong-cp.RAILWAY_PRIVATE_DOMAIN}}:8006" }, "KONG_LUA_SSL_TRUSTED_CERTIFICATE": { "description": "Trusted CA bundle for SSL", "defaultValue": "/etc/ssl/certs/ca-certificates.crt" } }, "networking": { "serviceDomains": { ":8000": { "port": 8000 } } } } } } } } } } }, "post_deploy": {}, "resources": { "expected_services": 3, "needs_volume": true }, "generated_at": "2026-09-20T16:14:49.616Z", "generator_version": "0.1.0" }