{
  "manifest_version": "1.0.0",
  "template": {
    "id": "ea7d8dec-ce0a-4231-9559-fe8845a8809b",
    "slug": "rustyauth",
    "name": "RustyAuth",
    "description": "RustyAuth 1.0.0: dashboard, private API, SableDB, encrypted backups.",
    "url": "https://railway.com/deploy/rustyauth",
    "upstream": {
      "image": "ghcr.io/rusty-auth/dashboard@sha256:d7a7f538e57606a4cc9bd344fe394e68e0f68ba26ec5f01d193170149e260c08"
    }
  },
  "status": "unvalidated",
  "validated_at": null,
  "success_rate_30d": null,
  "services": [
    {
      "name": "rustyauth-dashboard",
      "source": {
        "image": "ghcr.io/rusty-auth/dashboard@sha256:d7a7f538e57606a4cc9bd344fe394e68e0f68ba26ec5f01d193170149e260c08"
      },
      "needs_volume": false,
      "http": true
    },
    {
      "name": "RustyAuth",
      "source": {
        "image": "ghcr.io/rusty-auth/rustyauth@sha256:e0cf594e289b4f5af904e903a741970aef8975588e156f41fa5fe8cfaf65c86d"
      },
      "needs_volume": false,
      "http": false
    },
    {
      "name": "SableDB",
      "source": {
        "image": "ghcr.io/rusty-auth/sabledb@sha256:bbccbe52b7915a2d73b8cb0f9e12c706a5c733fd492432d341f66ef8d0b79051"
      },
      "needs_volume": true,
      "volume_mount_path": "/var/lib/sabledb",
      "http": false
    }
  ],
  "required_inputs": [
    {
      "key": "PORT",
      "service": "rustyauth-dashboard",
      "description": "Public dashboard gateway port.",
      "secret": false,
      "strategy": "default",
      "default": "8080"
    },
    {
      "key": "RUSTYAUTH_API_UPSTREAM",
      "service": "rustyauth-dashboard",
      "description": "Private Railway URL for the RustyAuth API.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "PORT",
      "service": "RustyAuth",
      "description": "Private HTTP port for the RustyAuth API.",
      "secret": false,
      "strategy": "default",
      "default": "8080"
    },
    {
      "key": "AUTH_ENV",
      "service": "RustyAuth",
      "description": "Fail-closed production runtime mode.",
      "secret": false,
      "strategy": "default",
      "default": "production"
    },
    {
      "key": "RUST_LOG",
      "service": "RustyAuth",
      "description": "Production logging filter.",
      "secret": false,
      "strategy": "default",
      "default": "rustyauth=info,tower_http=info"
    },
    {
      "key": "AUTH_ISSUER",
      "service": "RustyAuth",
      "description": "Issuer derived from the public dashboard gateway domain.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "SABLEDB_URL",
      "service": "RustyAuth",
      "description": "Private Railway connection to the bundled SableDB service.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_private_domain"
    },
    {
      "key": "AUTH_TENANT_ID",
      "service": "RustyAuth",
      "description": "Tenant identifier for this standalone realm.",
      "secret": false,
      "strategy": "default",
      "default": "default"
    },
    {
      "key": "WEBAUTHN_RP_ID",
      "service": "RustyAuth",
      "description": "Passkey relying-party ID derived from the public dashboard gateway domain.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "AUTH_BACKUP_SSE",
      "service": "RustyAuth",
      "description": "Require provider-managed encryption in addition to RustyAuth application encryption.",
      "secret": false,
      "strategy": "default",
      "default": "provider"
    },
    {
      "key": "BOOTSTRAP_TOKEN",
      "service": "RustyAuth",
      "description": "Automatically generated credential for initial administrative enrolment.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "WEBAUTHN_RP_NAME",
      "service": "RustyAuth",
      "description": "Human-readable relying-party name shown by passkey prompts.",
      "secret": false,
      "strategy": "default",
      "default": "RustyAuth"
    },
    {
      "key": "AUTH_BACKUP_BUCKET",
      "service": "RustyAuth",
      "description": "Private Railway bucket used for encrypted recovery points.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "AUTH_BACKUP_REGION",
      "service": "RustyAuth",
      "description": "Signing region for the private Railway backup bucket.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "SPACETIME_AUDIENCE",
      "service": "RustyAuth",
      "description": "Audience claim placed in issued access tokens.",
      "secret": false,
      "strategy": "default",
      "default": "rustyauth"
    },
    {
      "key": "WEBAUTHN_RP_ORIGIN",
      "service": "RustyAuth",
      "description": "Passkey origin derived from the public dashboard gateway domain.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "railway_domain"
    },
    {
      "key": "AUTH_MASTER_KEY_HEX",
      "service": "RustyAuth",
      "description": "Automatically generated 256-bit master key.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "AUTH_BACKUP_ENDPOINT",
      "service": "RustyAuth",
      "description": "S3-compatible endpoint for the private Railway backup bucket.",
      "secret": false,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "AUTH_EVENT_RPC_TOKEN",
      "service": "RustyAuth",
      "description": "Automatically generated credential for the event RPC surface.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "AUTH_OPERATOR_EMAILS",
      "service": "RustyAuth",
      "description": "Verified email allowed to bootstrap the first dashboard owner.",
      "secret": false,
      "strategy": "ask_user"
    },
    {
      "key": "AUTH_BACKUP_URL_STYLE",
      "service": "RustyAuth",
      "description": "Virtual-hosted S3 URL style used by Railway buckets.",
      "secret": false,
      "strategy": "default",
      "default": "virtual"
    },
    {
      "key": "AUTH_IDENTITY_RPC_TOKEN",
      "service": "RustyAuth",
      "description": "Automatically generated credential for the identity RPC surface.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "AUTH_TRUSTED_PROXY_HOPS",
      "service": "RustyAuth",
      "description": "Trust the single dashboard gateway reverse proxy in front of the private API.",
      "secret": false,
      "strategy": "default",
      "default": "1"
    },
    {
      "key": "AUTH_ACCESS_TOKEN_SECONDS",
      "service": "RustyAuth",
      "description": "Access-token lifetime in seconds.",
      "secret": true,
      "strategy": "default",
      "default": "300"
    },
    {
      "key": "AUTH_BACKUP_ACCESS_KEY_ID",
      "service": "RustyAuth",
      "description": "Access key for the private Railway backup bucket.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "AUTH_SESSION_IDLE_SECONDS",
      "service": "RustyAuth",
      "description": "Browser-session idle timeout in seconds.",
      "secret": false,
      "strategy": "default",
      "default": "1800"
    },
    {
      "key": "AUTH_BACKUP_STORAGE_PROFILE",
      "service": "RustyAuth",
      "description": "Railway-compatible storage profile with application encryption and read-back verification.",
      "secret": false,
      "strategy": "default",
      "default": "portable"
    },
    {
      "key": "AUTH_BACKUP_INTERVAL_SECONDS",
      "service": "RustyAuth",
      "description": "Create and verify an encrypted recovery point every six hours.",
      "secret": false,
      "strategy": "default",
      "default": "21600"
    },
    {
      "key": "AUTH_BACKUP_SECRET_ACCESS_KEY",
      "service": "RustyAuth",
      "description": "Secret access key for the private Railway backup bucket.",
      "secret": true,
      "strategy": "railway_provided",
      "railway_source": "reference_variable"
    },
    {
      "key": "AUTH_SESSION_ABSOLUTE_SECONDS",
      "service": "RustyAuth",
      "description": "Maximum browser-session lifetime in seconds.",
      "secret": false,
      "strategy": "default",
      "default": "604800"
    },
    {
      "key": "AUTH_BACKUP_ENCRYPTION_KEY_HEX",
      "service": "RustyAuth",
      "description": "Automatically generated independent 256-bit backup-encryption key.",
      "secret": true,
      "strategy": "generate",
      "generate": "random_base64_32"
    },
    {
      "key": "PORT",
      "service": "SableDB",
      "description": "Private SableDB port used by RustyAuth.",
      "secret": false,
      "strategy": "default",
      "default": "6379"
    },
    {
      "key": "SABLEDB_SCAN_KEYS_SECS",
      "service": "SableDB",
      "description": "Full key-count telemetry interval; avoids a once-per-minute database walk competing with authentication on larger realms.",
      "secret": true,
      "strategy": "default",
      "default": "3600"
    },
    {
      "key": "SABLEDB_BLOCK_CACHE_SIZE",
      "service": "SableDB",
      "description": "RocksDB point-read cache sized for the Railway realm tier; lightweight Helm installs retain the conservative image default.",
      "secret": false,
      "strategy": "default",
      "default": "256MB"
    }
  ],
  "deploy": {
    "mcp": {
      "server": "railway",
      "tool": "deploy_template",
      "args": {
        "template_code": "rustyauth"
      }
    },
    "cli": "railway deploy --template rustyauth",
    "api": {
      "method": "POST",
      "path": "/graphql/v2",
      "body": {
        "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }",
        "variables": {
          "input": {
            "templateId": "ea7d8dec-ce0a-4231-9559-fe8845a8809b",
            "serializedConfig": {
              "buckets": {
                "256d29d0-214b-4d41-9c86-cb8021e9d518": {
                  "name": "rustyauth-backups"
                }
              },
              "services": {
                "161192f7-0077-4389-a005-878ae0d7cfe7": {
                  "icon": "https://rustyauth.dev/brand/rustyauth-mark.png",
                  "name": "rustyauth-dashboard",
                  "deploy": {
                    "overlapSeconds": 10,
                    "drainingSeconds": 10,
                    "healthcheckPath": "/readyz",
                    "restartPolicyType": "ON_FAILURE",
                    "healthcheckTimeout": 180,
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "ghcr.io/rusty-auth/dashboard@sha256:d7a7f538e57606a4cc9bd344fe394e68e0f68ba26ec5f01d193170149e260c08"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Public dashboard gateway port.",
                      "defaultValue": "8080"
                    },
                    "RUSTYAUTH_API_UPSTREAM": {
                      "isOptional": false,
                      "description": "Private Railway URL for the RustyAuth API.",
                      "defaultValue": "http://${{RustyAuth.RAILWAY_PRIVATE_DOMAIN}}:8080"
                    }
                  },
                  "networking": {
                    "serviceDomains": {
                      "<hasDomain>:8080": {
                        "port": 8080
                      }
                    }
                  }
                },
                "2314c56d-976a-4d81-b34b-b24d0971493b": {
                  "icon": "https://rustyauth.dev/brand/rustyauth-mark.png",
                  "name": "RustyAuth",
                  "deploy": {
                    "overlapSeconds": 0,
                    "drainingSeconds": 25,
                    "healthcheckPath": "/readyz",
                    "restartPolicyType": "ON_FAILURE",
                    "healthcheckTimeout": 180,
                    "restartPolicyMaxRetries": 10
                  },
                  "source": {
                    "image": "ghcr.io/rusty-auth/rustyauth@sha256:e0cf594e289b4f5af904e903a741970aef8975588e156f41fa5fe8cfaf65c86d"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Private HTTP port for the RustyAuth API.",
                      "defaultValue": "8080"
                    },
                    "AUTH_ENV": {
                      "isOptional": false,
                      "description": "Fail-closed production runtime mode.",
                      "defaultValue": "production"
                    },
                    "RUST_LOG": {
                      "isOptional": false,
                      "description": "Production logging filter.",
                      "defaultValue": "rustyauth=info,tower_http=info"
                    },
                    "AUTH_ISSUER": {
                      "isOptional": false,
                      "description": "Issuer derived from the public dashboard gateway domain.",
                      "defaultValue": "https://${{rustyauth-dashboard.RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "SABLEDB_URL": {
                      "isOptional": false,
                      "description": "Private Railway connection to the bundled SableDB service.",
                      "defaultValue": "redis://${{SableDB.RAILWAY_PRIVATE_DOMAIN}}:6379"
                    },
                    "AUTH_TENANT_ID": {
                      "isOptional": false,
                      "description": "Tenant identifier for this standalone realm.",
                      "defaultValue": "default"
                    },
                    "WEBAUTHN_RP_ID": {
                      "isOptional": false,
                      "description": "Passkey relying-party ID derived from the public dashboard gateway domain.",
                      "defaultValue": "${{rustyauth-dashboard.RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "AUTH_BACKUP_SSE": {
                      "isOptional": false,
                      "description": "Require provider-managed encryption in addition to RustyAuth application encryption.",
                      "defaultValue": "provider"
                    },
                    "BOOTSTRAP_TOKEN": {
                      "isOptional": false,
                      "description": "Automatically generated credential for initial administrative enrolment.",
                      "defaultValue": "{{BOOTSTRAP_TOKEN}}"
                    },
                    "WEBAUTHN_RP_NAME": {
                      "isOptional": false,
                      "description": "Human-readable relying-party name shown by passkey prompts.",
                      "defaultValue": "RustyAuth"
                    },
                    "AUTH_BACKUP_BUCKET": {
                      "isOptional": false,
                      "description": "Private Railway bucket used for encrypted recovery points.",
                      "defaultValue": "${{rustyauth-backups.BUCKET}}"
                    },
                    "AUTH_BACKUP_REGION": {
                      "isOptional": false,
                      "description": "Signing region for the private Railway backup bucket.",
                      "defaultValue": "${{rustyauth-backups.REGION}}"
                    },
                    "SPACETIME_AUDIENCE": {
                      "isOptional": false,
                      "description": "Audience claim placed in issued access tokens.",
                      "defaultValue": "rustyauth"
                    },
                    "WEBAUTHN_RP_ORIGIN": {
                      "isOptional": false,
                      "description": "Passkey origin derived from the public dashboard gateway domain.",
                      "defaultValue": "https://${{rustyauth-dashboard.RAILWAY_PUBLIC_DOMAIN}}"
                    },
                    "AUTH_MASTER_KEY_HEX": {
                      "isOptional": false,
                      "description": "Automatically generated 256-bit master key.",
                      "defaultValue": "{{AUTH_MASTER_KEY_HEX}}"
                    },
                    "AUTH_BACKUP_ENDPOINT": {
                      "isOptional": false,
                      "description": "S3-compatible endpoint for the private Railway backup bucket.",
                      "defaultValue": "${{rustyauth-backups.ENDPOINT}}"
                    },
                    "AUTH_EVENT_RPC_TOKEN": {
                      "isOptional": false,
                      "description": "Automatically generated credential for the event RPC surface.",
                      "defaultValue": "{{AUTH_EVENT_RPC_TOKEN}}"
                    },
                    "AUTH_OPERATOR_EMAILS": {
                      "isOptional": false,
                      "description": "Verified email allowed to bootstrap the first dashboard owner.",
                      "defaultValue": "{{AUTH_OPERATOR_EMAILS}}"
                    },
                    "AUTH_BACKUP_URL_STYLE": {
                      "isOptional": false,
                      "description": "Virtual-hosted S3 URL style used by Railway buckets.",
                      "defaultValue": "virtual"
                    },
                    "AUTH_IDENTITY_RPC_TOKEN": {
                      "isOptional": false,
                      "description": "Automatically generated credential for the identity RPC surface.",
                      "defaultValue": "{{AUTH_IDENTITY_RPC_TOKEN}}"
                    },
                    "AUTH_TRUSTED_PROXY_HOPS": {
                      "isOptional": false,
                      "description": "Trust the single dashboard gateway reverse proxy in front of the private API.",
                      "defaultValue": "1"
                    },
                    "AUTH_ACCESS_TOKEN_SECONDS": {
                      "isOptional": false,
                      "description": "Access-token lifetime in seconds.",
                      "defaultValue": "300"
                    },
                    "AUTH_BACKUP_ACCESS_KEY_ID": {
                      "isOptional": false,
                      "description": "Access key for the private Railway backup bucket.",
                      "defaultValue": "${{rustyauth-backups.ACCESS_KEY_ID}}"
                    },
                    "AUTH_SESSION_IDLE_SECONDS": {
                      "isOptional": false,
                      "description": "Browser-session idle timeout in seconds.",
                      "defaultValue": "1800"
                    },
                    "AUTH_BACKUP_STORAGE_PROFILE": {
                      "isOptional": false,
                      "description": "Railway-compatible storage profile with application encryption and read-back verification.",
                      "defaultValue": "portable"
                    },
                    "AUTH_BACKUP_INTERVAL_SECONDS": {
                      "isOptional": false,
                      "description": "Create and verify an encrypted recovery point every six hours.",
                      "defaultValue": "21600"
                    },
                    "AUTH_BACKUP_SECRET_ACCESS_KEY": {
                      "isOptional": false,
                      "description": "Secret access key for the private Railway backup bucket.",
                      "defaultValue": "${{rustyauth-backups.SECRET_ACCESS_KEY}}"
                    },
                    "AUTH_SESSION_ABSOLUTE_SECONDS": {
                      "isOptional": false,
                      "description": "Maximum browser-session lifetime in seconds.",
                      "defaultValue": "604800"
                    },
                    "AUTH_BACKUP_ENCRYPTION_KEY_HEX": {
                      "isOptional": false,
                      "description": "Automatically generated independent 256-bit backup-encryption key.",
                      "defaultValue": "{{AUTH_BACKUP_ENCRYPTION_KEY_HEX}}"
                    }
                  }
                },
                "711d421a-f000-4b0a-adba-3d82cb5c19e7": {
                  "icon": "https://devicons.railway.com/i/redis.svg",
                  "name": "SableDB",
                  "deploy": {
                    "overlapSeconds": 0,
                    "restartPolicyType": "ALWAYS"
                  },
                  "source": {
                    "image": "ghcr.io/rusty-auth/sabledb@sha256:bbccbe52b7915a2d73b8cb0f9e12c706a5c733fd492432d341f66ef8d0b79051"
                  },
                  "variables": {
                    "PORT": {
                      "isOptional": false,
                      "description": "Private SableDB port used by RustyAuth.",
                      "defaultValue": "6379"
                    },
                    "SABLEDB_SCAN_KEYS_SECS": {
                      "isOptional": false,
                      "description": "Full key-count telemetry interval; avoids a once-per-minute database walk competing with authentication on larger realms.",
                      "defaultValue": "3600"
                    },
                    "SABLEDB_BLOCK_CACHE_SIZE": {
                      "isOptional": false,
                      "description": "RocksDB point-read cache sized for the Railway realm tier; lightweight Helm installs retain the conservative image default.",
                      "defaultValue": "256MB"
                    }
                  },
                  "volumeMounts": {
                    "711d421a-f000-4b0a-adba-3d82cb5c19e7": {
                      "mountPath": "/var/lib/sabledb"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "post_deploy": {
    "healthcheck": {
      "service": "rustyauth-dashboard",
      "method": "GET",
      "path": "/readyz",
      "expect_status": 200
    }
  },
  "resources": {
    "expected_services": 3,
    "needs_volume": true
  },
  "generated_at": "2026-09-10T22:14:43.398Z",
  "generator_version": "0.1.0"
}