{
  "manifest_version": "1.0.0",
  "template": {
    "id": "bed03298-7f37-4d43-b551-13cfe8444f4a",
    "slug": "passbolt-vault",
    "name": "Passbolt",
    "description": "Password manager for teams, with end-to-end encrypted sharing",
    "url": "https://railway.com/deploy/passbolt-vault",
    "upstream": {
      "image": "axllent/mailpit:latest"
    }
  },
  "services": [
    {
      "name": "mailpit",
      "source": {
        "image": "axllent/mailpit:latest"
      },
      "needs_volume": true,
      "volume_mount_path": "/data",
      "http": true
    },
    {
      "name": "MySQL",
      "source": {
        "image": "mysql:9.4"
      },
      "needs_volume": true,
      "volume_mount_path": "/var/lib/mysql",
      "http": false
    },
    {
      "name": "passbolt",
      "source": {
        "repo": "https://github.com/gridalpha/passbolt-railway"
      },
      "needs_volume": true,
      "volume_mount_path": "/data",
      "http": true
    }
  ],
  "required_inputs": [
    {
      "key": "TZ",
      "service": "mailpit",
      "description": "Timestamp timezone",
      "secret": false,
      "strategy": "default",
      "default": "UTC"
    },
    {
      "key": "PORT",
      "service": "mailpit",
      "description": "Web inbox port",
      "secret": false,
      "strategy": "default",
      "default": "8025"
    },
    {
      "key": "MP_UI_AUTH",
      "service": "mailpit",
      "description": "Basic auth guarding the inbox",
      "secret": false,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "MP_DATABASE",
      "service": "mailpit",
      "description": "Message store on the volume",
      "secret": false,
      "strategy": "default",
      "default": "/data/mailpit.db"
    },
    {
      "key": "MP_MAX_MESSAGES",
      "service": "mailpit",
      "description": "Messages retained before rotation",
      "secret": false,
      "strategy": "default",
      "default": "5000"
    },
    {
      "key": "MP_UI_BIND_ADDR",
      "service": "mailpit",
      "description": "Dual-stack bind for the inbox",
      "secret": false,
      "strategy": "default",
      "default": "[::]:8025"
    },
    {
      "key": "MP_SMTP_BIND_ADDR",
      "service": "mailpit",
      "description": "Dual-stack bind for private SMTP",
      "secret": false,
      "strategy": "default",
      "default": "[::]:1025"
    },
    {
      "key": "MP_SMTP_MAX_RECIPIENTS",
      "service": "mailpit",
      "description": "Recipient cap per message",
      "secret": false,
      "strategy": "default",
      "default": "100"
    },
    {
      "key": "MYSQLHOST",
      "service": "MySQL",
      "description": "Data panel alias, not read by the server",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "MYSQLPORT",
      "service": "MySQL",
      "description": "Data panel alias, not read by the server",
      "secret": false,
      "strategy": "default",
      "default": "3306"
    },
    {
      "key": "MYSQLUSER",
      "service": "MySQL",
      "description": "Data panel alias, not read by the server",
      "secret": false,
      "strategy": "default",
      "default": "root"
    },
    {
      "key": "MYSQL_URL",
      "service": "MySQL",
      "description": "Private connection string",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "MYSQLDATABASE",
      "service": "MySQL",
      "description": "Data panel alias, not read by the server",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "MYSQLPASSWORD",
      "service": "MySQL",
      "description": "Data panel alias, not read by the server",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "MYSQL_DATABASE",
      "service": "MySQL",
      "description": "Database created on first boot",
      "secret": false,
      "strategy": "default",
      "default": "railway"
    },
    {
      "key": "MYSQL_ROOT_PASSWORD",
      "service": "MySQL",
      "description": "Root password, read by the server",
      "secret": true,
      "strategy": "generate",
      "generate": "strong_password"
    },
    {
      "key": "PORT",
      "service": "passbolt",
      "description": "Port nginx listens on",
      "secret": false,
      "strategy": "default",
      "default": "8080"
    },
    {
      "key": "APP_FULL_BASE_URL",
      "service": "passbolt",
      "description": "Public URL used in every link",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "PASSBOLT_DATA_DIR",
      "service": "passbolt",
      "description": "Volume holding the OpenPGP and JWT keys",
      "secret": false,
      "strategy": "default",
      "default": "/data"
    },
    {
      "key": "PASSBOLT_KEY_NAME",
      "service": "passbolt",
      "description": "Label on the server OpenPGP key",
      "secret": true,
      "strategy": "default",
      "default": "Passbolt server key"
    },
    {
      "key": "EMAIL_DEFAULT_FROM",
      "service": "passbolt",
      "description": "Sender address",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "PASSBOLT_KEY_EMAIL",
      "service": "passbolt",
      "description": "Identity on the server OpenPGP key",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "PASSBOLT_ADMIN_EMAIL",
      "service": "passbolt",
      "description": "First administrator; change before deploying",
      "secret": false,
      "strategy": "default",
      "default": "admin@example.com"
    },
    {
      "key": "EMAIL_DEFAULT_FROM_NAME",
      "service": "passbolt",
      "description": "Sender display name",
      "secret": false,
      "strategy": "default",
      "default": "Passbolt"
    },
    {
      "key": "DATASOURCES_DEFAULT_HOST",
      "service": "passbolt",
      "description": "Private MySQL hostname",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "DATASOURCES_DEFAULT_PORT",
      "service": "passbolt",
      "description": "MySQL port",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "PASSBOLT_ADMIN_LAST_NAME",
      "service": "passbolt",
      "description": "First administrator's last name",
      "secret": false,
      "strategy": "default",
      "default": "Admin"
    },
    {
      "key": "PASSBOLT_ADMIN_FIRST_NAME",
      "service": "passbolt",
      "description": "First administrator's first name",
      "secret": false,
      "strategy": "default",
      "default": "Passbolt"
    },
    {
      "key": "DATASOURCES_DEFAULT_DATABASE",
      "service": "passbolt",
      "description": "Schema Passbolt installs into",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "DATASOURCES_DEFAULT_PASSWORD",
      "service": "passbolt",
      "description": "MySQL password",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "DATASOURCES_DEFAULT_USERNAME",
      "service": "passbolt",
      "description": "MySQL account",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "EMAIL_TRANSPORT_DEFAULT_HOST",
      "service": "passbolt",
      "description": "SMTP host",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "EMAIL_TRANSPORT_DEFAULT_PORT",
      "service": "passbolt",
      "description": "SMTP port",
      "secret": false,
      "strategy": "default",
      "default": "1025"
    },
    {
      "key": "RAILWAY_HEALTHCHECK_TIMEOUT_SEC",
      "service": "passbolt",
      "description": "First boot installs and migrates",
      "secret": false,
      "strategy": "default",
      "default": "600"
    },
    {
      "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS",
      "service": "passbolt",
      "description": "Clean shutdown window",
      "secret": false,
      "strategy": "default",
      "default": "30"
    }
  ],
  "deploy": {
    "mcp": {
      "server": "railway",
      "tool": "deploy_template",
      "args": {
        "template_code": "passbolt-vault"
      }
    },
    "cli": "railway deploy --template passbolt-vault",
    "api": {
      "method": "POST",
      "path": "/graphql/v2",
      "body": {
        "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }",
        "variables": {
          "input": {
            "templateId": "bed03298-7f37-4d43-b551-13cfe8444f4a",
            "serializedConfig": {
              "buckets": {},
              "services": {
                "25a6796d-3456-413b-8e59-4577eb0ee8ac": {
                  "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/mailpit.svg",
                  "name": "mailpit",
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": "/livez",
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "axllent/mailpit:latest"
                  },
                  "variables": {
                    "TZ": {
                      "isOptional": true,
                      "description": "Timestamp timezone",
                      "defaultValue": "UTC"
                    },
                    "PORT": {
                      "isOptional": false,
                      "description": "Web inbox port",
                      "defaultValue": "8025"
                    },
                    "MP_UI_AUTH": {
                      "isOptional": false,
                      "description": "Basic auth guarding the inbox",
                      "defaultValue": "{{MP_UI_AUTH}}"
                    },
                    "MP_DATABASE": {
                      "isOptional": false,
                      "description": "Message store on the volume",
                      "defaultValue": "/data/mailpit.db"
                    },
                    "MP_MAX_MESSAGES": {
                      "isOptional": true,
                      "description": "Messages retained before rotation",
                      "defaultValue": "5000"
                    },
                    "MP_UI_BIND_ADDR": {
                      "isOptional": false,
                      "description": "Dual-stack bind for the inbox",
                      "defaultValue": "[::]:8025"
                    },
                    "MP_SMTP_BIND_ADDR": {
                      "isOptional": false,
                      "description": "Dual-stack bind for private SMTP",
                      "defaultValue": "[::]:1025"
                    },
                    "MP_SMTP_MAX_RECIPIENTS": {
                      "isOptional": true,
                      "description": "Recipient cap per message",
                      "defaultValue": "100"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>:8025": {
                        "port": 8025
                      }
                    }
                  },
                  "volumeMounts": {
                    "25a6796d-3456-413b-8e59-4577eb0ee8ac": {
                      "mountPath": "/data"
                    }
                  }
                },
                "52eff0e2-e6be-4919-bc59-f6a078a1e51f": {
                  "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/mysql.svg",
                  "name": "MySQL",
                  "deploy": {
                    "startCommand": "docker-entrypoint.sh mysqld --innodb-use-native-aio=0 --disable-log-bin --performance_schema=0 --innodb-buffer-pool-size=1G",
                    "healthcheckPath": null,
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "mysql:9.4"
                  },
                  "variables": {
                    "MYSQLHOST": {
                      "isOptional": false,
                      "description": "Data panel alias, not read by the server",
                      "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}"
                    },
                    "MYSQLPORT": {
                      "isOptional": false,
                      "description": "Data panel alias, not read by the server",
                      "defaultValue": "3306"
                    },
                    "MYSQLUSER": {
                      "isOptional": false,
                      "description": "Data panel alias, not read by the server",
                      "defaultValue": "root"
                    },
                    "MYSQL_URL": {
                      "isOptional": false,
                      "description": "Private connection string",
                      "defaultValue": "mysql://${{ MYSQLUSER }}:${{ MYSQL_ROOT_PASSWORD }}@${{ RAILWAY_PRIVATE_DOMAIN }}:3306/${{ MYSQL_DATABASE }}"
                    },
                    "MYSQLDATABASE": {
                      "isOptional": false,
                      "description": "Data panel alias, not read by the server",
                      "defaultValue": "${{ MYSQL_DATABASE }}"
                    },
                    "MYSQLPASSWORD": {
                      "isOptional": false,
                      "description": "Data panel alias, not read by the server",
                      "defaultValue": "${{ MYSQL_ROOT_PASSWORD }}"
                    },
                    "MYSQL_DATABASE": {
                      "isOptional": false,
                      "description": "Database created on first boot",
                      "defaultValue": "railway"
                    },
                    "MYSQL_ROOT_PASSWORD": {
                      "isOptional": false,
                      "description": "Root password, read by the server",
                      "defaultValue": "{{MYSQL_ROOT_PASSWORD}}"
                    }
                  },
                  "volumeMounts": {
                    "52eff0e2-e6be-4919-bc59-f6a078a1e51f": {
                      "mountPath": "/var/lib/mysql"
                    }
                  }
                },
                "e0cc1782-9ef9-4663-8ff4-ee3236e33648": {
                  "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/passbolt.svg",
                  "name": "passbolt",
                  "deploy": {
                    "startCommand": null,
                    "healthcheckPath": "/healthcheck/status",
                    "restartPolicyType": "ON_FAILURE",
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "repo": "https://github.com/gridalpha/passbolt-railway",
                    "rootDirectory": null
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Port nginx listens on",
                      "defaultValue": "8080"
                    },
                    "APP_FULL_BASE_URL": {
                      "isOptional": false,
                      "description": "Public URL used in every link",
                      "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "PASSBOLT_DATA_DIR": {
                      "isOptional": false,
                      "description": "Volume holding the OpenPGP and JWT keys",
                      "defaultValue": "/data"
                    },
                    "PASSBOLT_KEY_NAME": {
                      "isOptional": true,
                      "description": "Label on the server OpenPGP key",
                      "defaultValue": "Passbolt server key"
                    },
                    "EMAIL_DEFAULT_FROM": {
                      "isOptional": false,
                      "description": "Sender address",
                      "defaultValue": "passbolt@${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "PASSBOLT_KEY_EMAIL": {
                      "isOptional": false,
                      "description": "Identity on the server OpenPGP key",
                      "defaultValue": "passbolt@${{RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "PASSBOLT_ADMIN_EMAIL": {
                      "isOptional": false,
                      "description": "First administrator; change before deploying",
                      "defaultValue": "admin@example.com"
                    },
                    "EMAIL_DEFAULT_FROM_NAME": {
                      "isOptional": true,
                      "description": "Sender display name",
                      "defaultValue": "Passbolt"
                    },
                    "DATASOURCES_DEFAULT_HOST": {
                      "isOptional": false,
                      "description": "Private MySQL hostname",
                      "defaultValue": "${{MySQL.MYSQLHOST}}"
                    },
                    "DATASOURCES_DEFAULT_PORT": {
                      "isOptional": false,
                      "description": "MySQL port",
                      "defaultValue": "${{MySQL.MYSQLPORT}}"
                    },
                    "PASSBOLT_ADMIN_LAST_NAME": {
                      "isOptional": true,
                      "description": "First administrator's last name",
                      "defaultValue": "Admin"
                    },
                    "PASSBOLT_ADMIN_FIRST_NAME": {
                      "isOptional": true,
                      "description": "First administrator's first name",
                      "defaultValue": "Passbolt"
                    },
                    "DATASOURCES_DEFAULT_DATABASE": {
                      "isOptional": false,
                      "description": "Schema Passbolt installs into",
                      "defaultValue": "${{MySQL.MYSQLDATABASE}}"
                    },
                    "DATASOURCES_DEFAULT_PASSWORD": {
                      "isOptional": false,
                      "description": "MySQL password",
                      "defaultValue": "${{MySQL.MYSQLPASSWORD}}"
                    },
                    "DATASOURCES_DEFAULT_USERNAME": {
                      "isOptional": false,
                      "description": "MySQL account",
                      "defaultValue": "${{MySQL.MYSQLUSER}}"
                    },
                    "EMAIL_TRANSPORT_DEFAULT_HOST": {
                      "isOptional": false,
                      "description": "SMTP host",
                      "defaultValue": "${{mailpit.RAILWAY_PRIVATE_DOMAIN}}"
                    },
                    "EMAIL_TRANSPORT_DEFAULT_PORT": {
                      "isOptional": false,
                      "description": "SMTP port",
                      "defaultValue": "1025"
                    },
                    "RAILWAY_HEALTHCHECK_TIMEOUT_SEC": {
                      "isOptional": false,
                      "description": "First boot installs and migrates",
                      "defaultValue": "600"
                    },
                    "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": {
                      "isOptional": false,
                      "description": "Clean shutdown window",
                      "defaultValue": "30"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>:8080": {
                        "port": 8080
                      }
                    }
                  },
                  "volumeMounts": {
                    "e0cc1782-9ef9-4663-8ff4-ee3236e33648": {
                      "mountPath": "/data"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "post_deploy": {
    "healthcheck": {
      "service": "mailpit",
      "method": "GET",
      "path": "/livez",
      "expect_status": 200
    }
  },
  "resources": {
    "expected_services": 3,
    "needs_volume": true
  },
  "generated_at": "2026-09-04T05:44:27.711Z",
  "generator_version": "0.1.0",
  "status": "validated",
  "validated_at": "2026-09-04T05:46:43.090Z",
  "success_rate_30d": 1,
  "validation": {
    "last_run_id": "run_7b829c4777a642a1a296",
    "checks": [
      {
        "name": "workflow_completed",
        "passed": true
      },
      {
        "name": "all_services_deployed",
        "passed": true
      },
      {
        "name": "healthcheck",
        "passed": true
      },
      {
        "name": "stays_up",
        "passed": true
      }
    ],
    "typical_ready_seconds": 77,
    "typical_workflow_seconds": 6,
    "typical_queue_seconds": 0,
    "typical_init_seconds": 0,
    "typical_build_seconds": 40,
    "typical_deploy_seconds": 20,
    "typical_healthcheck_lag_seconds": 0,
    "slowest_service": "passbolt"
  }
}