{ "manifest_version": "1.0.0", "template": { "id": "711f7878-96d9-44d0-bab8-af0246f65afa", "slug": "supabase-lite", "name": "Supabase Lite", "description": "Minimal self-hosted Supabase stack: 7 services in ~1.5 GB of RAM", "url": "https://railway.com/deploy/supabase-lite", "upstream": { "repo_url": "https://github.com/INAPP-Mobile/railway-supabase-lite" } }, "services": [ { "name": "rest", "source": { "image": "postgrest/postgrest:v14.8" }, "needs_volume": false, "http": false }, { "name": "realtime", "source": { "image": "supabase/realtime:v2.76.5" }, "needs_volume": false, "http": false }, { "name": "auth", "source": { "image": "supabase/gotrue:v2.186.0" }, "needs_volume": false, "http": false }, { "name": "postgres", "source": { "repo": "https://github.com/INAPP-Mobile/railway-supabase-lite" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql", "http": false }, { "name": "storage", "source": { "image": "supabase/storage-api:v1.48.26" }, "needs_volume": false, "http": false }, { "name": "kong", "source": { "repo": "https://github.com/INAPP-Mobile/railway-supabase-lite" }, "needs_volume": false, "http": true }, { "name": "minio", "source": { "image": "minio/minio:RELEASE.2025-09-07T16-13-09Z" }, "needs_volume": true, "volume_mount_path": "/data", "http": true } ], "required_inputs": [ { "key": "PGRST_DB_URI", "service": "rest", "description": "PostgreSQL connection string for PostgREST. Uses private networking and references postgres service vars. The *** is auto-resolved to the real password by Railway.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PGRST_DB_SCHEMAS", "service": "rest", "description": "Comma-separated list of database schemas PostgREST exposes. graphql_public omitted (requires pg_graphql extension).", "secret": false, "strategy": "default", "default": "public,storage" }, { "key": "PGRST_JWT_SECRET", "service": "rest", "description": "HS256 secret for verifying JWTs. References the auth service's JWT_SECRET so all services share the same signing key.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGRST_SERVER_PORT", "service": "rest", "description": "PostgREST listen port. Set to Railway-injected ${{PORT}} so health checks and Kong proxy can reach it.", "secret": false, "strategy": "default", "default": "8080" }, { "key": "PGRST_DB_ANON_ROLE", "service": "rest", "description": "Database role used for anonymous (unauthenticated) requests. Must match the role created in PostgreSQL init scripts.", "secret": false, "strategy": "default", "default": "anon" }, { "key": "PGRST_DB_EXTRA_SEARCH_PATH", "service": "rest", "description": "Extra schema search path for PostgREST to find functions and types in the public schema.", "secret": false, "strategy": "default", "default": "public" }, { "key": "DB_HOST", "service": "realtime", "description": "PostgreSQL host via Railway private networking. References the postgres service's private domain.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "DB_NAME", "service": "realtime", "description": "PostgreSQL database name. References the postgres service's POSTGRES_DB.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DB_PORT", "service": "realtime", "description": "PostgreSQL port. References the postgres service's POSTGRES_PORT.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DB_USER", "service": "realtime", "description": "PostgreSQL username. References the postgres service's POSTGRES_USER.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "APP_NAME", "service": "realtime", "description": "Application name for the Realtime service. Required by the Elixir/Erlang app for node naming.", "secret": false, "strategy": "default", "default": "realtime" }, { "key": "ERL_AFLAGS", "service": "realtime", "description": "Erlang distribution flags. inet_tcp ensures standard TCP clustering works on Railway.", "secret": false, "strategy": "default", "default": "-proto_dist inet_tcp" }, { "key": "JWT_SECRET", "service": "realtime", "description": "JWT secret for Realtime. References the auth service's JWT_SECRET so all services share the same signing key.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DB_PASSWORD", "service": "realtime", "description": "PostgreSQL password. References the postgres service's POSTGRES_PASSWORD.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "API_JWT_SECRET", "service": "realtime", "description": "JWT secret for the Realtime API. Mirrors JWT_SECRET from the auth service.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SECRET_KEY_BASE", "service": "realtime", "description": "Elixir secret key base for crypto operations (session signing, CSRF tokens). Auto-generated 64-char secret.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "ENABLE_TAILSCALE", "service": "realtime", "description": "Enable Tailscale-based clustering. Set to false for Railway (uses standard TCP).", "secret": false, "strategy": "default", "default": "false" }, { "key": "DB_AFTER_CONNECT_QUERY", "service": "realtime", "description": "SQL executed after connecting to PostgreSQL. Sets the search path to the _realtime schema.", "secret": false, "strategy": "default", "default": "SET search_path TO _realtime" }, { "key": "ANON_KEY", "service": "auth", "description": "Public client API key — JWT signed by JWT_SECRET with role=anon. Pre-computed for default JWT_SECRET; regenerate if you change JWT_SECRET.", "secret": true, "strategy": "default", "default": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiJ9.ZopqoUt20nEV9cklpv9e3yw3PVyZLmKs5qLD6nGL1SI" }, { "key": "JWT_SECRET", "service": "auth", "description": "JWT secret used to sign API tokens. Default is the Supabase demo secret — change this and regenerate ANON_KEY/SERVICE_ROLE_KEY for production.", "secret": true, "strategy": "default", "default": "super-secret-jwt-token-with-at-least-32-characters-long" }, { "key": "DATABASE_URL", "service": "auth", "description": "Raw PostgreSQL connection string (without search_path). Available for migrations and tooling.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_HOST", "service": "auth", "description": "Provide a value for POSTGRES_HOST.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_PORT", "service": "auth", "description": "Provide a value for POSTGRES_PORT.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "GOTRUE_JWT_EXP", "service": "auth", "description": "JWT expiration time in seconds (3600 = 1 hour).", "secret": false, "strategy": "default", "default": "3600" }, { "key": "GOTRUE_API_HOST", "service": "auth", "description": "Bind address for the GoTrue (Supabase Auth) API server. 0.0.0.0 binds all interfaces so Railway's proxy can reach it.", "secret": false, "strategy": "default", "default": "0.0.0.0" }, { "key": "GOTRUE_API_PORT", "service": "auth", "description": "Listen port for GoTrue API. Set to Railway-injected ${{PORT}} so health checks and Kong proxy can reach it.", "secret": false, "strategy": "default", "default": "8080" }, { "key": "GOTRUE_SITE_URL", "service": "auth", "description": "Site URL for auth redirect flows. Points to the Kong gateway public domain.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "API_EXTERNAL_URL", "service": "auth", "description": "External-facing API URL. Points to the Kong gateway's public domain so OAuth redirects work correctly.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "GOTRUE_DB_DRIVER", "service": "auth", "description": "Database driver — always postgres.", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "GOTRUE_SMTP_PORT", "service": "auth", "description": "SMTP server port. Must be numeric (GoTrue requires an integer). Common: 587 (TLS), 465 (SSL), 25 (unencrypted). Ignored when GOTRUE_SMTP_HOST is empty.", "secret": false, "strategy": "default", "default": "587" }, { "key": "SERVICE_ROLE_KEY", "service": "auth", "description": "Server-side key with full database access — JWT signed by JWT_SECRET with role=service_role. Pre-computed for default JWT_SECRET; regenerate if you change JWT_SECRET.", "secret": true, "strategy": "default", "default": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIn0.M2d2z4SFn5C7HlJlaSLfrzuYim9nbY_XI40uWFN3hEE" }, { "key": "GOTRUE_JWT_SECRET", "service": "auth", "description": "GoTrue-specific JWT secret. Mirrors JWT_SECRET within the same service.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DASHBOARD_PASSWORD", "service": "auth", "description": "Password for admin dashboard access. Auto-generated.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "DASHBOARD_USERNAME", "service": "auth", "description": "Username for admin dashboard access (if Studio were included).", "secret": false, "strategy": "default", "default": "supabase" }, { "key": "GOTRUE_DB_DATABASE_URL", "service": "auth", "description": "PostgreSQL connection string for GoTrue. Uses private networking and references postgres service vars. The *** is auto-resolved by Railway to the actual password.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "GOTRUE_MAILER_AUTOCONFIRM", "service": "auth", "description": "Auto-confirm user emails on signup (development mode). Set to false in production to require email verification.", "secret": false, "strategy": "default", "default": "true" }, { "key": "GOTRUE_EXTERNAL_EMAIL_ENABLED", "service": "auth", "description": "Enable external email provider support. Set to false to disable email auth.", "secret": false, "strategy": "default", "default": "true" }, { "key": "PGDATA", "service": "postgres", "description": "PostgreSQL data directory, placed under the Railway persistent volume mount (/var/lib/postgresql/data). Changing this after first boot will orphan existing data.", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "POSTGRES_DB", "service": "postgres", "description": "Name of the default database created on first boot. All Supabase schemas (auth, storage, _realtime, public) are created inside this database.", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "DATABASE_URL", "service": "postgres", "description": "Self-referencing connection string. Consumed by the postgres service itself and referenced by dependent services as ${{postgres.DATABASE_URL}}.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_PORT", "service": "postgres", "description": "Port PostgreSQL listens on inside the container. Must stay 5432 — all other services reference this port via private networking.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "POSTGRES_USER", "service": "postgres", "description": "PostgreSQL superuser username. Change to harden the default account.", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "POSTGRES_PASSWORD", "service": "postgres", "description": "Master database password — auto-generated at deploy time. Referenced by all Supabase services (auth, rest, realtime, storage) via ${{postgres.POSTGRES_PASSWORD}}.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "REGION", "service": "storage", "description": "Region for the storage API. Must match AWS_REGION.", "secret": false, "strategy": "default", "default": "us-east-1" }, { "key": "ANON_KEY", "service": "storage", "description": "Public anon JWT. References the auth service's ANON_KEY so client-side storage calls are authenticated.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "AWS_REGION", "service": "storage", "description": "AWS region for S3. MinIO ignores this but the storage API requires a non-empty value.", "secret": false, "strategy": "default", "default": "us-east-1" }, { "key": "MINIO_HOST", "service": "storage", "description": "Provide a value for MINIO_HOST.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "DATABASE_URL", "service": "storage", "description": "PostgreSQL connection string for storage API. Uses private networking and references postgres service vars.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_HOST", "service": "storage", "description": "Provide a value for POSTGRES_HOST.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_PORT", "service": "storage", "description": "Provide a value for POSTGRES_PORT.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "AWS_S3_ENDPOINT", "service": "storage", "description": "S3 endpoint URL. Points to MinIO via Railway private networking on port 8080 (Railway-injected PORT).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "FILE_SIZE_LIMIT", "service": "storage", "description": "Maximum file upload size in bytes (52428800 = 50 MB). Increase for larger file support.", "secret": false, "strategy": "default", "default": "52428800" }, { "key": "STORAGE_BACKEND", "service": "storage", "description": "Storage backend type. 's3' uses MinIO (S3-compatible). 'file' uses local disk (not recommended for Railway).", "secret": false, "strategy": "default", "default": "s3" }, { "key": "GLOBAL_S3_BUCKET", "service": "storage", "description": "Default S3 bucket name. The bucket is created automatically on first storage API startup if it does not exist.", "secret": false, "strategy": "default", "default": "supabase-storage" }, { "key": "PGRST_JWT_SECRET", "service": "storage", "description": "HS256 secret for JWT verification. References the auth service's JWT_SECRET.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SERVICE_ROLE_KEY", "service": "storage", "description": "Server-side full-access key. References the auth service's SERVICE_ROLE_KEY for admin storage operations.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "AWS_ACCESS_KEY_ID", "service": "storage", "description": "S3 access key. References the minio service's MINIO_ROOT_USER.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "AWS_SECRET_ACCESS_KEY", "service": "storage", "description": "S3 secret key. References the minio service's MINIO_ROOT_PASSWORD (auto-generated).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "AWS_S3_FORCE_PATH_STYLE", "service": "storage", "description": "Force path-style S3 addressing. Required for MinIO compatibility (not using virtual-host-style).", "secret": false, "strategy": "default", "default": "true" }, { "key": "FILE_STORAGE_BACKEND_PATH", "service": "storage", "description": "Temporary path for file processing before upload to S3.", "secret": false, "strategy": "default", "default": "/tmp" }, { "key": "ENABLE_IMAGE_TRANSFORMATION", "service": "storage", "description": "Enable image transformation (resize, optimize). Set to false to save RAM on Railway.", "secret": false, "strategy": "default", "default": "false" }, { "key": "PORT", "service": "kong", "description": "Railway-injected port. Kong proxy listens on this port.", "secret": false, "strategy": "default", "default": "8080" }, { "key": "AUTH_HOST", "service": "kong", "description": "Private domain for the auth (GoTrue) service. Kong proxies /auth/v1/* requests here.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "REST_HOST", "service": "kong", "description": "Private domain for the rest (PostgREST) service. Kong proxies /rest/v1/* requests here.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "STORAGE_HOST", "service": "kong", "description": "Private domain for the storage service. Kong proxies /storage/v1/* requests here.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "REALTIME_HOST", "service": "kong", "description": "Private domain for the realtime service. Kong proxies /realtime/v1/* requests here.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "KONG_PROXY_LISTEN", "service": "kong", "description": "Kong proxy listen address. Uses Railway-injected ${{PORT}} so health checks and external traffic can reach it.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PORT", "service": "minio", "description": "Railway-injected port. Minio API listens on this port.", "secret": false, "strategy": "default", "default": "8080" }, { "key": "MINIO_ADDRESS", "service": "minio", "description": "MinIO listen address. Port 8080 matches Railway's injected PORT so health checks can reach it.", "secret": false, "strategy": "default", "default": "0.0.0.0:8080" }, { "key": "MINIO_ROOT_USER", "service": "minio", "description": "MinIO root (admin) username. Referenced by the storage service as AWS_ACCESS_KEY_ID via ${{minio.MINIO_ROOT_USER}}.", "secret": false, "strategy": "default", "default": "minioadmin" }, { "key": "MINIO_ROOT_PASSWORD", "service": "minio", "description": "MinIO root password — auto-generated at deploy time. Referenced by the storage service as AWS_SECRET_ACCESS_KEY via ${{minio.MINIO_ROOT_PASSWORD}}.", "secret": true, "strategy": "generate", "generate": "strong_password" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "supabase-lite" } }, "cli": "railway deploy --template supabase-lite", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "711f7878-96d9-44d0-bab8-af0246f65afa", "serializedConfig": { "services": { "1611d653-731e-4b5d-8209-fadea35671c0": { "icon": null, "name": "rest", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "postgrest/postgrest:v14.8" }, "variables": { "PGRST_DB_URI": { "isOptional": false, "description": "PostgreSQL connection string for PostgREST. Uses private networking and references postgres service vars. The *** is auto-resolved to the real password by Railway.", "defaultValue": "postgres://${{postgres.POSTGRES_USER}}:${{postgres.POSTGRES_PASSWORD}}@${{postgres.RAILWAY_PRIVATE_DOMAIN}}:${{postgres.POSTGRES_PORT}}/${{postgres.POSTGRES_DB}}" }, "PGRST_DB_SCHEMAS": { "isOptional": false, "description": "Comma-separated list of database schemas PostgREST exposes. graphql_public omitted (requires pg_graphql extension).", "defaultValue": "public,storage" }, "PGRST_JWT_SECRET": { "isOptional": false, "description": "HS256 secret for verifying JWTs. References the auth service's JWT_SECRET so all services share the same signing key.", "defaultValue": "${{auth.JWT_SECRET}}" }, "PGRST_SERVER_PORT": { "isOptional": false, "description": "PostgREST listen port. Set to Railway-injected ${{PORT}} so health checks and Kong proxy can reach it.", "defaultValue": "8080" }, "PGRST_DB_ANON_ROLE": { "isOptional": false, "description": "Database role used for anonymous (unauthenticated) requests. Must match the role created in PostgreSQL init scripts.", "defaultValue": "anon" }, "PGRST_DB_EXTRA_SEARCH_PATH": { "isOptional": false, "description": "Extra schema search path for PostgREST to find functions and types in the public schema.", "defaultValue": "public" } } }, "3231f670-4c0a-4fa7-8b59-05a48ef21639": { "icon": null, "name": "realtime", "deploy": { "startCommand": null, "healthcheckPath": "/healthcheck", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "supabase/realtime:v2.76.5" }, "variables": { "DB_HOST": { "isOptional": false, "description": "PostgreSQL host via Railway private networking. References the postgres service's private domain.", "defaultValue": "${{postgres.RAILWAY_PRIVATE_DOMAIN}}" }, "DB_NAME": { "isOptional": false, "description": "PostgreSQL database name. References the postgres service's POSTGRES_DB.", "defaultValue": "${{postgres.POSTGRES_DB}}" }, "DB_PORT": { "isOptional": false, "description": "PostgreSQL port. References the postgres service's POSTGRES_PORT.", "defaultValue": "${{postgres.POSTGRES_PORT}}" }, "DB_USER": { "isOptional": false, "description": "PostgreSQL username. References the postgres service's POSTGRES_USER.", "defaultValue": "${{postgres.POSTGRES_USER}}" }, "APP_NAME": { "isOptional": false, "description": "Application name for the Realtime service. Required by the Elixir/Erlang app for node naming.", "defaultValue": "realtime" }, "DNS_NODES": { "isOptional": true, "description": "DNS node names for Erlang clustering. Leave empty for single-node deployment.", "defaultValue": "" }, "ERL_AFLAGS": { "isOptional": false, "description": "Erlang distribution flags. inet_tcp ensures standard TCP clustering works on Railway.", "defaultValue": "-proto_dist inet_tcp" }, "JWT_SECRET": { "isOptional": false, "description": "JWT secret for Realtime. References the auth service's JWT_SECRET so all services share the same signing key.", "defaultValue": "${{auth.JWT_SECRET}}" }, "DB_PASSWORD": { "isOptional": false, "description": "PostgreSQL password. References the postgres service's POSTGRES_PASSWORD.", "defaultValue": "${{postgres.POSTGRES_PASSWORD}}" }, "API_JWT_SECRET": { "isOptional": false, "description": "JWT secret for the Realtime API. Mirrors JWT_SECRET from the auth service.", "defaultValue": "${{auth.JWT_SECRET}}" }, "SECRET_KEY_BASE": { "isOptional": false, "description": "Elixir secret key base for crypto operations (session signing, CSRF tokens). Auto-generated 64-char secret.", "defaultValue": "{{SECRET_KEY_BASE}}" }, "ENABLE_TAILSCALE": { "isOptional": false, "description": "Enable Tailscale-based clustering. Set to false for Railway (uses standard TCP).", "defaultValue": "false" }, "DB_AFTER_CONNECT_QUERY": { "isOptional": false, "description": "SQL executed after connecting to PostgreSQL. Sets the search path to the _realtime schema.", "defaultValue": "SET search_path TO _realtime" } } }, "32452c8a-54e7-459c-9e70-8de717e4b7ba": { "icon": null, "name": "auth", "deploy": { "startCommand": "sh -c 'until nc -z $POSTGRES_HOST $POSTGRES_PORT 2>/dev/null; do echo waiting for postgres; sleep 2; done; exec gotrue'", "healthcheckPath": "/health", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "supabase/gotrue:v2.186.0" }, "variables": { "ANON_KEY": { "isOptional": false, "description": "Public client API key — JWT signed by JWT_SECRET with role=anon. Pre-computed for default JWT_SECRET; regenerate if you change JWT_SECRET.", "defaultValue": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiJ9.ZopqoUt20nEV9cklpv9e3yw3PVyZLmKs5qLD6nGL1SI" }, "JWT_SECRET": { "isOptional": false, "description": "JWT secret used to sign API tokens. Default is the Supabase demo secret — change this and regenerate ANON_KEY/SERVICE_ROLE_KEY for production.", "defaultValue": "super-secret-jwt-token-with-at-least-32-characters-long" }, "DATABASE_URL": { "isOptional": false, "description": "Raw PostgreSQL connection string (without search_path). Available for migrations and tooling.", "defaultValue": "postgres://${{postgres.POSTGRES_USER}}:${{postgres.POSTGRES_PASSWORD}}@${{postgres.RAILWAY_PRIVATE_DOMAIN}}:${{postgres.POSTGRES_PORT}}/${{postgres.POSTGRES_DB}}" }, "POSTGRES_HOST": { "isOptional": false, "description": "", "defaultValue": "${{postgres.RAILWAY_PRIVATE_DOMAIN}}" }, "POSTGRES_PORT": { "isOptional": false, "description": "", "defaultValue": "${{postgres.POSTGRES_PORT}}" }, "GOTRUE_JWT_EXP": { "isOptional": false, "description": "JWT expiration time in seconds (3600 = 1 hour).", "defaultValue": "3600" }, "GOTRUE_API_HOST": { "isOptional": false, "description": "Bind address for the GoTrue (Supabase Auth) API server. 0.0.0.0 binds all interfaces so Railway's proxy can reach it.", "defaultValue": "0.0.0.0" }, "GOTRUE_API_PORT": { "isOptional": false, "description": "Listen port for GoTrue API. Set to Railway-injected ${{PORT}} so health checks and Kong proxy can reach it.", "defaultValue": "8080" }, "GOTRUE_SITE_URL": { "isOptional": false, "description": "Site URL for auth redirect flows. Points to the Kong gateway public domain.", "defaultValue": "https://${{kong.RAILWAY_PUBLIC_DOMAIN}}" }, "API_EXTERNAL_URL": { "isOptional": false, "description": "External-facing API URL. Points to the Kong gateway's public domain so OAuth redirects work correctly.", "defaultValue": "https://${{kong.RAILWAY_PUBLIC_DOMAIN}}" }, "GOTRUE_DB_DRIVER": { "isOptional": false, "description": "Database driver — always postgres.", "defaultValue": "postgres" }, "GOTRUE_SMTP_HOST": { "isOptional": true, "description": "SMTP server host for sending auth emails. Leave empty to disable email sending (emails will not be sent). Example: smtp.gmail.com", "defaultValue": "" }, "GOTRUE_SMTP_PORT": { "isOptional": false, "description": "SMTP server port. Must be numeric (GoTrue requires an integer). Common: 587 (TLS), 465 (SSL), 25 (unencrypted). Ignored when GOTRUE_SMTP_HOST is empty.", "defaultValue": "587" }, "SERVICE_ROLE_KEY": { "isOptional": false, "description": "Server-side key with full database access — JWT signed by JWT_SECRET with role=service_role. Pre-computed for default JWT_SECRET; regenerate if you change JWT_SECRET.", "defaultValue": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIn0.M2d2z4SFn5C7HlJlaSLfrzuYim9nbY_XI40uWFN3hEE" }, "GOTRUE_JWT_SECRET": { "isOptional": false, "description": "GoTrue-specific JWT secret. Mirrors JWT_SECRET within the same service.", "defaultValue": "${{JWT_SECRET}}" }, "DASHBOARD_PASSWORD": { "isOptional": false, "description": "Password for admin dashboard access. Auto-generated.", "defaultValue": "{{DASHBOARD_PASSWORD}}" }, "DASHBOARD_USERNAME": { "isOptional": false, "description": "Username for admin dashboard access (if Studio were included).", "defaultValue": "supabase" }, "GOTRUE_URI_ALLOW_LIST": { "isOptional": true, "description": "Comma-separated list of additional allowed redirect URIs for OAuth flows. Leave empty to allow only the site URL.", "defaultValue": "" }, "GOTRUE_DB_DATABASE_URL": { "isOptional": false, "description": "PostgreSQL connection string for GoTrue. Uses private networking and references postgres service vars. The *** is auto-resolved by Railway to the actual password.", "defaultValue": "postgres://${{postgres.POSTGRES_USER}}:${{postgres.POSTGRES_PASSWORD}}@${{postgres.RAILWAY_PRIVATE_DOMAIN}}:${{postgres.POSTGRES_PORT}}/${{postgres.POSTGRES_DB}}?search_path=auth" }, "GOTRUE_MAILER_AUTOCONFIRM": { "isOptional": false, "description": "Auto-confirm user emails on signup (development mode). Set to false in production to require email verification.", "defaultValue": "true" }, "GOTRUE_EXTERNAL_EMAIL_ENABLED": { "isOptional": false, "description": "Enable external email provider support. Set to false to disable email auth.", "defaultValue": "true" } } }, "6e77c89e-6e4d-4c1a-8db7-fe12b122811d": { "icon": null, "name": "postgres", "deploy": { "startCommand": "", "healthcheckPath": "", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "repo": "https://github.com/INAPP-Mobile/railway-supabase-lite", "rootDirectory": "postgres" }, "variables": { "PGDATA": { "isOptional": false, "description": "PostgreSQL data directory, placed under the Railway persistent volume mount (/var/lib/postgresql/data). Changing this after first boot will orphan existing data.", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "POSTGRES_DB": { "isOptional": false, "description": "Name of the default database created on first boot. All Supabase schemas (auth, storage, _realtime, public) are created inside this database.", "defaultValue": "postgres" }, "DATABASE_URL": { "isOptional": false, "description": "Self-referencing connection string. Consumed by the postgres service itself and referenced by dependent services as ${{postgres.DATABASE_URL}}.", "defaultValue": "postgresql://${{POSTGRES_USER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:${{POSTGRES_PORT}}/${{POSTGRES_DB}}" }, "POSTGRES_PORT": { "isOptional": false, "description": "Port PostgreSQL listens on inside the container. Must stay 5432 — all other services reference this port via private networking.", "defaultValue": "5432" }, "POSTGRES_USER": { "isOptional": false, "description": "PostgreSQL superuser username. Change to harden the default account.", "defaultValue": "postgres" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Master database password — auto-generated at deploy time. Referenced by all Supabase services (auth, rest, realtime, storage) via ${{postgres.POSTGRES_PASSWORD}}.", "defaultValue": "{{POSTGRES_PASSWORD}}" } }, "volumeMounts": { "6e77c89e-6e4d-4c1a-8db7-fe12b122811d": { "mountPath": "/var/lib/postgresql" } } }, "7725e4cd-defc-4df9-9402-68dc3bede37e": { "icon": null, "name": "storage", "deploy": { "startCommand": "sh -c 'until nc -z $POSTGRES_HOST $POSTGRES_PORT 2>/dev/null; do echo waiting for postgres; sleep 2; done; until nc -z $MINIO_HOST 8080 2>/dev/null; do echo waiting for minio; sleep 2; done; exec node dist/start/server.js'", "healthcheckPath": "/status", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "supabase/storage-api:v1.48.26" }, "variables": { "REGION": { "isOptional": false, "description": "Region for the storage API. Must match AWS_REGION.", "defaultValue": "us-east-1" }, "ANON_KEY": { "isOptional": false, "description": "Public anon JWT. References the auth service's ANON_KEY so client-side storage calls are authenticated.", "defaultValue": "${{auth.ANON_KEY}}" }, "AWS_REGION": { "isOptional": false, "description": "AWS region for S3. MinIO ignores this but the storage API requires a non-empty value.", "defaultValue": "us-east-1" }, "MINIO_HOST": { "isOptional": false, "description": "", "defaultValue": "${{minio.RAILWAY_PRIVATE_DOMAIN}}" }, "DATABASE_URL": { "isOptional": false, "description": "PostgreSQL connection string for storage API. Uses private networking and references postgres service vars.", "defaultValue": "postgres://${{postgres.POSTGRES_USER}}:${{postgres.POSTGRES_PASSWORD}}@${{postgres.RAILWAY_PRIVATE_DOMAIN}}:${{postgres.POSTGRES_PORT}}/${{postgres.POSTGRES_DB}}?search_path=storage" }, "POSTGRES_HOST": { "isOptional": false, "description": "", "defaultValue": "${{postgres.RAILWAY_PRIVATE_DOMAIN}}" }, "POSTGRES_PORT": { "isOptional": false, "description": "", "defaultValue": "${{postgres.POSTGRES_PORT}}" }, "AWS_S3_ENDPOINT": { "isOptional": false, "description": "S3 endpoint URL. Points to MinIO via Railway private networking on port 8080 (Railway-injected PORT).", "defaultValue": "http://${{minio.RAILWAY_PRIVATE_DOMAIN}}:${{minio.PORT}}" }, "FILE_SIZE_LIMIT": { "isOptional": false, "description": "Maximum file upload size in bytes (52428800 = 50 MB). Increase for larger file support.", "defaultValue": "52428800" }, "STORAGE_BACKEND": { "isOptional": false, "description": "Storage backend type. 's3' uses MinIO (S3-compatible). 'file' uses local disk (not recommended for Railway).", "defaultValue": "s3" }, "GLOBAL_S3_BUCKET": { "isOptional": false, "description": "Default S3 bucket name. The bucket is created automatically on first storage API startup if it does not exist.", "defaultValue": "supabase-storage" }, "PGRST_JWT_SECRET": { "isOptional": false, "description": "HS256 secret for JWT verification. References the auth service's JWT_SECRET.", "defaultValue": "${{auth.JWT_SECRET}}" }, "SERVICE_ROLE_KEY": { "isOptional": false, "description": "Server-side full-access key. References the auth service's SERVICE_ROLE_KEY for admin storage operations.", "defaultValue": "${{auth.SERVICE_ROLE_KEY}}" }, "AWS_ACCESS_KEY_ID": { "isOptional": false, "description": "S3 access key. References the minio service's MINIO_ROOT_USER.", "defaultValue": "${{minio.MINIO_ROOT_USER}}" }, "AWS_SECRET_ACCESS_KEY": { "isOptional": false, "description": "S3 secret key. References the minio service's MINIO_ROOT_PASSWORD (auto-generated).", "defaultValue": "${{minio.MINIO_ROOT_PASSWORD}}" }, "AWS_S3_FORCE_PATH_STYLE": { "isOptional": false, "description": "Force path-style S3 addressing. Required for MinIO compatibility (not using virtual-host-style).", "defaultValue": "true" }, "FILE_STORAGE_BACKEND_PATH": { "isOptional": false, "description": "Temporary path for file processing before upload to S3.", "defaultValue": "/tmp" }, "ENABLE_IMAGE_TRANSFORMATION": { "isOptional": false, "description": "Enable image transformation (resize, optimize). Set to false to save RAM on Railway.", "defaultValue": "false" } } }, "b6b0d5f2-6f0b-44fd-93e8-e86563af6f92": { "icon": null, "name": "kong", "deploy": { "startCommand": "", "healthcheckPath": "/health", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "repo": "https://github.com/INAPP-Mobile/railway-supabase-lite", "rootDirectory": "kong" }, "variables": { "PORT": { "isOptional": false, "description": "Railway-injected port. Kong proxy listens on this port.", "defaultValue": "8080" }, "AUTH_HOST": { "isOptional": false, "description": "Private domain for the auth (GoTrue) service. Kong proxies /auth/v1/* requests here.", "defaultValue": "${{auth.RAILWAY_PRIVATE_DOMAIN}}" }, "REST_HOST": { "isOptional": false, "description": "Private domain for the rest (PostgREST) service. Kong proxies /rest/v1/* requests here.", "defaultValue": "${{rest.RAILWAY_PRIVATE_DOMAIN}}" }, "STORAGE_HOST": { "isOptional": false, "description": "Private domain for the storage service. Kong proxies /storage/v1/* requests here.", "defaultValue": "${{storage.RAILWAY_PRIVATE_DOMAIN}}" }, "REALTIME_HOST": { "isOptional": false, "description": "Private domain for the realtime service. Kong proxies /realtime/v1/* requests here.", "defaultValue": "${{realtime.RAILWAY_PRIVATE_DOMAIN}}" }, "KONG_PROXY_LISTEN": { "isOptional": false, "description": "Kong proxy listen address. Uses Railway-injected ${{PORT}} so health checks and external traffic can reach it.", "defaultValue": "0.0.0.0:${{PORT}}" } }, "networking": { "serviceDomains": { "": {} } } }, "d89183c1-dac5-45b5-adfd-375ec11c16ee": { "icon": null, "name": "minio", "deploy": { "startCommand": "minio server /data --address 0.0.0.0:8080 --console-address 0.0.0.0:9001", "healthcheckPath": "/minio/health/live", "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "minio/minio:RELEASE.2025-09-07T16-13-09Z" }, "variables": { "PORT": { "isOptional": false, "description": "Railway-injected port. Minio API listens on this port.", "defaultValue": "8080" }, "MINIO_ADDRESS": { "isOptional": false, "description": "MinIO listen address. Port 8080 matches Railway's injected PORT so health checks can reach it.", "defaultValue": "0.0.0.0:8080" }, "MINIO_ROOT_USER": { "isOptional": false, "description": "MinIO root (admin) username. Referenced by the storage service as AWS_ACCESS_KEY_ID via ${{minio.MINIO_ROOT_USER}}.", "defaultValue": "minioadmin" }, "MINIO_ROOT_PASSWORD": { "isOptional": false, "description": "MinIO root password — auto-generated at deploy time. Referenced by the storage service as AWS_SECRET_ACCESS_KEY via ${{minio.MINIO_ROOT_PASSWORD}}.", "defaultValue": "{{MINIO_ROOT_PASSWORD}}" } }, "networking": { "serviceDomains": { "": {} } }, "volumeMounts": { "d89183c1-dac5-45b5-adfd-375ec11c16ee": { "mountPath": "/data" } } } } } } } } } }, "post_deploy": { "healthcheck": { "service": "kong", "method": "GET", "path": "/health", "expect_status": 200 } }, "resources": { "expected_services": 7, "needs_volume": true }, "generated_at": "2026-09-20T16:14:49.616Z", "generator_version": "0.1.0", "status": "degraded", "validated_at": "2026-09-19T21:13:47.662Z", "success_rate_30d": 0, "validation": { "last_run_id": "run_8f73646c6ab840e7bc70", "checks": [ { "name": "workflow_completed", "passed": true }, { "name": "all_services_deployed", "passed": false, "detail": "BUILDING,BUILDING,FAILED,QUEUED,QUEUED,QUEUED,QUEUED" } ] } }