{ "manifest_version": "1.0.0", "template": { "id": "fa761cfb-2b02-4e4d-96db-d30922c0db2e", "slug": "penpot-production", "name": "Penpot | Open-Source Figma Alternative with Postgres & S3", "description": "Collaborative design and prototyping tool, the open-source Figma alt", "url": "https://railway.com/deploy/penpot-production", "upstream": { "image": "penpotapp/frontend:2.18.3" } }, "services": [ { "name": "Penpot", "source": { "image": "penpotapp/frontend:2.18.3" }, "needs_volume": false, "http": true }, { "name": "Backend", "source": { "image": "penpotapp/backend:2.18.3" }, "needs_volume": false, "http": false }, { "name": "Exporter", "source": { "image": "penpotapp/exporter:2.18.3" }, "needs_volume": false, "http": false }, { "name": "Valkey", "source": { "image": "valkey/valkey:8.1.10-alpine" }, "needs_volume": false, "http": false }, { "name": "Postgres", "source": { "image": "postgres:17.11-alpine" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "http": false } ], "required_inputs": [ { "key": "PORT", "service": "Penpot", "description": "Port the Penpot web server listens on - leave as is", "secret": false, "strategy": "default", "default": "8080" }, { "key": "PENPOT_FLAGS", "service": "Penpot", "description": "Feature flags - edit them on the Backend service", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "BACKEND_ADDRESS", "service": "Penpot", "description": "Backend API on the private network, re-resolved while running so backend redeploys never leave a stale address", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "EXPORTER_ADDRESS", "service": "Penpot", "description": "Exporter on the private network", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PENPOT_PUBLIC_URI", "service": "Penpot", "description": "Public URL - edit it on the Backend service", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PENPOT_BACKEND_URI", "service": "Penpot", "description": "nginx upstream defined by the start command from BACKEND_ADDRESS - leave as is", "secret": false, "strategy": "default", "default": "http://penpot-backend" }, { "key": "PENPOT_EXPORTER_URI", "service": "Penpot", "description": "nginx upstream defined by the start command from EXPORTER_ADDRESS - leave as is", "secret": false, "strategy": "default", "default": "http://penpot-exporter" }, { "key": "PORT", "service": "Backend", "description": "Port the backend API listens on - leave as is", "secret": false, "strategy": "default", "default": "6060" }, { "key": "JAVA_OPTS", "service": "Backend", "description": "JVM heap limits. Without a cap the JVM sizes its heap from the host's memory; raise -Xmx for very large design files", "secret": false, "strategy": "default", "default": "-Xms128m -Xmx1g" }, { "key": "PENPOT_FLAGS", "service": "Backend", "description": "Feature flags shared by all Penpot services. Add disable-registration once your team has signed up; add enable-smtp after setting the PENPOT_SMTP_* variables", "secret": false, "strategy": "default", "default": "disable-email-verification" }, { "key": "PENPOT_REDIS_URI", "service": "Backend", "description": "Valkey on the private network (real-time notifications)", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "AWS_ACCESS_KEY_ID", "service": "Backend", "description": "Bucket access key", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PENPOT_PUBLIC_URI", "service": "Backend", "description": "Public URL of Penpot (links, invitations, exports) - set it to your custom domain after adding one; the other services follow", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "PENPOT_SECRET_KEY", "service": "Backend", "description": "Master key that sessions, invitations and the exporter's key are derived from. Changing it logs everyone out", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "AWS_ENDPOINT_URL_S3", "service": "Backend", "description": "Bucket endpoint, read by the AWS SDK. Deliberately not PENPOT_OBJECTS_STORAGE_S3_ENDPOINT: that one forces path-style URLs, and Railway buckets are virtual-hosted", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PENPOT_DATABASE_URI", "service": "Backend", "description": "Postgres on the private network", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "AWS_SECRET_ACCESS_KEY", "service": "Backend", "description": "Bucket secret key", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PENPOT_HTTP_SERVER_HOST", "service": "Backend", "description": "Listen on IPv6 and IPv4 so Railway's private network can reach it", "secret": false, "strategy": "default", "default": "::" }, { "key": "PENPOT_HTTP_SERVER_PORT", "service": "Backend", "description": "Backend API port - must match PORT", "secret": false, "strategy": "default", "default": "6060" }, { "key": "PENPOT_DATABASE_PASSWORD", "service": "Backend", "description": "Database password", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PENPOT_DATABASE_USERNAME", "service": "Backend", "description": "Database user", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PENPOT_OBJECTS_STORAGE_BACKEND", "service": "Backend", "description": "Uploads, images, fonts and thumbnails go to the Railway bucket", "secret": false, "strategy": "default", "default": "s3" }, { "key": "RAILWAY_HEALTHCHECK_TIMEOUT_SEC", "service": "Backend", "description": "First boot runs the database migrations before the health check can pass", "secret": false, "strategy": "default", "default": "600" }, { "key": "PENPOT_OBJECTS_STORAGE_S3_BUCKET", "service": "Backend", "description": "Bucket name", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PENPOT_OBJECTS_STORAGE_S3_REGION", "service": "Backend", "description": "Bucket region", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PORT", "service": "Exporter", "description": "Port the exporter listens on - leave as is", "secret": false, "strategy": "default", "default": "6061" }, { "key": "PENPOT_FLAGS", "service": "Exporter", "description": "Feature flags - edit them on the Backend service", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PENPOT_REDIS_URI", "service": "Exporter", "description": "Valkey on the private network (family=0 lets it connect over IPv6)", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PENPOT_PUBLIC_URI", "service": "Exporter", "description": "Public URL - edit it on the Backend service", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PENPOT_SECRET_KEY", "service": "Exporter", "description": "Same master key as the backend, so the backend accepts the exporter's uploads", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PENPOT_INTERNAL_URI", "service": "Exporter", "description": "The headless browser renders exports from the Penpot web server over the private network", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PENPOT_HTTP_SERVER_PORT", "service": "Exporter", "description": "Exporter port - must match PORT", "secret": false, "strategy": "default", "default": "6061" }, { "key": "VALKEY_PASSWORD", "service": "Valkey", "description": "Auto-generated Valkey password", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "PGDATA", "service": "Postgres", "description": "Data subdirectory - keeps Postgres happy on Railway volumes", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "POSTGRES_DB", "service": "Postgres", "description": "Database name", "secret": false, "strategy": "default", "default": "penpot" }, { "key": "POSTGRES_USER", "service": "Postgres", "description": "Database user", "secret": false, "strategy": "default", "default": "penpot" }, { "key": "POSTGRES_PASSWORD", "service": "Postgres", "description": "Auto-generated database password", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "POSTGRES_INITDB_ARGS", "service": "Postgres", "description": "Same initdb options as upstream's compose file", "secret": false, "strategy": "default", "default": "--data-checksums" }, { "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS", "service": "Postgres", "description": "Time for Postgres to shut down cleanly on redeploy", "secret": false, "strategy": "default", "default": "60" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "penpot-production" } }, "cli": "railway deploy --template penpot-production", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "fa761cfb-2b02-4e4d-96db-d30922c0db2e", "serializedConfig": { "buckets": { "2456e7b0-0027-429a-a949-724ac3ccbd78": { "name": "Assets" } }, "services": { "1b2e43eb-e23d-40a4-a762-ee3234670750": { "icon": "https://raw.githubusercontent.com/nomideusz/penpot-railway/main/icon.svg", "name": "Penpot", "build": {}, "deploy": { "startCommand": "/bin/bash -c \"printf 'upstream penpot-backend { zone penpot-backend 64k; server %s resolve; } upstream penpot-exporter { zone penpot-exporter 64k; server %s resolve; }' $BACKEND_ADDRESS $EXPORTER_ADDRESS > /etc/nginx/overrides/http.d/railway-upstreams.conf && bash /entrypoint.sh true && sed -i 's/^worker_processes auto;/worker_processes 2;/' /etc/nginx/nginx.conf && exec nginx -g 'daemon off;'\"", "healthcheckPath": "/", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "penpotapp/frontend:2.18.3" }, "variables": { "PORT": { "isOptional": false, "description": "Port the Penpot web server listens on - leave as is", "defaultValue": "8080" }, "PENPOT_FLAGS": { "isOptional": false, "description": "Feature flags - edit them on the Backend service", "defaultValue": "${{Backend.PENPOT_FLAGS}}" }, "BACKEND_ADDRESS": { "isOptional": false, "description": "Backend API on the private network, re-resolved while running so backend redeploys never leave a stale address", "defaultValue": "${{Backend.RAILWAY_PRIVATE_DOMAIN}}:6060" }, "EXPORTER_ADDRESS": { "isOptional": false, "description": "Exporter on the private network", "defaultValue": "${{Exporter.RAILWAY_PRIVATE_DOMAIN}}:6061" }, "PENPOT_PUBLIC_URI": { "isOptional": false, "description": "Public URL - edit it on the Backend service", "defaultValue": "${{Backend.PENPOT_PUBLIC_URI}}" }, "PENPOT_BACKEND_URI": { "isOptional": false, "description": "nginx upstream defined by the start command from BACKEND_ADDRESS - leave as is", "defaultValue": "http://penpot-backend" }, "PENPOT_EXPORTER_URI": { "isOptional": false, "description": "nginx upstream defined by the start command from EXPORTER_ADDRESS - leave as is", "defaultValue": "http://penpot-exporter" } }, "networking": { "serviceDomains": { "": {} } }, "volumeMounts": {} }, "4e2ef587-87e8-4396-8e94-2d6af88d5c7e": { "icon": "https://raw.githubusercontent.com/nomideusz/penpot-railway/main/icon.svg", "name": "Backend", "build": {}, "deploy": { "startCommand": null, "healthcheckPath": "/readyz", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "penpotapp/backend:2.18.3" }, "variables": { "PORT": { "isOptional": false, "description": "Port the backend API listens on - leave as is", "defaultValue": "6060" }, "JAVA_OPTS": { "isOptional": false, "description": "JVM heap limits. Without a cap the JVM sizes its heap from the host's memory; raise -Xmx for very large design files", "defaultValue": "-Xms128m -Xmx1g" }, "PENPOT_FLAGS": { "isOptional": false, "description": "Feature flags shared by all Penpot services. Add disable-registration once your team has signed up; add enable-smtp after setting the PENPOT_SMTP_* variables", "defaultValue": "disable-email-verification" }, "PENPOT_REDIS_URI": { "isOptional": false, "description": "Valkey on the private network (real-time notifications)", "defaultValue": "redis://default:${{Valkey.VALKEY_PASSWORD}}@${{Valkey.RAILWAY_PRIVATE_DOMAIN}}:6379/0" }, "AWS_ACCESS_KEY_ID": { "isOptional": false, "description": "Bucket access key", "defaultValue": "${{Assets.ACCESS_KEY_ID}}" }, "PENPOT_PUBLIC_URI": { "isOptional": false, "description": "Public URL of Penpot (links, invitations, exports) - set it to your custom domain after adding one; the other services follow", "defaultValue": "https://${{Penpot.RAILWAY_PUBLIC_DOMAIN}}" }, "PENPOT_SECRET_KEY": { "isOptional": false, "description": "Master key that sessions, invitations and the exporter's key are derived from. Changing it logs everyone out", "defaultValue": "{{PENPOT_SECRET_KEY}}" }, "AWS_ENDPOINT_URL_S3": { "isOptional": false, "description": "Bucket endpoint, read by the AWS SDK. Deliberately not PENPOT_OBJECTS_STORAGE_S3_ENDPOINT: that one forces path-style URLs, and Railway buckets are virtual-hosted", "defaultValue": "${{Assets.ENDPOINT}}" }, "PENPOT_DATABASE_URI": { "isOptional": false, "description": "Postgres on the private network", "defaultValue": "postgresql://${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/${{Postgres.POSTGRES_DB}}" }, "AWS_SECRET_ACCESS_KEY": { "isOptional": false, "description": "Bucket secret key", "defaultValue": "${{Assets.SECRET_ACCESS_KEY}}" }, "PENPOT_HTTP_SERVER_HOST": { "isOptional": false, "description": "Listen on IPv6 and IPv4 so Railway's private network can reach it", "defaultValue": "::" }, "PENPOT_HTTP_SERVER_PORT": { "isOptional": false, "description": "Backend API port - must match PORT", "defaultValue": "6060" }, "PENPOT_DATABASE_PASSWORD": { "isOptional": false, "description": "Database password", "defaultValue": "${{Postgres.POSTGRES_PASSWORD}}" }, "PENPOT_DATABASE_USERNAME": { "isOptional": false, "description": "Database user", "defaultValue": "${{Postgres.POSTGRES_USER}}" }, "PENPOT_OBJECTS_STORAGE_BACKEND": { "isOptional": false, "description": "Uploads, images, fonts and thumbnails go to the Railway bucket", "defaultValue": "s3" }, "RAILWAY_HEALTHCHECK_TIMEOUT_SEC": { "isOptional": false, "description": "First boot runs the database migrations before the health check can pass", "defaultValue": "600" }, "PENPOT_OBJECTS_STORAGE_S3_BUCKET": { "isOptional": false, "description": "Bucket name", "defaultValue": "${{Assets.BUCKET}}" }, "PENPOT_OBJECTS_STORAGE_S3_REGION": { "isOptional": false, "description": "Bucket region", "defaultValue": "${{Assets.REGION}}" } }, "networking": { "serviceDomains": {} }, "volumeMounts": {} }, "5b794b80-1445-467b-b4bc-48227c4595f3": { "icon": "https://raw.githubusercontent.com/nomideusz/penpot-railway/main/icon.svg", "name": "Exporter", "build": {}, "deploy": { "startCommand": null, "healthcheckPath": "/readyz", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "penpotapp/exporter:2.18.3" }, "variables": { "PORT": { "isOptional": false, "description": "Port the exporter listens on - leave as is", "defaultValue": "6061" }, "PENPOT_FLAGS": { "isOptional": false, "description": "Feature flags - edit them on the Backend service", "defaultValue": "${{Backend.PENPOT_FLAGS}}" }, "PENPOT_REDIS_URI": { "isOptional": false, "description": "Valkey on the private network (family=0 lets it connect over IPv6)", "defaultValue": "redis://default:${{Valkey.VALKEY_PASSWORD}}@${{Valkey.RAILWAY_PRIVATE_DOMAIN}}:6379/0?family=0" }, "PENPOT_PUBLIC_URI": { "isOptional": false, "description": "Public URL - edit it on the Backend service", "defaultValue": "${{Backend.PENPOT_PUBLIC_URI}}" }, "PENPOT_SECRET_KEY": { "isOptional": false, "description": "Same master key as the backend, so the backend accepts the exporter's uploads", "defaultValue": "${{Backend.PENPOT_SECRET_KEY}}" }, "PENPOT_INTERNAL_URI": { "isOptional": false, "description": "The headless browser renders exports from the Penpot web server over the private network", "defaultValue": "http://${{Penpot.RAILWAY_PRIVATE_DOMAIN}}:8080" }, "PENPOT_HTTP_SERVER_PORT": { "isOptional": false, "description": "Exporter port - must match PORT", "defaultValue": "6061" } }, "networking": { "serviceDomains": {} }, "volumeMounts": {} }, "842809b4-4625-4bd9-ad31-24296d2c2e09": { "icon": "https://devicons.railway.app/i/redis.svg", "name": "Valkey", "build": {}, "deploy": { "startCommand": "/bin/sh -c \"exec docker-entrypoint.sh valkey-server --requirepass $VALKEY_PASSWORD --save '' --appendonly no --maxmemory 128mb --maxmemory-policy volatile-lfu\"", "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "valkey/valkey:8.1.10-alpine" }, "variables": { "VALKEY_PASSWORD": { "isOptional": false, "description": "Auto-generated Valkey password", "defaultValue": "{{VALKEY_PASSWORD}}" } }, "networking": { "serviceDomains": {} }, "volumeMounts": {} }, "eac928f3-5efe-4553-9c12-17196f65d187": { "icon": "https://devicons.railway.app/i/postgresql.svg", "name": "Postgres", "build": {}, "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "postgres:17.11-alpine" }, "variables": { "PGDATA": { "isOptional": false, "description": "Data subdirectory - keeps Postgres happy on Railway volumes", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "POSTGRES_DB": { "isOptional": false, "description": "Database name", "defaultValue": "penpot" }, "POSTGRES_USER": { "isOptional": false, "description": "Database user", "defaultValue": "penpot" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Auto-generated database password", "defaultValue": "{{POSTGRES_PASSWORD}}" }, "POSTGRES_INITDB_ARGS": { "isOptional": false, "description": "Same initdb options as upstream's compose file", "defaultValue": "--data-checksums" }, "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": { "isOptional": false, "description": "Time for Postgres to shut down cleanly on redeploy", "defaultValue": "60" } }, "networking": { "serviceDomains": {} }, "volumeMounts": { "8490a663-b955-4399-bfe2-8ce0b8cdd9d2": { "mountPath": "/var/lib/postgresql/data" } } } } } } } } } }, "post_deploy": { "healthcheck": { "service": "Penpot", "method": "GET", "path": "/", "expect_status": 200 } }, "resources": { "expected_services": 5, "needs_volume": true }, "generated_at": "2026-10-14T10:14:43.564Z", "generator_version": "0.1.0", "status": "degraded", "validated_at": "2026-10-12T05:13:42.478Z", "success_rate_30d": 0, "validation": { "last_run_id": "run_bdeb52117a86487598ea", "checks": [ { "name": "workflow_completed", "passed": false, "detail": "Your workspace has been restricted. Please contact support to resolve this." } ] } }