{
  "manifest_version": "1.0.0",
  "template": {
    "id": "b265d31b-51b6-441c-b7bd-0ec378e9a657",
    "slug": "paperclip-3",
    "name": "Paperclip",
    "description": "Host Paperclip with authenticated access and persistent agent state.",
    "url": "https://railway.com/deploy/paperclip-3",
    "upstream": {
      "image": "ghcr.io/paperclipai/paperclip@sha256:17e54b1fd1ffcc3a575cf6c23cd6c364f89cf67614481a4176749d1c6a293507"
    }
  },
  "services": [
    {
      "name": "Paperclip",
      "source": {
        "image": "ghcr.io/paperclipai/paperclip@sha256:17e54b1fd1ffcc3a575cf6c23cd6c364f89cf67614481a4176749d1c6a293507"
      },
      "needs_volume": true,
      "volume_mount_path": "/paperclip",
      "http": true
    }
  ],
  "required_inputs": [
    {
      "key": "HOST",
      "service": "Paperclip",
      "description": "Listen on the container network interface.",
      "secret": false,
      "strategy": "default",
      "default": "0.0.0.0"
    },
    {
      "key": "PORT",
      "service": "Paperclip",
      "description": "Internal HTTP port used by Paperclip and Railway public networking.",
      "secret": false,
      "strategy": "default",
      "default": "3100"
    },
    {
      "key": "USER_GID",
      "service": "Paperclip",
      "description": "Force a safe group remap so the upstream entrypoint takes ownership of Railway's root-owned volume before starting as non-root.",
      "secret": false,
      "strategy": "default",
      "default": "1001"
    },
    {
      "key": "USER_UID",
      "service": "Paperclip",
      "description": "Preserve the upstream image owner's UID so embedded PostgreSQL can prepare its native runtime under /app.",
      "secret": false,
      "strategy": "default",
      "default": "1000"
    },
    {
      "key": "PAPERCLIP_HOME",
      "service": "Paperclip",
      "description": "Persistent Paperclip home directory; must match the volume mount.",
      "secret": false,
      "strategy": "default",
      "default": "/paperclip"
    },
    {
      "key": "BETTER_AUTH_SECRET",
      "service": "Paperclip",
      "description": "Template-generated 256-bit hexadecimal session-signing secret; the pinned release also uses it for local-agent JWTs.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "PAPERCLIP_PUBLIC_URL",
      "service": "Paperclip",
      "description": "Canonical public HTTPS URL used by authentication and callbacks.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "PAPERCLIP_DEPLOYMENT_MODE",
      "service": "Paperclip",
      "description": "Require users to authenticate; local_trusted is unsafe for a public Railway domain.",
      "secret": false,
      "strategy": "default",
      "default": "authenticated"
    },
    {
      "key": "PAPERCLIP_TELEMETRY_DISABLED",
      "service": "Paperclip",
      "description": "Disable anonymous usage telemetry by default; remove only when the deployer deliberately opts in.",
      "secret": false,
      "strategy": "default",
      "default": "1"
    },
    {
      "key": "PAPERCLIP_DEPLOYMENT_EXPOSURE",
      "service": "Paperclip",
      "description": "Apply Paperclip's stricter policy for an internet-facing deployment.",
      "secret": false,
      "strategy": "default",
      "default": "public"
    },
    {
      "key": "PAPERCLIP_AUTH_DISABLE_SIGN_UP",
      "service": "Paperclip",
      "description": "Keep sign-up enabled for initial ownership setup; change to true immediately after onboarding.",
      "secret": false,
      "strategy": "default",
      "default": "false"
    }
  ],
  "deploy": {
    "mcp": {
      "server": "railway",
      "tool": "deploy_template",
      "args": {
        "template_code": "paperclip-3"
      }
    },
    "cli": "railway deploy --template paperclip-3",
    "api": {
      "method": "POST",
      "path": "/graphql/v2",
      "body": {
        "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }",
        "variables": {
          "input": {
            "templateId": "b265d31b-51b6-441c-b7bd-0ec378e9a657",
            "serializedConfig": {
              "services": {
                "3aee9e08-fecb-4d61-a97d-43c54a59af42": {
                  "name": "Paperclip",
                  "deploy": {
                    "healthcheckPath": "/api/health"
                  },
                  "source": {
                    "image": "ghcr.io/paperclipai/paperclip@sha256:17e54b1fd1ffcc3a575cf6c23cd6c364f89cf67614481a4176749d1c6a293507"
                  },
                  "variables": {
                    "HOST": {
                      "description": "Listen on the container network interface.",
                      "defaultValue": "0.0.0.0"
                    },
                    "PORT": {
                      "description": "Internal HTTP port used by Paperclip and Railway public networking.",
                      "defaultValue": "3100"
                    },
                    "USER_GID": {
                      "description": "Force a safe group remap so the upstream entrypoint takes ownership of Railway's root-owned volume before starting as non-root.",
                      "defaultValue": "1001"
                    },
                    "USER_UID": {
                      "description": "Preserve the upstream image owner's UID so embedded PostgreSQL can prepare its native runtime under /app.",
                      "defaultValue": "1000"
                    },
                    "XAI_API_KEY": {
                      "isOptional": true,
                      "description": "Optional xAI credential for a configured provider-specific CLI path.",
                      "defaultValue": ""
                    },
                    "GEMINI_API_KEY": {
                      "isOptional": true,
                      "description": "Optional restricted Gemini API credential for the experimental Gemini local adapter.",
                      "defaultValue": ""
                    },
                    "GOOGLE_API_KEY": {
                      "isOptional": true,
                      "description": "Optional Google credential accepted by the Gemini CLI as an alternative to GEMINI_API_KEY; do not require both.",
                      "defaultValue": ""
                    },
                    "OPENAI_API_KEY": {
                      "isOptional": true,
                      "description": "Optional credential for the bundled Codex local adapter.",
                      "defaultValue": ""
                    },
                    "PAPERCLIP_HOME": {
                      "description": "Persistent Paperclip home directory; must match the volume mount.",
                      "defaultValue": "/paperclip"
                    },
                    "ANTHROPIC_API_KEY": {
                      "isOptional": true,
                      "description": "Optional credential for the bundled Claude Code local adapter.",
                      "defaultValue": ""
                    },
                    "BETTER_AUTH_SECRET": {
                      "description": "Template-generated 256-bit hexadecimal session-signing secret; the pinned release also uses it for local-agent JWTs.",
                      "defaultValue": "{{BETTER_AUTH_SECRET}}"
                    },
                    "OPENROUTER_API_KEY": {
                      "isOptional": true,
                      "description": "Optional OpenRouter credential for a configured provider-specific CLI or plugin path.",
                      "defaultValue": ""
                    },
                    "PAPERCLIP_PUBLIC_URL": {
                      "description": "Canonical public HTTPS URL used by authentication and callbacks.",
                      "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "PAPERCLIP_DEPLOYMENT_MODE": {
                      "description": "Require users to authenticate; local_trusted is unsafe for a public Railway domain.",
                      "defaultValue": "authenticated"
                    },
                    "PAPERCLIP_TELEMETRY_DISABLED": {
                      "isOptional": true,
                      "description": "Disable anonymous usage telemetry by default; remove only when the deployer deliberately opts in.",
                      "defaultValue": "1"
                    },
                    "PAPERCLIP_DEPLOYMENT_EXPOSURE": {
                      "description": "Apply Paperclip's stricter policy for an internet-facing deployment.",
                      "defaultValue": "public"
                    },
                    "PAPERCLIP_AUTH_DISABLE_SIGN_UP": {
                      "description": "Keep sign-up enabled for initial ownership setup; change to true immediately after onboarding.",
                      "defaultValue": "false"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>:3100": {
                        "port": 3100
                      }
                    }
                  },
                  "volumeMounts": {
                    "3aee9e08-fecb-4d61-a97d-43c54a59af42": {
                      "mountPath": "/paperclip"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "post_deploy": {
    "healthcheck": {
      "service": "Paperclip",
      "method": "GET",
      "path": "/api/health",
      "expect_status": 200
    }
  },
  "resources": {
    "expected_services": 1,
    "needs_volume": true
  },
  "generated_at": "2026-09-10T16:14:52.212Z",
  "generator_version": "0.1.0",
  "status": "degraded",
  "validated_at": "2026-09-08T22:36:20.599Z",
  "success_rate_30d": 0,
  "validation": {
    "last_run_id": "run_24f32f875445453c9319",
    "checks": [
      {
        "name": "workflow_completed",
        "passed": true
      },
      {
        "name": "all_services_deployed",
        "passed": false,
        "detail": "FAILED"
      }
    ]
  }
}