{ "manifest_version": "1.0.0", "template": { "id": "3cf23b4f-26a2-466c-9c46-5037f2b4cfb0", "slug": "librechat-open-source", "name": "LibreChat [Updated Sep '26]", "description": "LibreChat [Sep '26] (Self-Hosted ChatGPT UI, Multi-Provider + RAG)", "url": "https://railway.com/deploy/librechat-open-source", "upstream": { "image": "ghcr.io/danny-avila/librechat-dev:latest" } }, "services": [ { "name": "meilisearch", "source": { "image": "getmeili/meilisearch:v1.53.1" }, "needs_volume": true, "volume_mount_path": "/meili_data", "http": false }, { "name": "rag_api", "source": { "image": "ghcr.io/danny-avila/librechat-rag-api-dev-lite:v0.9.0" }, "needs_volume": false, "http": false }, { "name": "librechat", "source": { "image": "ghcr.io/danny-avila/librechat-dev:latest" }, "needs_volume": false, "http": true }, { "name": "vectordb", "source": { "image": "pgvector/pgvector:0.8.6-pg16" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "http": false }, { "name": "mongodb", "source": { "image": "mongo:8.0.20" }, "needs_volume": true, "volume_mount_path": "/data/db", "http": false } ], "required_inputs": [ { "key": "MEILI_HOST", "service": "meilisearch", "description": "Meilisearch's own self-reference, required by LibreChat's official compose pattern.", "secret": false, "strategy": "default", "default": "http://meilisearch.railway.internal:7700" }, { "key": "MEILI_MASTER_KEY", "service": "meilisearch", "description": "Auth key for this Meilisearch instance — referenced by librechat's own MEILI_MASTER_KEY variable, must match exactly.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "MEILI_NO_ANALYTICS", "service": "meilisearch", "description": "Disables Meilisearch's anonymized telemetry.", "secret": false, "strategy": "default", "default": "true" }, { "key": "DB_HOST", "service": "rag_api", "description": "Private-network hostname of the vectordb service.", "secret": false, "strategy": "default", "default": "vectordb.railway.internal" }, { "key": "RAG_PORT", "service": "rag_api", "description": "Port this service listens on — must match librechat's RAG_API_URL port.", "secret": false, "strategy": "default", "default": "8000" }, { "key": "POSTGRES_DB", "service": "rag_api", "description": "Must match vectordb's own database name exactly.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_USER", "service": "rag_api", "description": "Must match vectordb's own username exactly.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_PASSWORD", "service": "rag_api", "description": "Must match vectordb's own password exactly.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "RAG_OPENAI_API_KEY", "service": "rag_api", "description": "Required for this service to boot at all, not just for RAG features to work. Confirmed live: rag_api initializes its embeddings client at import time and crash-loops forever with openai.OpenAIError: Missing credentials if this is unset, before the server even starts listening. Any non-empty value clears the boot crash (the client library doesn't validate authenticity at construction time), but only a real key makes file-upload Q&A actually function.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "HOST", "service": "librechat", "description": "Must bind to all interfaces, not localhost, for Railway's proxy to reach the container.", "secret": false, "strategy": "default", "default": "0.0.0.0" }, { "key": "PORT", "service": "librechat", "description": "LibreChat's own default port. Must match the service's Networking target port.", "secret": false, "strategy": "default", "default": "3080" }, { "key": "SEARCH", "service": "librechat", "description": "Enables message/conversation search — requires MEILI_HOST and MEILI_MASTER_KEY both set correctly, which this template wires automatically.", "secret": false, "strategy": "default", "default": "true" }, { "key": "CREDS_IV", "service": "librechat", "description": "16-byte hex initialization vector paired with CREDS_KEY. Must be exactly 16 bytes.", "secret": false, "strategy": "generate", "generate": "random_base64_32" }, { "key": "NO_INDEX", "service": "librechat", "description": "Prevents search engines from indexing your private LibreChat instance.", "secret": false, "strategy": "default", "default": "true" }, { "key": "RAG_PORT", "service": "librechat", "description": "Port the rag_api service listens on — must match RAG_API_URL's port.", "secret": false, "strategy": "default", "default": "8000" }, { "key": "CREDS_KEY", "service": "librechat", "description": "32-byte hex key used to encrypt stored provider credentials (API keys users add in-app). Must be exactly 32 bytes — a wrong length breaks credential encryption entirely, not just weakens it.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "MONGO_URI", "service": "librechat", "description": "Connection string to the mongodb service. No username/password — Mongo runs with --noauth on the private network, matching LibreChat's own official compose file exactly.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "JWT_SECRET", "service": "librechat", "description": "Signs user session JWTs. Minimum 32 bytes per LibreChat's own docs.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "MEILI_HOST", "service": "librechat", "description": "Connection to the meilisearch service for conversation search indexing.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "RAG_API_URL", "service": "librechat", "description": "Connection to the rag_api service for file/document retrieval-augmented generation.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "DOMAIN_CLIENT", "service": "librechat", "description": "Full URL including protocol — unlike some other templates in this project, LibreChat's own config expects the scheme prefix here, not a bare hostname.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "DOMAIN_SERVER", "service": "librechat", "description": "Same value as DOMAIN_CLIENT for this single-domain deploy.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "MEILI_MASTER_KEY", "service": "librechat", "description": "Must exactly match the meilisearch service's own master key or search silently fails to index.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "ALLOW_REGISTRATION", "service": "librechat", "description": "Whether new users can self-register an account. LibreChat's own default is already true; set explicitly here so deployers can find and flip it without hunting through docs.", "secret": false, "strategy": "default", "default": "true" }, { "key": "JWT_REFRESH_SECRET", "service": "librechat", "description": "Signs refresh tokens. Must differ from JWT_SECRET — never reuse the same value for both.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "PGDATA", "service": "vectordb", "description": "Required — without this, Postgres refuses to initialize on the raw volume mount point and the service crashes on every deploy. Confirmed live during this template's own build.", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "POSTGRES_DB", "service": "vectordb", "description": "Database name for stored document embeddings.", "secret": false, "strategy": "default", "default": "librechat_vectors" }, { "key": "POSTGRES_USER", "service": "vectordb", "description": "Must match the username rag_api connects with.", "secret": false, "strategy": "default", "default": "librechat" }, { "key": "POSTGRES_PASSWORD", "service": "vectordb", "description": "Referenced by rag_api's own POSTGRES_PASSWORD variable — must match exactly.", "secret": true, "strategy": "generate", "generate": "strong_password" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "librechat-open-source" } }, "cli": "railway deploy --template librechat-open-source", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "3cf23b4f-26a2-466c-9c46-5037f2b4cfb0", "serializedConfig": { "buckets": {}, "services": { "19430d39-316b-48a8-93aa-923c301ec4fe": { "icon": "https://raw.githubusercontent.com/meilisearch/meilisearch/refs/heads/main/assets/logo.svg", "name": "meilisearch", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "getmeili/meilisearch:v1.53.1" }, "variables": { "MEILI_HOST": { "isOptional": false, "description": "Meilisearch's own self-reference, required by LibreChat's official compose pattern.", "defaultValue": "http://meilisearch.railway.internal:7700" }, "MEILI_MASTER_KEY": { "isOptional": false, "description": "Auth key for this Meilisearch instance — referenced by librechat's own MEILI_MASTER_KEY variable, must match exactly.", "defaultValue": "{{MEILI_MASTER_KEY}}" }, "MEILI_NO_ANALYTICS": { "isOptional": false, "description": "Disables Meilisearch's anonymized telemetry.", "defaultValue": "true" } }, "volumeMounts": { "19430d39-316b-48a8-93aa-923c301ec4fe": { "mountPath": "/meili_data" } } }, "32f7ee79-d775-4872-a209-648eb812701f": { "icon": "https://www.librechat.ai/librechat.svg", "name": "rag_api", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/danny-avila/librechat-rag-api-dev-lite:v0.9.0" }, "variables": { "DB_HOST": { "isOptional": false, "description": "Private-network hostname of the vectordb service.", "defaultValue": "vectordb.railway.internal" }, "RAG_PORT": { "isOptional": false, "description": "Port this service listens on — must match librechat's RAG_API_URL port.", "defaultValue": "8000" }, "POSTGRES_DB": { "isOptional": false, "description": "Must match vectordb's own database name exactly.", "defaultValue": "${{vectordb.POSTGRES_DB}}" }, "POSTGRES_USER": { "isOptional": false, "description": "Must match vectordb's own username exactly.", "defaultValue": "${{vectordb.POSTGRES_USER}}" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Must match vectordb's own password exactly.", "defaultValue": "${{vectordb.POSTGRES_PASSWORD}}" }, "RAG_OPENAI_API_KEY": { "isOptional": false, "description": "Required for this service to boot at all, not just for RAG features to work. Confirmed live: rag_api initializes its embeddings client at import time and crash-loops forever with openai.OpenAIError: Missing credentials if this is unset, before the server even starts listening. Any non-empty value clears the boot crash (the client library doesn't validate authenticity at construction time), but only a real key makes file-upload Q&A actually function.", "defaultValue": "{{RAG_OPENAI_API_KEY}}" } } }, "86cc5bc4-adb5-45b2-9758-472a4cf66f32": { "icon": "https://www.librechat.ai/librechat.svg", "name": "librechat", "deploy": { "startCommand": null, "healthcheckPath": "/health", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/danny-avila/librechat-dev:latest" }, "variables": { "HOST": { "isOptional": false, "description": "Must bind to all interfaces, not localhost, for Railway's proxy to reach the container.", "defaultValue": "0.0.0.0" }, "PORT": { "isOptional": false, "description": "LibreChat's own default port. Must match the service's Networking target port.", "defaultValue": "3080" }, "SEARCH": { "isOptional": false, "description": "Enables message/conversation search — requires MEILI_HOST and MEILI_MASTER_KEY both set correctly, which this template wires automatically.", "defaultValue": "true" }, "CREDS_IV": { "isOptional": false, "description": "16-byte hex initialization vector paired with CREDS_KEY. Must be exactly 16 bytes.", "defaultValue": "{{CREDS_IV}}" }, "NO_INDEX": { "isOptional": false, "description": "Prevents search engines from indexing your private LibreChat instance.", "defaultValue": "true" }, "RAG_PORT": { "isOptional": false, "description": "Port the rag_api service listens on — must match RAG_API_URL's port.", "defaultValue": "8000" }, "CREDS_KEY": { "isOptional": false, "description": "32-byte hex key used to encrypt stored provider credentials (API keys users add in-app). Must be exactly 32 bytes — a wrong length breaks credential encryption entirely, not just weakens it.", "defaultValue": "{{CREDS_KEY}}" }, "MONGO_URI": { "isOptional": false, "description": "Connection string to the mongodb service. No username/password — Mongo runs with --noauth on the private network, matching LibreChat's own official compose file exactly.", "defaultValue": "mongodb://${{mongodb.RAILWAY_PRIVATE_DOMAIN}}:27017/LibreChat" }, "JWT_SECRET": { "isOptional": false, "description": "Signs user session JWTs. Minimum 32 bytes per LibreChat's own docs.", "defaultValue": "{{JWT_SECRET}}" }, "MEILI_HOST": { "isOptional": false, "description": "Connection to the meilisearch service for conversation search indexing.", "defaultValue": "http://${{meilisearch.RAILWAY_PRIVATE_DOMAIN}}:7700" }, "RAG_API_URL": { "isOptional": false, "description": "Connection to the rag_api service for file/document retrieval-augmented generation.", "defaultValue": "http://${{rag_api.RAILWAY_PRIVATE_DOMAIN}}:8000" }, "DOMAIN_CLIENT": { "isOptional": false, "description": "Full URL including protocol — unlike some other templates in this project, LibreChat's own config expects the scheme prefix here, not a bare hostname.", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "DOMAIN_SERVER": { "isOptional": false, "description": "Same value as DOMAIN_CLIENT for this single-domain deploy.", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "MEILI_MASTER_KEY": { "isOptional": false, "description": "Must exactly match the meilisearch service's own master key or search silently fails to index.", "defaultValue": "${{meilisearch.MEILI_MASTER_KEY}}" }, "ALLOW_REGISTRATION": { "isOptional": true, "description": "Whether new users can self-register an account. LibreChat's own default is already true; set explicitly here so deployers can find and flip it without hunting through docs.", "defaultValue": "true" }, "JWT_REFRESH_SECRET": { "isOptional": false, "description": "Signs refresh tokens. Must differ from JWT_SECRET — never reuse the same value for both.", "defaultValue": "{{JWT_REFRESH_SECRET}}" } }, "networking": { "serviceDomains": { ":3080": { "port": 3080 } } } }, "9f2ea12e-2f9f-4078-8cb0-9deb34f15d5c": { "icon": "https://www.svgrepo.com/show/303301/postgresql-logo.svg", "name": "vectordb", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "pgvector/pgvector:0.8.6-pg16" }, "variables": { "PGDATA": { "isOptional": false, "description": "Required — without this, Postgres refuses to initialize on the raw volume mount point and the service crashes on every deploy. Confirmed live during this template's own build.", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "POSTGRES_DB": { "isOptional": false, "description": "Database name for stored document embeddings.", "defaultValue": "librechat_vectors" }, "POSTGRES_USER": { "isOptional": false, "description": "Must match the username rag_api connects with.", "defaultValue": "librechat" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Referenced by rag_api's own POSTGRES_PASSWORD variable — must match exactly.", "defaultValue": "{{POSTGRES_PASSWORD}}" } }, "volumeMounts": { "9f2ea12e-2f9f-4078-8cb0-9deb34f15d5c": { "mountPath": "/var/lib/postgresql/data" } } }, "abdf0b6b-d99e-4da6-841a-1aab97f3a0c6": { "icon": "https://devicons.railway.app/mongodb", "name": "mongodb", "deploy": { "startCommand": "mongod --noauth --bind_ip_all", "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "mongo:8.0.20" }, "variables": {}, "volumeMounts": { "abdf0b6b-d99e-4da6-841a-1aab97f3a0c6": { "mountPath": "/data/db" } } } } } } } } } }, "post_deploy": { "healthcheck": { "service": "librechat", "method": "GET", "path": "/health", "expect_status": 200 } }, "resources": { "expected_services": 5, "needs_volume": true }, "generated_at": "2026-09-08T18:46:46.960Z", "generator_version": "0.1.0", "status": "validated", "validated_at": "2026-09-08T17:58:32.916Z", "success_rate_30d": 1, "validation": { "last_run_id": "run_c413ad58efaa4ecfa3ce", "checks": [ { "name": "workflow_completed", "passed": true }, { "name": "all_services_deployed", "passed": true }, { "name": "healthcheck", "passed": true }, { "name": "stays_up", "passed": true } ], "typical_ready_seconds": 179, "typical_build_seconds": 0, "typical_start_seconds": 51, "slowest_service": "librechat" } }