{ "manifest_version": "1.0.0", "template": { "id": "72f20088-d384-4f17-ac1f-41036e34cd1d", "slug": "deploy-paperclip-ai-org-chart", "name": "Paperclip Org Chart", "description": "Hire AI agents into roles with reporting lines", "url": "https://railway.com/deploy/deploy-paperclip-ai-org-chart", "upstream": { "image": "ghcr.io/paperclipai/paperclip:2026.1012.0@sha256:1661b3dd3fdf7a9b59542d1ced464c3faf9dc8309798b4d15a9923ed32795307" } }, "services": [ { "name": "paperclip", "source": { "image": "ghcr.io/paperclipai/paperclip:2026.1012.0@sha256:1661b3dd3fdf7a9b59542d1ced464c3faf9dc8309798b4d15a9923ed32795307" }, "needs_volume": true, "volume_mount_path": "/paperclip", "http": true }, { "name": "Postgres", "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:18" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "http": false } ], "required_inputs": [ { "key": "HOST", "service": "paperclip", "description": "Bind address; 0.0.0.0 so Railway can reach the server.", "secret": false, "strategy": "default", "default": "0.0.0.0" }, { "key": "PORT", "service": "paperclip", "description": "HTTP port for the API and UI (3100).", "secret": false, "strategy": "default", "default": "3100" }, { "key": "SERVE_UI", "service": "paperclip", "description": "Serve the React UI from the same server.", "secret": false, "strategy": "default", "default": "true" }, { "key": "DATABASE_URL", "service": "paperclip", "description": "Postgres connection string from the Postgres service.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PAPERCLIP_BIND", "service": "paperclip", "description": "Bind mode; lan for access through Railway's proxy.", "secret": false, "strategy": "default", "default": "lan" }, { "key": "PAPERCLIP_HOME", "service": "paperclip", "description": "Data directory on the /paperclip volume.", "secret": false, "strategy": "default", "default": "/paperclip" }, { "key": "PAPERCLIP_API_URL", "service": "paperclip", "description": "Public API base URL from the Railway domain.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "BETTER_AUTH_SECRET", "service": "paperclip", "description": "Signs auth sessions; generated per deploy, keep stable.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "PAPERCLIP_PUBLIC_URL", "service": "paperclip", "description": "Public HTTPS URL from the Railway domain.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "PAPERCLIP_DEPLOYMENT_MODE", "service": "paperclip", "description": "authenticated: login required for every user.", "secret": false, "strategy": "default", "default": "authenticated" }, { "key": "PAPERCLIP_AGENT_JWT_SECRET", "service": "paperclip", "description": "Signs agent tokens; generated per deploy, keep stable.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "PAPERCLIP_SECRETS_MASTER_KEY", "service": "paperclip", "description": "Encrypts company secrets; never change after deploy.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "PAPERCLIP_DEPLOYMENT_EXPOSURE", "service": "paperclip", "description": "public: hardened for internet exposure.", "secret": false, "strategy": "default", "default": "public" }, { "key": "PAPERCLIP_RAILWAY_BOOTSTRAP_JS", "service": "paperclip", "description": "Invite helper script run by the start command.", "secret": false, "strategy": "default", "default": "import{createHash as H,randomBytes as R}from\"node:crypto\";import{createRequire as Q}from\"node:module\";const L=m=>console.log(\"[railway-bootstrap] \"+m),P=process.env.PORT||\"3100\",U=(process.env.PAPERCLIP_PUBLIC_URL||\"http://localhost:\"+P).replace(/\\/+$/,\"\"),D=process.env.DATABASE_URL,E=Math.max(1,Math.min(720,Number(process.env.PAPERCLIP_BOOTSTRAP_INVITE_HOURS)||72));async function W(){const t=Date.now();while(Date.now()-t<9e5){try{const r=await fetch(\"http://127.0.0.1:\"+P+\"/api/health\",{signal:AbortSignal.timeout(5e3)});if(r.ok){const b=await r.json();if(b&&b.status===\"ok\"&&b.bootstrapStatus)return b}}catch{}await new Promise(r=>setTimeout(r,3e3))}return null}async function M(){if(!D)return L(\"DATABASE_URL not set; skipping first-admin invite\");const h=await W();if(!h)return L(\"server not healthy in time; skipping first-admin invite\");if(h.deploymentMode!==\"authenticated\")return;if(h.bootstrapStatus!==\"bootstrap_pending\")return L(\"instance already has an admin; no invite needed\");const sql=Q(\"/app/packages/db/package.json\")(\"postgres\")(D,{max:1,onnotice:()=>{}});try{const[{c}]=await sql`SELECT count(*)::int AS c FROM instance_user_roles WHERE role='instance_admin'`;if(c>0)return;const n=new Date();await sql`UPDATE invites SET revoked_at=${n},updated_at=${n} WHERE invite_type='bootstrap_ceo' AND revoked_at IS NULL AND accepted_at IS NULL AND expires_at>${n}`;const k=\"pcp_bootstrap_\"+R(24).toString(\"hex\"),x=new Date(Date.now()+E*36e5);await sql`INSERT INTO invites(invite_type,token_hash,allowed_join_types,expires_at,invited_by_user_id)VALUES('bootstrap_ceo',${H(\"sha256\").update(k).digest(\"hex\")},'human',${x},'system')`;L(\"No Paperclip admin yet. Sign up, then open this one-time first-admin invite URL:\");L(U+\"/invite/\"+k);L(\"Expires \"+x.toISOString()+\" (a fresh link is printed on every restart until claimed)\")}finally{await sql.end({timeout:5}).catch(()=>{})}}M().catch(e=>L(\"could not create first-admin invite: \"+(e&&e.message||e)));" }, { "key": "PAPERCLIP_RAILWAY_BOOTSTRAP_INVITE", "service": "paperclip", "description": "Print a first-admin invite URL in deploy logs.", "secret": false, "strategy": "default", "default": "true" }, { "key": "PGDATA", "service": "Postgres", "description": "Postgres data directory on the volume.", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "PGHOST", "service": "Postgres", "description": "Private hostname of the Postgres service.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PGPORT", "service": "Postgres", "description": "Postgres port (5432).", "secret": false, "strategy": "default", "default": "5432" }, { "key": "PGUSER", "service": "Postgres", "description": "Postgres username.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGDATABASE", "service": "Postgres", "description": "Database name.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGPASSWORD", "service": "Postgres", "description": "Postgres password, generated per deploy.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_DB", "service": "Postgres", "description": "Database created on first boot.", "secret": false, "strategy": "default", "default": "railway" }, { "key": "DATABASE_URL", "service": "Postgres", "description": "Private connection string used by Paperclip.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_USER", "service": "Postgres", "description": "Superuser name.", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "SSL_CERT_DAYS", "service": "Postgres", "description": "Validity in days of the self-signed SSL certificate.", "secret": false, "strategy": "default", "default": "820" }, { "key": "POSTGRES_PASSWORD", "service": "Postgres", "description": "Superuser password, generated per deploy.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS", "service": "Postgres", "description": "Seconds Railway waits for the old deployment to drain and shut down gracefully before stopping it.", "secret": false, "strategy": "default", "default": "60" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "deploy-paperclip-ai-org-chart" } }, "cli": "railway deploy --template deploy-paperclip-ai-org-chart", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "72f20088-d384-4f17-ac1f-41036e34cd1d", "serializedConfig": { "services": { "aa4922af-d3d4-4758-99e7-2cc38c1e0f8f": { "icon": null, "name": "paperclip", "deploy": { "startCommand": "/bin/sh -c \"printenv PAPERCLIP_RAILWAY_BOOTSTRAP_JS > /tmp/railway-bootstrap.mjs || true; chmod 644 /tmp/railway-bootstrap.mjs; exec /usr/bin/tini -s -- docker-entrypoint.sh /bin/sh -c 'cd /app; if [ -s /tmp/railway-bootstrap.mjs ] && [ ${PAPERCLIP_RAILWAY_BOOTSTRAP_INVITE:-true} = true ]; then (node /tmp/railway-bootstrap.mjs &); fi; exec node --import ./server/node_modules/tsx/dist/loader.mjs server/dist/index.js'\"", "healthcheckPath": "/api/health", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/paperclipai/paperclip:2026.1012.0@sha256:1661b3dd3fdf7a9b59542d1ced464c3faf9dc8309798b4d15a9923ed32795307" }, "variables": { "HOST": { "isOptional": false, "description": "Bind address; 0.0.0.0 so Railway can reach the server.", "defaultValue": "0.0.0.0" }, "PORT": { "isOptional": false, "description": "HTTP port for the API and UI (3100).", "defaultValue": "3100" }, "SERVE_UI": { "isOptional": false, "description": "Serve the React UI from the same server.", "defaultValue": "true" }, "DATABASE_URL": { "isOptional": false, "description": "Postgres connection string from the Postgres service.", "defaultValue": "${{Postgres.DATABASE_URL}}" }, "GEMINI_API_KEY": { "isOptional": true, "description": "Optional Google key for Gemini CLI agents.", "defaultValue": "" }, "OPENAI_API_KEY": { "isOptional": true, "description": "Optional OpenAI key for Codex and OpenAI agents.", "defaultValue": "" }, "PAPERCLIP_BIND": { "isOptional": false, "description": "Bind mode; lan for access through Railway's proxy.", "defaultValue": "lan" }, "PAPERCLIP_HOME": { "isOptional": false, "description": "Data directory on the /paperclip volume.", "defaultValue": "/paperclip" }, "ANTHROPIC_API_KEY": { "isOptional": true, "description": "Optional Anthropic key for Claude Code agents.", "defaultValue": "" }, "PAPERCLIP_API_URL": { "isOptional": false, "description": "Public API base URL from the Railway domain.", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "BETTER_AUTH_SECRET": { "isOptional": false, "description": "Signs auth sessions; generated per deploy, keep stable.", "defaultValue": "{{BETTER_AUTH_SECRET}}" }, "PAPERCLIP_PUBLIC_URL": { "isOptional": false, "description": "Public HTTPS URL from the Railway domain.", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "PAPERCLIP_DEPLOYMENT_MODE": { "isOptional": false, "description": "authenticated: login required for every user.", "defaultValue": "authenticated" }, "PAPERCLIP_AGENT_JWT_SECRET": { "isOptional": false, "description": "Signs agent tokens; generated per deploy, keep stable.", "defaultValue": "{{PAPERCLIP_AGENT_JWT_SECRET}}" }, "PAPERCLIP_SECRETS_MASTER_KEY": { "isOptional": false, "description": "Encrypts company secrets; never change after deploy.", "defaultValue": "{{PAPERCLIP_SECRETS_MASTER_KEY}}" }, "PAPERCLIP_DEPLOYMENT_EXPOSURE": { "isOptional": false, "description": "public: hardened for internet exposure.", "defaultValue": "public" }, "PAPERCLIP_RAILWAY_BOOTSTRAP_JS": { "isOptional": false, "description": "Invite helper script run by the start command.", "defaultValue": "import{createHash as H,randomBytes as R}from\"node:crypto\";import{createRequire as Q}from\"node:module\";const L=m=>console.log(\"[railway-bootstrap] \"+m),P=process.env.PORT||\"3100\",U=(process.env.PAPERCLIP_PUBLIC_URL||\"http://localhost:\"+P).replace(/\\/+$/,\"\"),D=process.env.DATABASE_URL,E=Math.max(1,Math.min(720,Number(process.env.PAPERCLIP_BOOTSTRAP_INVITE_HOURS)||72));async function W(){const t=Date.now();while(Date.now()-t<9e5){try{const r=await fetch(\"http://127.0.0.1:\"+P+\"/api/health\",{signal:AbortSignal.timeout(5e3)});if(r.ok){const b=await r.json();if(b&&b.status===\"ok\"&&b.bootstrapStatus)return b}}catch{}await new Promise(r=>setTimeout(r,3e3))}return null}async function M(){if(!D)return L(\"DATABASE_URL not set; skipping first-admin invite\");const h=await W();if(!h)return L(\"server not healthy in time; skipping first-admin invite\");if(h.deploymentMode!==\"authenticated\")return;if(h.bootstrapStatus!==\"bootstrap_pending\")return L(\"instance already has an admin; no invite needed\");const sql=Q(\"/app/packages/db/package.json\")(\"postgres\")(D,{max:1,onnotice:()=>{}});try{const[{c}]=await sql`SELECT count(*)::int AS c FROM instance_user_roles WHERE role='instance_admin'`;if(c>0)return;const n=new Date();await sql`UPDATE invites SET revoked_at=${n},updated_at=${n} WHERE invite_type='bootstrap_ceo' AND revoked_at IS NULL AND accepted_at IS NULL AND expires_at>${n}`;const k=\"pcp_bootstrap_\"+R(24).toString(\"hex\"),x=new Date(Date.now()+E*36e5);await sql`INSERT INTO invites(invite_type,token_hash,allowed_join_types,expires_at,invited_by_user_id)VALUES('bootstrap_ceo',${H(\"sha256\").update(k).digest(\"hex\")},'human',${x},'system')`;L(\"No Paperclip admin yet. Sign up, then open this one-time first-admin invite URL:\");L(U+\"/invite/\"+k);L(\"Expires \"+x.toISOString()+\" (a fresh link is printed on every restart until claimed)\")}finally{await sql.end({timeout:5}).catch(()=>{})}}M().catch(e=>L(\"could not create first-admin invite: \"+(e&&e.message||e)));" }, "PAPERCLIP_RAILWAY_BOOTSTRAP_INVITE": { "isOptional": false, "description": "Print a first-admin invite URL in deploy logs.", "defaultValue": "true" } }, "networking": { "serviceDomains": { ":3100": { "port": 3100 } } }, "volumeMounts": { "aa4922af-d3d4-4758-99e7-2cc38c1e0f8f": { "mountPath": "/paperclip" } } }, "e09383c1-dc55-4f38-be1d-842e2a21f197": { "icon": "https://devicons.railway.app/i/postgresql.svg", "name": "Postgres", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:18" }, "variables": { "PGDATA": { "isOptional": false, "description": "Postgres data directory on the volume.", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "PGHOST": { "isOptional": false, "description": "Private hostname of the Postgres service.", "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}" }, "PGPORT": { "isOptional": false, "description": "Postgres port (5432).", "defaultValue": "5432" }, "PGUSER": { "isOptional": false, "description": "Postgres username.", "defaultValue": "${{POSTGRES_USER}}" }, "PGDATABASE": { "isOptional": false, "description": "Database name.", "defaultValue": "${{POSTGRES_DB}}" }, "PGPASSWORD": { "isOptional": false, "description": "Postgres password, generated per deploy.", "defaultValue": "${{POSTGRES_PASSWORD}}" }, "POSTGRES_DB": { "isOptional": false, "description": "Database created on first boot.", "defaultValue": "railway" }, "DATABASE_URL": { "isOptional": false, "description": "Private connection string used by Paperclip.", "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{PGDATABASE}}" }, "POSTGRES_USER": { "isOptional": false, "description": "Superuser name.", "defaultValue": "postgres" }, "SSL_CERT_DAYS": { "isOptional": false, "description": "Validity in days of the self-signed SSL certificate.", "defaultValue": "820" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Superuser password, generated per deploy.", "defaultValue": "{{POSTGRES_PASSWORD}}" }, "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": { "isOptional": false, "description": "Seconds Railway waits for the old deployment to drain and shut down gracefully before stopping it.", "defaultValue": "60" } }, "volumeMounts": { "e09383c1-dc55-4f38-be1d-842e2a21f197": { "mountPath": "/var/lib/postgresql/data" } } } } } } } } } }, "post_deploy": { "healthcheck": { "service": "paperclip", "method": "GET", "path": "/api/health", "expect_status": 200 } }, "resources": { "expected_services": 2, "needs_volume": true }, "generated_at": "2026-10-17T04:14:47.046Z", "generator_version": "0.1.0", "status": "validated", "validated_at": "2026-10-17T02:37:43.584Z", "success_rate_30d": 1, "validation": { "last_run_id": "run_1a5a2d7fe0dd4ce7b268", "checks": [ { "name": "workflow_completed", "passed": true }, { "name": "all_services_deployed", "passed": true }, { "name": "healthcheck", "passed": true }, { "name": "stays_up", "passed": true } ], "typical_ready_seconds": 149, "typical_build_seconds": 0, "typical_start_seconds": 71, "slowest_service": "paperclip" } }