{ "manifest_version": "1.0.0", "template": { "id": "ae1e8b7c-99f9-43ed-a7b3-1552f8d71c95", "slug": "multica-coding-agents", "name": "Multica | Open Source Linear for AI Coding Agents", "description": "Issue tracker where you assign tasks to Claude Code, Codex, Cursor", "url": "https://railway.com/deploy/multica-coding-agents", "upstream": { "image": "ghcr.io/multica-ai/multica-backend:v0.4.28" } }, "services": [ { "name": "Valkey", "source": { "image": "valkey/valkey:8.1.9-alpine" }, "needs_volume": false, "http": false }, { "name": "Postgres", "source": { "image": "pgvector/pgvector:0.8.6-pg17-trixie" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "http": false }, { "name": "multica-api", "source": { "image": "ghcr.io/multica-ai/multica-backend:v0.4.28" }, "needs_volume": false, "http": true }, { "name": "multica-web", "source": { "image": "ghcr.io/multica-ai/multica-web:v0.4.28" }, "needs_volume": false, "http": true } ], "required_inputs": [ { "key": "VALKEY_PASSWORD", "service": "Valkey", "description": "Password Valkey requires from the API. Hex on purpose — it is substituted into the REDIS_URL connection string, where a slash or an at-sign would truncate the URL.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "PGDATA", "service": "Postgres", "description": "Data directory, deliberately one level below the mount point: a fresh Railway volume already contains lost+found and the PostgreSQL entrypoint refuses to initialise into a non-empty directory.", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "POSTGRES_DB", "service": "Postgres", "description": "Database Multica connects to.", "secret": false, "strategy": "default", "default": "multica" }, { "key": "POSTGRES_USER", "service": "Postgres", "description": "Database role Multica connects as.", "secret": false, "strategy": "default", "default": "multica" }, { "key": "POSTGRES_PASSWORD", "service": "Postgres", "description": "Generated database password. Hex on purpose — it is substituted into DATABASE_URL, and the default generator alphabet can emit a slash that would cut the connection string short.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "PORT", "service": "multica-api", "description": "Port the Go API listens on. Railway routes traffic and health checks by it.", "secret": false, "strategy": "default", "default": "8080" }, { "key": "APP_ENV", "service": "multica-api", "description": "Enables the production safety checks. Among other things it makes the server ignore any fixed development verification code.", "secret": false, "strategy": "default", "default": "production" }, { "key": "REDIS_URL", "service": "multica-api", "description": "Valkey connection string. Its presence is what switches on per-IP rate limiting for the login endpoints and moves realtime fan-out onto a relay that survives more than one API replica.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "S3_BUCKET", "service": "multica-api", "description": "Railway object storage bucket holding attachments and avatars.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "S3_REGION", "service": "multica-api", "description": "Region of the attachments bucket.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SMTP_PORT", "service": "multica-api", "description": "SMTP port. 465 switches to implicit TLS automatically.", "secret": false, "strategy": "default", "default": "587" }, { "key": "JWT_SECRET", "service": "multica-api", "description": "Signs session tokens. Changing it logs everyone out.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "ALLOW_SIGNUP", "service": "multica-api", "description": "Leave true to create your first account, then set it to false — or restrict ALLOWED_EMAILS below — and redeploy. Your instance is on the public internet.", "secret": false, "strategy": "default", "default": "true" }, { "key": "DATABASE_URL", "service": "multica-api", "description": "PostgreSQL connection string, wired to the Postgres service over the private network.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "FRONTEND_ORIGIN", "service": "multica-api", "description": "Origin of the web app. Used for CORS and for the session cookie.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "MULTICA_APP_URL", "service": "multica-api", "description": "Public address of the web app, used in links the server generates.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "RATE_LIMIT_AUTH", "service": "multica-api", "description": "Requests per minute allowed to /auth/send-code. Upstream's default is 5 and assumes one bucket per visitor; because a CDN sits in front of your service the bucket is regional, hence the higher value. Lower it to 5 on a small instance.", "secret": false, "strategy": "default", "default": "20" }, { "key": "AWS_ENDPOINT_URL", "service": "multica-api", "description": "Railway object storage endpoint.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "AWS_ACCESS_KEY_ID", "service": "multica-api", "description": "Access key for the attachments bucket.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "S3_USE_PATH_STYLE", "service": "multica-api", "description": "Path-style addressing. Railway object storage only returns CORS headers on the path-style endpoint, so presigned URLs opened by a browser depend on this being true.", "secret": false, "strategy": "default", "default": "true" }, { "key": "MULTICA_PUBLIC_URL", "service": "multica-api", "description": "This API's own public address. It is what the UI prints in the `multica setup self-host` command, and what autopilot webhook URLs are minted from.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "GOOGLE_REDIRECT_URI", "service": "multica-api", "description": "OAuth callback, already pointed at your web domain.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "CORS_ALLOWED_ORIGINS", "service": "multica-api", "description": "Origins allowed to call the API from a browser.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "AWS_SECRET_ACCESS_KEY", "service": "multica-api", "description": "Secret key for the attachments bucket.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "MULTICA_VCS_SECRET_KEY", "service": "multica-api", "description": "Encrypts self-hosted Git provider tokens at rest. Must be base64 of exactly 32 bytes. Without it the integration above stays off however the flag is set.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "RATE_LIMIT_AUTH_VERIFY", "service": "multica-api", "description": "Requests per minute allowed to /auth/verify-code. A login code is already void after five wrong guesses; this bounds how fast an attacker can request fresh ones.", "secret": false, "strategy": "default", "default": "60" }, { "key": "ATTACHMENT_DOWNLOAD_MODE", "service": "multica-api", "description": "How attachments are delivered: auto lets the server pick between a presigned URL and streaming through the API.", "secret": false, "strategy": "default", "default": "auto" }, { "key": "MULTICA_SLACK_SECRET_KEY", "service": "multica-api", "description": "Encrypts each workspace's Slack bot token at rest. Base64 of exactly 32 bytes. The tokens themselves arrive per workspace via OAuth; this one key unseals them.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "MULTICA_PLUGIN_SECRET_KEY", "service": "multica-api", "description": "Encrypts remote MCP server credentials at rest. Base64 of exactly 32 bytes. Without it the plugin configuration endpoints fail closed.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "RATE_LIMIT_TRUSTED_PROXIES", "service": "multica-api", "description": "Railway reaches this container from its internal 100.64/10 range, so naming that range lets the rate limiter look past it into X-Forwarded-For. Railway discards whatever XFF the caller sent, so this cannot be used to spoof an address.", "secret": false, "strategy": "default", "default": "100.64.0.0/10" }, { "key": "MULTICA_VCS_INTEGRATION_ENABLED", "service": "multica-api", "description": "Enables the self-hosted Git provider integration — Forgejo, Gitea and GitLab.", "secret": false, "strategy": "default", "default": "true" }, { "key": "PORT", "service": "multica-web", "description": "Port the Next.js server listens on.", "secret": false, "strategy": "default", "default": "3000" }, { "key": "DOCS_URL", "service": "multica-web", "description": "Upstream documentation, proxied under /docs. Clear it to disable that route.", "secret": false, "strategy": "default", "default": "https://multica.ai" }, { "key": "HOSTNAME", "service": "multica-web", "description": "Bind address. The image ships 0.0.0.0; :: leaves the Node socket dual-stack so it answers Railway's IPv4 health check as well as anything on the private network.", "secret": false, "strategy": "default", "default": "::" }, { "key": "REMOTE_API_URL", "service": "multica-web", "description": "Where the Next.js server proxies /api, /auth, /uploads and /ws. Keeping it on the private network is what makes your browser talk to a single origin.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "multica-coding-agents" } }, "cli": "railway deploy --template multica-coding-agents", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "ae1e8b7c-99f9-43ed-a7b3-1552f8d71c95", "serializedConfig": { "buckets": { "87a235e5-6b2a-4cee-b2d0-e638ad0c28ac": { "name": "Attachments" } }, "services": { "911d53be-9a47-4701-bc68-ad35e81245c7": { "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/valkey.svg", "name": "Valkey", "deploy": { "startCommand": "sh -c 'exec valkey-server --requirepass \"$VALKEY_PASSWORD\"'", "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "valkey/valkey:8.1.9-alpine" }, "variables": { "VALKEY_PASSWORD": { "isOptional": false, "description": "Password Valkey requires from the API. Hex on purpose — it is substituted into the REDIS_URL connection string, where a slash or an at-sign would truncate the URL.", "defaultValue": "{{VALKEY_PASSWORD}}" } } }, "9c22219e-0d0c-48f4-8a61-25d300e9d7d6": { "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/postgresql.svg", "name": "Postgres", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 2 }, "source": { "image": "pgvector/pgvector:0.8.6-pg17-trixie" }, "variables": { "PGDATA": { "isOptional": false, "description": "Data directory, deliberately one level below the mount point: a fresh Railway volume already contains lost+found and the PostgreSQL entrypoint refuses to initialise into a non-empty directory.", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "POSTGRES_DB": { "isOptional": false, "description": "Database Multica connects to.", "defaultValue": "multica" }, "POSTGRES_USER": { "isOptional": false, "description": "Database role Multica connects as.", "defaultValue": "multica" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Generated database password. Hex on purpose — it is substituted into DATABASE_URL, and the default generator alphabet can emit a slash that would cut the connection string short.", "defaultValue": "{{POSTGRES_PASSWORD}}" } }, "volumeMounts": { "9c22219e-0d0c-48f4-8a61-25d300e9d7d6": { "mountPath": "/var/lib/postgresql/data" } } }, "dcafd660-18ce-42af-a843-7cc41b4bee67": { "icon": "https://cdn.jsdelivr.net/gh/multica-ai/multica@v0.4.28/docs/assets/logo-dark.svg", "name": "multica-api", "deploy": { "startCommand": "sh -c 'cd /app && i=1; while [ $i -le 60 ]; do ./migrate up && break; echo \"waiting for postgres ($i/60)\"; sleep 3; i=$((i+1)); done; exec ./server'", "healthcheckPath": "/healthz", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/multica-ai/multica-backend:v0.4.28" }, "variables": { "PORT": { "isOptional": false, "description": "Port the Go API listens on. Railway routes traffic and health checks by it.", "defaultValue": "8080" }, "APP_ENV": { "isOptional": false, "description": "Enables the production safety checks. Among other things it makes the server ignore any fixed development verification code.", "defaultValue": "production" }, "SMTP_TLS": { "isOptional": true, "description": "Empty or starttls for STARTTLS; implicit for SMTPS on port 465.", "defaultValue": "" }, "REDIS_URL": { "isOptional": false, "description": "Valkey connection string. Its presence is what switches on per-IP rate limiting for the login endpoints and moves realtime fan-out onto a relay that survives more than one API replica.", "defaultValue": "redis://default:${{Valkey.VALKEY_PASSWORD}}@${{Valkey.RAILWAY_PRIVATE_DOMAIN}}:6379" }, "S3_BUCKET": { "isOptional": false, "description": "Railway object storage bucket holding attachments and avatars.", "defaultValue": "${{Attachments.BUCKET}}" }, "S3_REGION": { "isOptional": false, "description": "Region of the attachments bucket.", "defaultValue": "${{Attachments.REGION}}" }, "SMTP_HOST": { "isOptional": true, "description": "SMTP relay for login codes. Takes priority over Resend as soon as it is non-empty.", "defaultValue": "" }, "SMTP_PORT": { "isOptional": true, "description": "SMTP port. 465 switches to implicit TLS automatically.", "defaultValue": "587" }, "JWT_SECRET": { "isOptional": false, "description": "Signs session tokens. Changing it logs everyone out.", "defaultValue": "{{JWT_SECRET}}" }, "ALLOW_SIGNUP": { "isOptional": false, "description": "Leave true to create your first account, then set it to false — or restrict ALLOWED_EMAILS below — and redeploy. Your instance is on the public internet.", "defaultValue": "true" }, "DATABASE_URL": { "isOptional": false, "description": "PostgreSQL connection string, wired to the Postgres service over the private network.", "defaultValue": "postgres://multica:${{Postgres.POSTGRES_PASSWORD}}@${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/multica?sslmode=disable" }, "SMTP_PASSWORD": { "isOptional": true, "description": "SMTP password.", "defaultValue": "" }, "SMTP_USERNAME": { "isOptional": true, "description": "SMTP username. Leave empty for an unauthenticated relay.", "defaultValue": "" }, "ALLOWED_EMAILS": { "isOptional": true, "description": "Comma-separated allow-list of addresses that may sign up. Empty means anyone can.", "defaultValue": "" }, "RESEND_API_KEY": { "isOptional": true, "description": "Resend key for sending login codes. Leave empty and the code is printed to this service's log instead, which is how you sign in the first time.", "defaultValue": "" }, "FRONTEND_ORIGIN": { "isOptional": false, "description": "Origin of the web app. Used for CORS and for the session cookie.", "defaultValue": "https://${{multica-web.RAILWAY_PUBLIC_DOMAIN}}" }, "MULTICA_APP_URL": { "isOptional": false, "description": "Public address of the web app, used in links the server generates.", "defaultValue": "https://${{multica-web.RAILWAY_PUBLIC_DOMAIN}}" }, "RATE_LIMIT_AUTH": { "isOptional": false, "description": "Requests per minute allowed to /auth/send-code. Upstream's default is 5 and assumes one bucket per visitor; because a CDN sits in front of your service the bucket is regional, hence the higher value. Lower it to 5 on a small instance.", "defaultValue": "20" }, "SMTP_FROM_EMAIL": { "isOptional": true, "description": "Envelope sender for SMTP mail.", "defaultValue": "" }, "AWS_ENDPOINT_URL": { "isOptional": false, "description": "Railway object storage endpoint.", "defaultValue": "${{Attachments.ENDPOINT}}" }, "GOOGLE_CLIENT_ID": { "isOptional": true, "description": "Google OAuth client id, to offer Sign in with Google.", "defaultValue": "" }, "AWS_ACCESS_KEY_ID": { "isOptional": false, "description": "Access key for the attachments bucket.", "defaultValue": "${{Attachments.ACCESS_KEY_ID}}" }, "RESEND_FROM_EMAIL": { "isOptional": true, "description": "Sender address used with Resend.", "defaultValue": "" }, "S3_USE_PATH_STYLE": { "isOptional": false, "description": "Path-style addressing. Railway object storage only returns CORS headers on the path-style endpoint, so presigned URLs opened by a browser depend on this being true.", "defaultValue": "true" }, "MULTICA_PUBLIC_URL": { "isOptional": false, "description": "This API's own public address. It is what the UI prints in the `multica setup self-host` command, and what autopilot webhook URLs are minted from.", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "GOOGLE_REDIRECT_URI": { "isOptional": false, "description": "OAuth callback, already pointed at your web domain.", "defaultValue": "https://${{multica-web.RAILWAY_PUBLIC_DOMAIN}}/auth/callback" }, "CORS_ALLOWED_ORIGINS": { "isOptional": false, "description": "Origins allowed to call the API from a browser.", "defaultValue": "https://${{multica-web.RAILWAY_PUBLIC_DOMAIN}}" }, "GOOGLE_CLIENT_SECRET": { "isOptional": true, "description": "Google OAuth client secret.", "defaultValue": "" }, "ALLOWED_EMAIL_DOMAINS": { "isOptional": true, "description": "Comma-separated allow-list of email domains that may sign up, e.g. yourcompany.com.", "defaultValue": "" }, "AWS_SECRET_ACCESS_KEY": { "isOptional": false, "description": "Secret key for the attachments bucket.", "defaultValue": "${{Attachments.SECRET_ACCESS_KEY}}" }, "MULTICA_VCS_SECRET_KEY": { "isOptional": false, "description": "Encrypts self-hosted Git provider tokens at rest. Must be base64 of exactly 32 bytes. Without it the integration above stays off however the flag is set.", "defaultValue": "{{MULTICA_VCS_SECRET_KEY}}" }, "RATE_LIMIT_AUTH_VERIFY": { "isOptional": false, "description": "Requests per minute allowed to /auth/verify-code. A login code is already void after five wrong guesses; this bounds how fast an attacker can request fresh ones.", "defaultValue": "60" }, "MULTICA_LARK_SECRET_KEY": { "isOptional": true, "description": "Set to base64 of 32 random bytes to enable the Lark / Feishu bot. Empty leaves it off.", "defaultValue": "" }, "MULTICA_TRUSTED_PROXIES": { "isOptional": true, "description": "A separate setting from the rate limiter above: CIDRs whose X-Forwarded-For the autopilot webhook limiter should believe. Empty means it trusts no headers, which is the safe default here.", "defaultValue": "" }, "ATTACHMENT_DOWNLOAD_MODE": { "isOptional": false, "description": "How attachments are delivered: auto lets the server pick between a presigned URL and streaming through the API.", "defaultValue": "auto" }, "MULTICA_SLACK_SECRET_KEY": { "isOptional": false, "description": "Encrypts each workspace's Slack bot token at rest. Base64 of exactly 32 bytes. The tokens themselves arrive per workspace via OAuth; this one key unseals them.", "defaultValue": "{{MULTICA_SLACK_SECRET_KEY}}" }, "MULTICA_WECOM_SECRET_KEY": { "isOptional": true, "description": "Set to base64 of 32 random bytes to enable the WeCom smart bot. Empty leaves it off.", "defaultValue": "" }, "MULTICA_PLUGIN_SECRET_KEY": { "isOptional": false, "description": "Encrypts remote MCP server credentials at rest. Base64 of exactly 32 bytes. Without it the plugin configuration endpoints fail closed.", "defaultValue": "{{MULTICA_PLUGIN_SECRET_KEY}}" }, "DISABLE_WORKSPACE_CREATION": { "isOptional": true, "description": "Set to true to stop members creating further workspaces once yours exists.", "defaultValue": "" }, "RATE_LIMIT_TRUSTED_PROXIES": { "isOptional": false, "description": "Railway reaches this container from its internal 100.64/10 range, so naming that range lets the rate limiter look past it into X-Forwarded-For. Railway discards whatever XFF the caller sent, so this cannot be used to spoof an address.", "defaultValue": "100.64.0.0/10" }, "MULTICA_VCS_INTEGRATION_ENABLED": { "isOptional": false, "description": "Enables the self-hosted Git provider integration — Forgejo, Gitea and GitLab.", "defaultValue": "true" } }, "networking": { "serviceDomains": { ":8080": { "port": 8080 } } } }, "f48a55f1-3b5a-459b-a1b6-492adb5923d0": { "icon": "https://cdn.jsdelivr.net/gh/multica-ai/multica@v0.4.28/docs/assets/logo-dark.svg", "name": "multica-web", "deploy": { "startCommand": null, "healthcheckPath": "/", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/multica-ai/multica-web:v0.4.28" }, "variables": { "PORT": { "isOptional": false, "description": "Port the Next.js server listens on.", "defaultValue": "3000" }, "DOCS_URL": { "isOptional": false, "description": "Upstream documentation, proxied under /docs. Clear it to disable that route.", "defaultValue": "https://multica.ai" }, "HOSTNAME": { "isOptional": false, "description": "Bind address. The image ships 0.0.0.0; :: leaves the Node socket dual-stack so it answers Railway's IPv4 health check as well as anything on the private network.", "defaultValue": "::" }, "REMOTE_API_URL": { "isOptional": false, "description": "Where the Next.js server proxies /api, /auth, /uploads and /ws. Keeping it on the private network is what makes your browser talk to a single origin.", "defaultValue": "http://${{multica-api.RAILWAY_PRIVATE_DOMAIN}}:8080" } }, "networking": { "serviceDomains": { ":3000": { "port": 3000 } } } } } } } } } } }, "post_deploy": { "healthcheck": { "service": "multica-api", "method": "GET", "path": "/healthz", "expect_status": 200 } }, "resources": { "expected_services": 4, "needs_volume": true }, "generated_at": "2026-09-06T17:54:17.775Z", "generator_version": "0.1.0", "status": "validated", "validated_at": "2026-09-04T12:27:54.514Z", "success_rate_30d": 1, "validation": { "last_run_id": "run_1dc143ec2a4e48cdbe62", "checks": [ { "name": "workflow_completed", "passed": true }, { "name": "all_services_deployed", "passed": true }, { "name": "healthcheck", "passed": true }, { "name": "stays_up", "passed": true } ], "typical_ready_seconds": 47, "typical_build_seconds": 0, "typical_start_seconds": 30, "slowest_service": "multica-api" } }