{ "manifest_version": "1.0.0", "template": { "id": "96aece68-4271-4c8d-b76c-e86523b9141d", "slug": "supabase-self-hosted-backend", "name": "Supabase Self-Hosted Backend", "description": "Postgres, auth, storage, realtime, edge functions and Studio in one stack.", "url": "https://railway.com/deploy/supabase-self-hosted-backend", "upstream": { "repo_url": "https://github.com/baranberkay96/supabase-railway" } }, "services": [ { "name": "Realtime", "source": { "image": "supabase/realtime:v2.134.10" }, "needs_volume": false, "http": false }, { "name": "Storage", "source": { "repo": "https://github.com/baranberkay96/supabase-railway" }, "needs_volume": false, "http": false }, { "name": "Functions", "source": { "repo": "https://github.com/baranberkay96/supabase-railway" }, "needs_volume": false, "http": false }, { "name": "Gateway", "source": { "repo": "https://github.com/baranberkay96/supabase-railway" }, "needs_volume": false, "http": true }, { "name": "Studio", "source": { "repo": "https://github.com/baranberkay96/supabase-railway" }, "needs_volume": true, "volume_mount_path": "/app/snippets", "http": false }, { "name": "Postgres", "source": { "repo": "https://github.com/baranberkay96/supabase-railway" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "http": false }, { "name": "Meta", "source": { "image": "supabase/postgres-meta:v0.99.0" }, "needs_volume": false, "http": false }, { "name": "Supavisor", "source": { "repo": "https://github.com/baranberkay96/supabase-railway" }, "needs_volume": false, "http": false }, { "name": "imgproxy", "source": { "image": "darthsim/imgproxy:v3.31.4" }, "needs_volume": false, "http": false }, { "name": "REST", "source": { "image": "postgrest/postgrest:v14.17" }, "needs_volume": false, "http": false }, { "name": "Auth", "source": { "image": "supabase/gotrue:v2.196.0" }, "needs_volume": false, "http": false } ], "required_inputs": [ { "key": "PORT", "service": "Realtime", "description": "Realtime port.", "secret": false, "strategy": "default", "default": "4000" }, { "key": "DB_HOST", "service": "Realtime", "description": "Postgres host (private).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "DB_NAME", "service": "Realtime", "description": "Postgres database.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DB_PORT", "service": "Realtime", "description": "Postgres port.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "DB_USER", "service": "Realtime", "description": "Realtime needs a superuser for replication slots.", "secret": false, "strategy": "default", "default": "supabase_admin" }, { "key": "APP_NAME", "service": "Realtime", "description": "Application name.", "secret": false, "strategy": "default", "default": "realtime" }, { "key": "DNS_NODES", "service": "Realtime", "description": "No clustering.", "secret": false, "strategy": "default", "default": "''" }, { "key": "DB_ENC_KEY", "service": "Realtime", "description": "Encryption key for _realtime secrets (exactly 16 chars).", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "ERL_AFLAGS", "service": "Realtime", "description": "Erlang distribution transport (single node).", "secret": false, "strategy": "default", "default": "-proto_dist inet_tcp" }, { "key": "DB_PASSWORD", "service": "Realtime", "description": "Postgres password.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "RUN_JANITOR", "service": "Realtime", "description": "Clean up stale channels/slots.", "secret": false, "strategy": "default", "default": "true" }, { "key": "RLIMIT_NOFILE", "service": "Realtime", "description": "File descriptor limit.", "secret": false, "strategy": "default", "default": "10000" }, { "key": "API_JWT_SECRET", "service": "Realtime", "description": "JWT verification secret.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SEED_SELF_HOST", "service": "Realtime", "description": "Create the self-hosted tenant (realtime-dev) on start.", "secret": false, "strategy": "default", "default": "true" }, { "key": "SECRET_KEY_BASE", "service": "Realtime", "description": "Phoenix secret key base (64+ chars).", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "METRICS_JWT_SECRET", "service": "Realtime", "description": "JWT secret for the metrics endpoint.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DB_AFTER_CONNECT_QUERY", "service": "Realtime", "description": "Realtime metadata schema.", "secret": false, "strategy": "default", "default": "SET search_path TO _realtime" }, { "key": "DISABLE_HEALTHCHECK_LOGGING", "service": "Realtime", "description": "Keep healthchecks out of the logs.", "secret": false, "strategy": "default", "default": "true" }, { "key": "PORT", "service": "Storage", "description": "Storage API port.", "secret": false, "strategy": "default", "default": "5000" }, { "key": "REGION", "service": "Storage", "description": "Bucket region.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "ANON_KEY", "service": "Storage", "description": "Pinned anon key, if any (empty = derived).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "TENANT_ID", "service": "Storage", "description": "Single-tenant id (key prefix inside the bucket).", "secret": false, "strategy": "default", "default": "stub" }, { "key": "JWT_SECRET", "service": "Storage", "description": "JWT secret (API keys are derived from it at start).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SERVER_HOST", "service": "Storage", "description": "Listen on all IPv4/IPv6 interfaces.", "secret": false, "strategy": "default", "default": "::" }, { "key": "DATABASE_URL", "service": "Storage", "description": "Storage database connection (private).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "IMGPROXY_URL", "service": "Storage", "description": "imgproxy URL (private).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGREST_URL", "service": "Storage", "description": "PostgREST URL (private).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "AUTH_JWT_SECRET", "service": "Storage", "description": "JWT verification secret.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "FILE_SIZE_LIMIT", "service": "Storage", "description": "Max upload size in bytes (50 MB).", "secret": false, "strategy": "default", "default": "52428800" }, { "key": "STORAGE_BACKEND", "service": "Storage", "description": "Store objects in the Railway Bucket.", "secret": false, "strategy": "default", "default": "s3" }, { "key": "GLOBAL_S3_BUCKET", "service": "Storage", "description": "Railway Bucket name.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SERVICE_ROLE_KEY", "service": "Storage", "description": "Pinned service_role key, if any (empty = derived).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "AWS_ACCESS_KEY_ID", "service": "Storage", "description": "Bucket access key.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "GLOBAL_S3_ENDPOINT", "service": "Storage", "description": "Railway Bucket S3 endpoint.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "STORAGE_PUBLIC_URL", "service": "Storage", "description": "Public project URL used in generated links.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "AWS_SECRET_ACCESS_KEY", "service": "Storage", "description": "Bucket secret key.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "S3_PROTOCOL_ACCESS_KEY_ID", "service": "Storage", "description": "Access key for Storage's own S3-compatible endpoint (/storage/v1/s3).", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "GLOBAL_S3_FORCE_PATH_STYLE", "service": "Storage", "description": "Virtual-hosted addressing (Railway default). Set true for buckets that require path-style.", "secret": false, "strategy": "default", "default": "false" }, { "key": "ENABLE_IMAGE_TRANSFORMATION", "service": "Storage", "description": "Image resizing via imgproxy.", "secret": false, "strategy": "default", "default": "true" }, { "key": "S3_PROTOCOL_ACCESS_KEY_SECRET", "service": "Storage", "description": "Secret for Storage's own S3-compatible endpoint.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "REQUEST_ALLOW_X_FORWARDED_PATH", "service": "Storage", "description": "Trust the gateway's X-Forwarded-Prefix.", "secret": false, "strategy": "default", "default": "true" }, { "key": "STORAGE_S3_REQUEST_CHECKSUM_CALCULATION", "service": "Storage", "description": "Only send S3 checksums when required (compatibility with S3-compatible stores).", "secret": false, "strategy": "default", "default": "WHEN_REQUIRED" }, { "key": "STORAGE_S3_RESPONSE_CHECKSUM_VALIDATION", "service": "Storage", "description": "Only validate S3 checksums when required.", "secret": false, "strategy": "default", "default": "WHEN_REQUIRED" }, { "key": "PORT", "service": "Functions", "description": "Edge runtime port.", "secret": false, "strategy": "default", "default": "9000" }, { "key": "ANON_KEY", "service": "Functions", "description": "Pinned anon key, if any (empty = derived).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "JWT_SECRET", "service": "Functions", "description": "JWT secret (keys derived at start; also used when VERIFY_JWT=true).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "VERIFY_JWT", "service": "Functions", "description": "Require a valid JWT for every function call (applies to all functions).", "secret": false, "strategy": "default", "default": "false" }, { "key": "SUPABASE_URL", "service": "Functions", "description": "Gateway URL on the private network (for supabase-js inside functions).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "SUPABASE_DB_URL", "service": "Functions", "description": "Direct database URL available to functions.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "SERVICE_ROLE_KEY", "service": "Functions", "description": "Pinned service_role key, if any (empty = derived).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SUPABASE_PUBLIC_URL", "service": "Functions", "description": "Public project URL.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SUPABASE_SECRET_KEYS", "service": "Functions", "description": "New-style secret keys (JSON). Empty value = legacy mode.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SUPABASE_PUBLISHABLE_KEYS", "service": "Functions", "description": "New-style publishable keys (JSON). Empty value = legacy mode.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PORT", "service": "Gateway", "description": "Port Envoy listens on (public domain target).", "secret": false, "strategy": "default", "default": "8000" }, { "key": "AUTH_HOST", "service": "Gateway", "description": "Private host of the Auth service.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "META_HOST", "service": "Gateway", "description": "Private host of postgres-meta.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "REST_HOST", "service": "Gateway", "description": "Private host of PostgREST.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "JWT_EXPIRY", "service": "Gateway", "description": "Access token lifetime in seconds.", "secret": false, "strategy": "default", "default": "3600" }, { "key": "JWT_SECRET", "service": "Gateway", "description": "Project JWT secret. ANON_KEY and SERVICE_ROLE_KEY are derived from it; changing it rotates both and signs everyone out.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "STUDIO_HOST", "service": "Gateway", "description": "Private host of Studio.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "STORAGE_HOST", "service": "Gateway", "description": "Private host of Storage.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "REALTIME_HOST", "service": "Gateway", "description": "Private host of Realtime.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "FUNCTIONS_HOST", "service": "Gateway", "description": "Private host of Edge Functions.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "DASHBOARD_PASSWORD", "service": "Gateway", "description": "Studio basic-auth password (generated).", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "DASHBOARD_USERNAME", "service": "Gateway", "description": "Studio basic-auth username (letters, digits, . _ -).", "secret": false, "strategy": "default", "default": "supabase" }, { "key": "SUPABASE_PUBLIC_URL", "service": "Gateway", "description": "Public URL of your Supabase project (API + Studio). Change to https://your-domain after adding a custom domain.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "PORT", "service": "Studio", "description": "Studio port (reached through the Gateway only).", "secret": false, "strategy": "default", "default": "3000" }, { "key": "ANON_KEY", "service": "Studio", "description": "Pinned anon key, if any (empty = derived).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "HOSTNAME", "service": "Studio", "description": "Listen on all IPv4/IPv6 interfaces.", "secret": false, "strategy": "default", "default": "::" }, { "key": "JWT_SECRET", "service": "Studio", "description": "JWT secret (API keys are derived from it at start).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_DB", "service": "Studio", "description": "Postgres database.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SUPABASE_URL", "service": "Studio", "description": "Gateway URL on the private network.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_HOST", "service": "Studio", "description": "Postgres host (private).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_PORT", "service": "Studio", "description": "Postgres port.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "AUTH_JWT_SECRET", "service": "Studio", "description": "JWT secret used by Studio to verify tokens.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGRST_DB_SCHEMAS", "service": "Studio", "description": "Schemas exposed by the REST API (mirrors PostgREST).", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SERVICE_ROLE_KEY", "service": "Studio", "description": "Pinned service_role key, if any (empty = derived).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGRST_DB_MAX_ROWS", "service": "Studio", "description": "Max rows per REST request (mirrors PostgREST).", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_PASSWORD", "service": "Studio", "description": "Postgres password.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PG_META_CRYPTO_KEY", "service": "Studio", "description": "Shared key for encrypted connection strings between Studio and postgres-meta.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "STUDIO_PG_META_URL", "service": "Studio", "description": "postgres-meta URL (private).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "SUPABASE_PUBLIC_URL", "service": "Studio", "description": "Public project URL.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SUPABASE_SECRET_KEY", "service": "Studio", "description": "Optional new-style secret key.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DEFAULT_PROJECT_NAME", "service": "Studio", "description": "Project name shown in Studio.", "secret": false, "strategy": "default", "default": "Default Project" }, { "key": "POSTGRES_USER_READ_WRITE", "service": "Studio", "description": "Role Studio uses for read/write queries.", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "SUPABASE_PUBLISHABLE_KEY", "service": "Studio", "description": "Optional new-style publishable key.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DEFAULT_ORGANIZATION_NAME", "service": "Studio", "description": "Organization name shown in Studio.", "secret": false, "strategy": "default", "default": "Default Organization" }, { "key": "ENABLED_FEATURES_LOGS_ALL", "service": "Studio", "description": "Logs Explorer needs Logflare + Vector, which this template does not run.", "secret": false, "strategy": "default", "default": "false" }, { "key": "PGRST_DB_EXTRA_SEARCH_PATH", "service": "Studio", "description": "Extra search_path (mirrors PostgREST).", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SNIPPETS_MANAGEMENT_FOLDER", "service": "Studio", "description": "SQL snippets folder (on the volume).", "secret": false, "strategy": "default", "default": "/app/snippets" }, { "key": "PGDATA", "service": "Postgres", "description": "Cluster directory inside the volume.", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "PGHOST", "service": "Postgres", "description": "Private host (Railway Data panel).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PGPORT", "service": "Postgres", "description": "Postgres port.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "PGUSER", "service": "Postgres", "description": "User for the Railway Data panel and app connections.", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "JWT_EXP", "service": "Postgres", "description": "JWT lifetime stored as app.settings.jwt_exp on first init.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGDATABASE", "service": "Postgres", "description": "Database for the Railway Data panel.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGPASSWORD", "service": "Postgres", "description": "Password for PGUSER.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_DB", "service": "Postgres", "description": "Main database name (Supabase expects postgres).", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "DATABASE_URL", "service": "Postgres", "description": "Direct private connection string (user postgres).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_PORT", "service": "Postgres", "description": "Port used by the image's init scripts.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "POSTGRES_USER", "service": "Postgres", "description": "Bootstrap superuser of the Supabase image. Must stay supabase_admin.", "secret": false, "strategy": "default", "default": "supabase_admin" }, { "key": "PGSODIUM_ROOT_KEY", "service": "Postgres", "description": "pgsodium/Vault root key (64 hex). Never change or lose it: Vault secrets become unreadable.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "POSTGRES_PASSWORD", "service": "Postgres", "description": "Password of supabase_admin and of every Supabase role (postgres, authenticator, supabase_auth_admin, ...). Set once: changing it later does not update the roles.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS", "service": "Postgres", "description": "Allow Postgres to shut down cleanly on redeploy.", "secret": false, "strategy": "default", "default": "60" }, { "key": "PORT", "service": "Meta", "description": "postgres-meta port.", "secret": false, "strategy": "default", "default": "8080" }, { "key": "CRYPTO_KEY", "service": "Meta", "description": "Key for encrypted connection strings (shared with Studio).", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "PG_META_HOST", "service": "Meta", "description": "Listen on all IPv4/IPv6 interfaces.", "secret": false, "strategy": "default", "default": "::" }, { "key": "PG_META_PORT", "service": "Meta", "description": "postgres-meta port.", "secret": false, "strategy": "default", "default": "8080" }, { "key": "PG_META_DB_HOST", "service": "Meta", "description": "Postgres host (private).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PG_META_DB_NAME", "service": "Meta", "description": "Postgres database.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PG_META_DB_PORT", "service": "Meta", "description": "Postgres port.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "PG_META_DB_USER", "service": "Meta", "description": "Role used by postgres-meta.", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "PG_META_DB_PASSWORD", "service": "Meta", "description": "Postgres password.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PORT", "service": "Supavisor", "description": "Supavisor HTTP API port.", "secret": false, "strategy": "default", "default": "4000" }, { "key": "REGION", "service": "Supavisor", "description": "Region label.", "secret": false, "strategy": "default", "default": "local" }, { "key": "ADDR_TYPE", "service": "Supavisor", "description": "HTTP API listens on IPv6 (dual-stack).", "secret": false, "strategy": "default", "default": "inet6" }, { "key": "ERL_AFLAGS", "service": "Supavisor", "description": "Erlang distribution transport (single node).", "secret": false, "strategy": "default", "default": "-proto_dist inet_tcp" }, { "key": "POSTGRES_DB", "service": "Supavisor", "description": "Postgres database.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "DATABASE_URL", "service": "Supavisor", "description": "Supavisor metadata database.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "DB_POOL_SIZE", "service": "Supavisor", "description": "Connections for Supavisor's own metadata.", "secret": false, "strategy": "default", "default": "5" }, { "key": "POSTGRES_HOST", "service": "Supavisor", "description": "Postgres host (private).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_PORT", "service": "Supavisor", "description": "Postgres port.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "VAULT_ENC_KEY", "service": "Supavisor", "description": "Encryption key for tenant config (exactly 32 chars).", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "API_JWT_SECRET", "service": "Supavisor", "description": "JWT secret for the management API.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SECRET_KEY_BASE", "service": "Supavisor", "description": "Phoenix secret key base.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "CLUSTER_POSTGRES", "service": "Supavisor", "description": "Store cluster state in Postgres.", "secret": false, "strategy": "default", "default": "true" }, { "key": "POOLER_POOL_MODE", "service": "Supavisor", "description": "Default pool mode.", "secret": false, "strategy": "default", "default": "transaction" }, { "key": "POOLER_TENANT_ID", "service": "Supavisor", "description": "Tenant id; pooled connections log in as postgres..", "secret": false, "strategy": "default", "default": "supabase" }, { "key": "POSTGRES_PASSWORD", "service": "Supavisor", "description": "Postgres password (pgbouncer role).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "METRICS_JWT_SECRET", "service": "Supavisor", "description": "JWT secret for metrics.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POOLER_URL_SESSION", "service": "Supavisor", "description": "Pooled connection string, session mode (private network).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POOLER_MAX_CLIENT_CONN", "service": "Supavisor", "description": "Client connections per pool.", "secret": false, "strategy": "default", "default": "100" }, { "key": "POOLER_URL_TRANSACTION", "service": "Supavisor", "description": "Pooled connection string, transaction mode (private network).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "SUPAVISOR_DB_IP_VERSION", "service": "Supavisor", "description": "Reach the metadata DB over IPv6 (works in all Railway environments).", "secret": false, "strategy": "default", "default": "ipv6" }, { "key": "POOLER_DEFAULT_POOL_SIZE", "service": "Supavisor", "description": "Server connections per pool.", "secret": false, "strategy": "default", "default": "20" }, { "key": "PORT", "service": "imgproxy", "description": "imgproxy port.", "secret": false, "strategy": "default", "default": "5001" }, { "key": "IMGPROXY_BIND", "service": "imgproxy", "description": "Listen address.", "secret": false, "strategy": "default", "default": ":5001" }, { "key": "IMGPROXY_USE_ETAG", "service": "imgproxy", "description": "Send ETags.", "secret": false, "strategy": "default", "default": "true" }, { "key": "IMGPROXY_AUTO_WEBP", "service": "imgproxy", "description": "Serve WebP when the browser supports it.", "secret": false, "strategy": "default", "default": "true" }, { "key": "IMGPROXY_MAX_SRC_RESOLUTION", "service": "imgproxy", "description": "Max source image size in megapixels.", "secret": false, "strategy": "default", "default": "16.8" }, { "key": "PORT", "service": "REST", "description": "PostgREST port.", "secret": false, "strategy": "default", "default": "3000" }, { "key": "PGRST_DB_URI", "service": "REST", "description": "Database connection as the authenticator role (private).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PGRST_DB_SCHEMAS", "service": "REST", "description": "Schemas exposed via the REST API.", "secret": false, "strategy": "default", "default": "public,graphql_public" }, { "key": "PGRST_JWT_SECRET", "service": "REST", "description": "JWT verification secret (or a JWKS when using new API keys).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGRST_DB_MAX_ROWS", "service": "REST", "description": "Max rows returned per request.", "secret": false, "strategy": "default", "default": "1000" }, { "key": "PGRST_SERVER_HOST", "service": "REST", "description": "Listen on all IPv4/IPv6 interfaces.", "secret": false, "strategy": "default", "default": "*" }, { "key": "PGRST_SERVER_PORT", "service": "REST", "description": "PostgREST port.", "secret": false, "strategy": "default", "default": "3000" }, { "key": "PGRST_DB_ANON_ROLE", "service": "REST", "description": "Role for unauthenticated requests.", "secret": false, "strategy": "default", "default": "anon" }, { "key": "PGRST_ADMIN_SERVER_HOST", "service": "REST", "description": "Admin server bind address.", "secret": false, "strategy": "default", "default": "localhost" }, { "key": "PGRST_ADMIN_SERVER_PORT", "service": "REST", "description": "Admin/health server port (container-local).", "secret": false, "strategy": "default", "default": "3001" }, { "key": "PGRST_DB_USE_LEGACY_GUCS", "service": "REST", "description": "Use current GUC names.", "secret": false, "strategy": "default", "default": "false" }, { "key": "PGRST_APP_SETTINGS_JWT_EXP", "service": "REST", "description": "JWT lifetime exposed as app.settings.jwt_exp.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGRST_DB_EXTRA_SEARCH_PATH", "service": "REST", "description": "Extra schemas on every request's search_path.", "secret": false, "strategy": "default", "default": "public" }, { "key": "PORT", "service": "Auth", "description": "Auth port.", "secret": false, "strategy": "default", "default": "9999" }, { "key": "GOTRUE_JWT_AUD", "service": "Auth", "description": "JWT audience.", "secret": false, "strategy": "default", "default": "authenticated" }, { "key": "GOTRUE_JWT_EXP", "service": "Auth", "description": "Access token lifetime (s).", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "GOTRUE_API_HOST", "service": "Auth", "description": "Listen on all IPv4/IPv6 interfaces.", "secret": false, "strategy": "default", "default": "::" }, { "key": "GOTRUE_API_PORT", "service": "Auth", "description": "Auth port.", "secret": false, "strategy": "default", "default": "9999" }, { "key": "GOTRUE_SITE_URL", "service": "Auth", "description": "Your app's URL: default redirect after sign-up/sign-in. Set this to your frontend URL.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "API_EXTERNAL_URL", "service": "Auth", "description": "Public URL of the Auth API (OAuth callbacks, email links).", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "GOTRUE_DB_DRIVER", "service": "Auth", "description": "Database driver.", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "GOTRUE_SMTP_PORT", "service": "Auth", "description": "SMTP port.", "secret": false, "strategy": "default", "default": "587" }, { "key": "GOTRUE_JWT_ISSUER", "service": "Auth", "description": "JWT issuer.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "GOTRUE_JWT_SECRET", "service": "Auth", "description": "JWT signing secret (HS256).", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "GOTRUE_DISABLE_SIGNUP", "service": "Auth", "description": "Set true to allow only invited/admin-created users.", "secret": false, "strategy": "default", "default": "false" }, { "key": "GOTRUE_DB_DATABASE_URL", "service": "Auth", "description": "Auth database connection (private).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "GOTRUE_JWT_ADMIN_ROLES", "service": "Auth", "description": "Roles allowed to use the admin API.", "secret": false, "strategy": "default", "default": "service_role" }, { "key": "GOTRUE_SMS_AUTOCONFIRM", "service": "Auth", "description": "Auto-confirm phone sign-ups.", "secret": false, "strategy": "default", "default": "false" }, { "key": "GOTRUE_SMTP_SENDER_NAME", "service": "Auth", "description": "Sender display name.", "secret": false, "strategy": "default", "default": "Supabase" }, { "key": "GOTRUE_MAILER_AUTOCONFIRM", "service": "Auth", "description": "Auto-confirm email sign-ups. Keep true until SMTP is configured, then set false to require email confirmation.", "secret": false, "strategy": "default", "default": "true" }, { "key": "GOTRUE_EXTERNAL_EMAIL_ENABLED", "service": "Auth", "description": "Enable email/password sign-in.", "secret": false, "strategy": "default", "default": "true" }, { "key": "GOTRUE_EXTERNAL_PHONE_ENABLED", "service": "Auth", "description": "Phone sign-in (needs an SMS provider; see Supabase docs).", "secret": false, "strategy": "default", "default": "false" }, { "key": "GOTRUE_JWT_DEFAULT_GROUP_NAME", "service": "Auth", "description": "Default role for signed-in users.", "secret": false, "strategy": "default", "default": "authenticated" }, { "key": "GOTRUE_MAILER_URLPATHS_INVITE", "service": "Auth", "description": "Invite link path.", "secret": false, "strategy": "default", "default": "/auth/v1/verify" }, { "key": "GOTRUE_MAILER_URLPATHS_RECOVERY", "service": "Auth", "description": "Recovery link path.", "secret": false, "strategy": "default", "default": "/auth/v1/verify" }, { "key": "GOTRUE_MAILER_URLPATHS_CONFIRMATION", "service": "Auth", "description": "Confirmation link path.", "secret": false, "strategy": "default", "default": "/auth/v1/verify" }, { "key": "GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE", "service": "Auth", "description": "Email-change link path.", "secret": false, "strategy": "default", "default": "/auth/v1/verify" }, { "key": "GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED", "service": "Auth", "description": "Enable anonymous sign-ins.", "secret": false, "strategy": "default", "default": "false" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "supabase-self-hosted-backend" } }, "cli": "railway deploy --template supabase-self-hosted-backend", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "96aece68-4271-4c8d-b76c-e86523b9141d", "serializedConfig": { "buckets": { "b1f581f2-cd41-5748-b26c-e47e87dd525b": { "name": "Bucket" } }, "services": { "082926f5-b057-5ff3-b8ca-3177a1696835": { "icon": "https://cdn.simpleicons.org/supabase/3FCF8E", "name": "Realtime", "deploy": { "healthcheckPath": "/healthcheck", "restartPolicyType": "ALWAYS", "healthcheckTimeout": 1200 }, "source": { "image": "supabase/realtime:v2.134.10" }, "variables": { "PORT": { "isOptional": true, "description": "Realtime port.", "defaultValue": "4000" }, "DB_HOST": { "isOptional": true, "description": "Postgres host (private).", "defaultValue": "${{Postgres.RAILWAY_PRIVATE_DOMAIN}}" }, "DB_NAME": { "isOptional": true, "description": "Postgres database.", "defaultValue": "${{Postgres.POSTGRES_DB}}" }, "DB_PORT": { "isOptional": true, "description": "Postgres port.", "defaultValue": "5432" }, "DB_USER": { "isOptional": true, "description": "Realtime needs a superuser for replication slots.", "defaultValue": "supabase_admin" }, "APP_NAME": { "isOptional": true, "description": "Application name.", "defaultValue": "realtime" }, "DNS_NODES": { "isOptional": true, "description": "No clustering.", "defaultValue": "''" }, "DB_ENC_KEY": { "isOptional": true, "description": "Encryption key for _realtime secrets (exactly 16 chars).", "defaultValue": "{{DB_ENC_KEY}}" }, "ERL_AFLAGS": { "isOptional": true, "description": "Erlang distribution transport (single node).", "defaultValue": "-proto_dist inet_tcp" }, "DB_PASSWORD": { "isOptional": true, "description": "Postgres password.", "defaultValue": "${{Postgres.POSTGRES_PASSWORD}}" }, "RUN_JANITOR": { "isOptional": true, "description": "Clean up stale channels/slots.", "defaultValue": "true" }, "RLIMIT_NOFILE": { "isOptional": true, "description": "File descriptor limit.", "defaultValue": "10000" }, "API_JWT_SECRET": { "isOptional": true, "description": "JWT verification secret.", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "SEED_SELF_HOST": { "isOptional": true, "description": "Create the self-hosted tenant (realtime-dev) on start.", "defaultValue": "true" }, "SECRET_KEY_BASE": { "isOptional": true, "description": "Phoenix secret key base (64+ chars).", "defaultValue": "{{SECRET_KEY_BASE}}" }, "METRICS_JWT_SECRET": { "isOptional": true, "description": "JWT secret for the metrics endpoint.", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "DB_AFTER_CONNECT_QUERY": { "isOptional": true, "description": "Realtime metadata schema.", "defaultValue": "SET search_path TO _realtime" }, "DISABLE_HEALTHCHECK_LOGGING": { "isOptional": true, "description": "Keep healthchecks out of the logs.", "defaultValue": "true" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "1146271a-afa8-5e02-b456-b58b414b041f": { "icon": "https://cdn.simpleicons.org/supabase/3FCF8E", "name": "Storage", "build": { "builder": "DOCKERFILE" }, "deploy": { "healthcheckPath": "/status", "restartPolicyType": "ALWAYS", "healthcheckTimeout": 1200 }, "source": { "repo": "baranberkay96/supabase-railway", "branch": "main", "rootDirectory": "/services/storage" }, "variables": { "PORT": { "isOptional": true, "description": "Storage API port.", "defaultValue": "5000" }, "REGION": { "isOptional": true, "description": "Bucket region.", "defaultValue": "${{Bucket.REGION}}" }, "ANON_KEY": { "isOptional": true, "description": "Pinned anon key, if any (empty = derived).", "defaultValue": "${{Gateway.ANON_KEY}}" }, "TENANT_ID": { "isOptional": true, "description": "Single-tenant id (key prefix inside the bucket).", "defaultValue": "stub" }, "JWT_SECRET": { "isOptional": true, "description": "JWT secret (API keys are derived from it at start).", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "SERVER_HOST": { "isOptional": true, "description": "Listen on all IPv4/IPv6 interfaces.", "defaultValue": "::" }, "DATABASE_URL": { "isOptional": true, "description": "Storage database connection (private).", "defaultValue": "postgres://supabase_storage_admin:${{Postgres.POSTGRES_PASSWORD}}@${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/${{Postgres.POSTGRES_DB}}" }, "IMGPROXY_URL": { "isOptional": true, "description": "imgproxy URL (private).", "defaultValue": "http://${{imgproxy.RAILWAY_PRIVATE_DOMAIN}}:5001" }, "POSTGREST_URL": { "isOptional": true, "description": "PostgREST URL (private).", "defaultValue": "http://${{REST.RAILWAY_PRIVATE_DOMAIN}}:3000" }, "AUTH_JWT_SECRET": { "isOptional": true, "description": "JWT verification secret.", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "FILE_SIZE_LIMIT": { "isOptional": true, "description": "Max upload size in bytes (50 MB).", "defaultValue": "52428800" }, "STORAGE_BACKEND": { "isOptional": true, "description": "Store objects in the Railway Bucket.", "defaultValue": "s3" }, "GLOBAL_S3_BUCKET": { "isOptional": true, "description": "Railway Bucket name.", "defaultValue": "${{Bucket.BUCKET}}" }, "SERVICE_ROLE_KEY": { "isOptional": true, "description": "Pinned service_role key, if any (empty = derived).", "defaultValue": "${{Gateway.SERVICE_ROLE_KEY}}" }, "AWS_ACCESS_KEY_ID": { "isOptional": true, "description": "Bucket access key.", "defaultValue": "${{Bucket.ACCESS_KEY_ID}}" }, "GLOBAL_S3_ENDPOINT": { "isOptional": true, "description": "Railway Bucket S3 endpoint.", "defaultValue": "${{Bucket.ENDPOINT}}" }, "STORAGE_PUBLIC_URL": { "isOptional": true, "description": "Public project URL used in generated links.", "defaultValue": "${{Gateway.SUPABASE_PUBLIC_URL}}" }, "AWS_SECRET_ACCESS_KEY": { "isOptional": true, "description": "Bucket secret key.", "defaultValue": "${{Bucket.SECRET_ACCESS_KEY}}" }, "S3_PROTOCOL_ACCESS_KEY_ID": { "isOptional": true, "description": "Access key for Storage's own S3-compatible endpoint (/storage/v1/s3).", "defaultValue": "{{S3_PROTOCOL_ACCESS_KEY_ID}}" }, "GLOBAL_S3_FORCE_PATH_STYLE": { "isOptional": true, "description": "Virtual-hosted addressing (Railway default). Set true for buckets that require path-style.", "defaultValue": "false" }, "ENABLE_IMAGE_TRANSFORMATION": { "isOptional": true, "description": "Image resizing via imgproxy.", "defaultValue": "true" }, "S3_PROTOCOL_ACCESS_KEY_SECRET": { "isOptional": true, "description": "Secret for Storage's own S3-compatible endpoint.", "defaultValue": "{{S3_PROTOCOL_ACCESS_KEY_SECRET}}" }, "REQUEST_ALLOW_X_FORWARDED_PATH": { "isOptional": true, "description": "Trust the gateway's X-Forwarded-Prefix.", "defaultValue": "true" }, "STORAGE_S3_REQUEST_CHECKSUM_CALCULATION": { "isOptional": true, "description": "Only send S3 checksums when required (compatibility with S3-compatible stores).", "defaultValue": "WHEN_REQUIRED" }, "STORAGE_S3_RESPONSE_CHECKSUM_VALIDATION": { "isOptional": true, "description": "Only validate S3 checksums when required.", "defaultValue": "WHEN_REQUIRED" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "13c0f9bd-fae2-5632-b183-7b8d609c12db": { "icon": "https://cdn.simpleicons.org/deno/70FFAF", "name": "Functions", "build": { "builder": "DOCKERFILE" }, "deploy": { "healthcheckPath": "/_internal/health", "restartPolicyType": "ON_FAILURE", "healthcheckTimeout": 300, "restartPolicyMaxRetries": 10 }, "source": { "repo": "baranberkay96/supabase-railway", "branch": "main", "rootDirectory": "/services/functions" }, "variables": { "PORT": { "isOptional": true, "description": "Edge runtime port.", "defaultValue": "9000" }, "ANON_KEY": { "isOptional": true, "description": "Pinned anon key, if any (empty = derived).", "defaultValue": "${{Gateway.ANON_KEY}}" }, "JWT_SECRET": { "isOptional": true, "description": "JWT secret (keys derived at start; also used when VERIFY_JWT=true).", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "VERIFY_JWT": { "isOptional": true, "description": "Require a valid JWT for every function call (applies to all functions).", "defaultValue": "false" }, "SUPABASE_URL": { "isOptional": true, "description": "Gateway URL on the private network (for supabase-js inside functions).", "defaultValue": "http://${{Gateway.RAILWAY_PRIVATE_DOMAIN}}:8000" }, "SUPABASE_DB_URL": { "isOptional": true, "description": "Direct database URL available to functions.", "defaultValue": "postgresql://postgres:${{Postgres.POSTGRES_PASSWORD}}@${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/${{Postgres.POSTGRES_DB}}" }, "SERVICE_ROLE_KEY": { "isOptional": true, "description": "Pinned service_role key, if any (empty = derived).", "defaultValue": "${{Gateway.SERVICE_ROLE_KEY}}" }, "SUPABASE_PUBLIC_URL": { "isOptional": true, "description": "Public project URL.", "defaultValue": "${{Gateway.SUPABASE_PUBLIC_URL}}" }, "SUPABASE_SECRET_KEYS": { "isOptional": true, "description": "New-style secret keys (JSON). Empty value = legacy mode.", "defaultValue": "{\"default\":\"${{Gateway.SUPABASE_SECRET_KEY}}\"}" }, "SUPABASE_PUBLISHABLE_KEYS": { "isOptional": true, "description": "New-style publishable keys (JSON). Empty value = legacy mode.", "defaultValue": "{\"default\":\"${{Gateway.SUPABASE_PUBLISHABLE_KEY}}\"}" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "3cbbb2ed-46cc-594b-82bd-570bece82654": { "icon": "https://cdn.simpleicons.org/envoyproxy/AC6199", "name": "Gateway", "build": { "builder": "DOCKERFILE" }, "deploy": { "healthcheckPath": "/health", "restartPolicyType": "ON_FAILURE", "healthcheckTimeout": 300, "restartPolicyMaxRetries": 10 }, "source": { "repo": "baranberkay96/supabase-railway", "branch": "main", "rootDirectory": "/services/api-gateway" }, "variables": { "PORT": { "isOptional": true, "description": "Port Envoy listens on (public domain target).", "defaultValue": "8000" }, "ANON_KEY": { "isOptional": true, "description": "Optional. Leave empty to derive the anon key from JWT_SECRET (recommended). Set only to pin an existing key.", "defaultValue": "" }, "AUTH_HOST": { "isOptional": true, "description": "Private host of the Auth service.", "defaultValue": "${{Auth.RAILWAY_PRIVATE_DOMAIN}}" }, "META_HOST": { "isOptional": true, "description": "Private host of postgres-meta.", "defaultValue": "${{Meta.RAILWAY_PRIVATE_DOMAIN}}" }, "REST_HOST": { "isOptional": true, "description": "Private host of PostgREST.", "defaultValue": "${{REST.RAILWAY_PRIVATE_DOMAIN}}" }, "JWT_EXPIRY": { "isOptional": true, "description": "Access token lifetime in seconds.", "defaultValue": "3600" }, "JWT_SECRET": { "isOptional": true, "description": "Project JWT secret. ANON_KEY and SERVICE_ROLE_KEY are derived from it; changing it rotates both and signs everyone out.", "defaultValue": "{{JWT_SECRET}}" }, "STUDIO_HOST": { "isOptional": true, "description": "Private host of Studio.", "defaultValue": "${{Studio.RAILWAY_PRIVATE_DOMAIN}}" }, "STORAGE_HOST": { "isOptional": true, "description": "Private host of Storage.", "defaultValue": "${{Storage.RAILWAY_PRIVATE_DOMAIN}}" }, "REALTIME_HOST": { "isOptional": true, "description": "Private host of Realtime.", "defaultValue": "${{Realtime.RAILWAY_PRIVATE_DOMAIN}}" }, "FUNCTIONS_HOST": { "isOptional": true, "description": "Private host of Edge Functions.", "defaultValue": "${{Functions.RAILWAY_PRIVATE_DOMAIN}}" }, "SERVICE_ROLE_KEY": { "isOptional": true, "description": "Optional. Leave empty to derive the service_role key from JWT_SECRET (recommended).", "defaultValue": "" }, "DASHBOARD_PASSWORD": { "isOptional": true, "description": "Studio basic-auth password (generated).", "defaultValue": "{{DASHBOARD_PASSWORD}}" }, "DASHBOARD_USERNAME": { "isOptional": true, "description": "Studio basic-auth username (letters, digits, . _ -).", "defaultValue": "supabase" }, "ANON_KEY_ASYMMETRIC": { "isOptional": true, "description": "Optional ES256 anon JWT used internally for sb_ key translation.", "defaultValue": "" }, "SUPABASE_PUBLIC_URL": { "isOptional": true, "description": "Public URL of your Supabase project (API + Studio). Change to https://your-domain after adding a custom domain.", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "SUPABASE_SECRET_KEY": { "isOptional": true, "description": "Optional new-style sb_secret_ key. Empty = legacy keys only.", "defaultValue": "" }, "SUPABASE_PUBLISHABLE_KEY": { "isOptional": true, "description": "Optional new-style sb_publishable_ key (see README, new API keys). Empty = legacy keys only.", "defaultValue": "" }, "SERVICE_ROLE_KEY_ASYMMETRIC": { "isOptional": true, "description": "Optional ES256 service_role JWT used internally for sb_ key translation.", "defaultValue": "" } }, "networking": { "tcpProxies": {}, "serviceDomains": { ":8000": { "port": 8000 } } } }, "8b0094d3-76d2-5711-87e2-ba32fb9549f3": { "icon": "https://cdn.simpleicons.org/supabase/3FCF8E", "name": "Studio", "build": { "builder": "DOCKERFILE" }, "deploy": { "healthcheckPath": "/api/platform/profile", "restartPolicyType": "ON_FAILURE", "healthcheckTimeout": 300, "restartPolicyMaxRetries": 10 }, "source": { "repo": "baranberkay96/supabase-railway", "branch": "main", "rootDirectory": "/services/studio" }, "variables": { "PORT": { "isOptional": true, "description": "Studio port (reached through the Gateway only).", "defaultValue": "3000" }, "ANON_KEY": { "isOptional": true, "description": "Pinned anon key, if any (empty = derived).", "defaultValue": "${{Gateway.ANON_KEY}}" }, "HOSTNAME": { "isOptional": true, "description": "Listen on all IPv4/IPv6 interfaces.", "defaultValue": "::" }, "JWT_SECRET": { "isOptional": true, "description": "JWT secret (API keys are derived from it at start).", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "POSTGRES_DB": { "isOptional": true, "description": "Postgres database.", "defaultValue": "${{Postgres.POSTGRES_DB}}" }, "SUPABASE_URL": { "isOptional": true, "description": "Gateway URL on the private network.", "defaultValue": "http://${{Gateway.RAILWAY_PRIVATE_DOMAIN}}:8000" }, "POSTGRES_HOST": { "isOptional": true, "description": "Postgres host (private).", "defaultValue": "${{Postgres.RAILWAY_PRIVATE_DOMAIN}}" }, "POSTGRES_PORT": { "isOptional": true, "description": "Postgres port.", "defaultValue": "5432" }, "OPENAI_API_KEY": { "isOptional": true, "description": "Optional. Enables the Studio AI assistant.", "defaultValue": "" }, "AUTH_JWT_SECRET": { "isOptional": true, "description": "JWT secret used by Studio to verify tokens.", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "PGRST_DB_SCHEMAS": { "isOptional": true, "description": "Schemas exposed by the REST API (mirrors PostgREST).", "defaultValue": "${{REST.PGRST_DB_SCHEMAS}}" }, "SERVICE_ROLE_KEY": { "isOptional": true, "description": "Pinned service_role key, if any (empty = derived).", "defaultValue": "${{Gateway.SERVICE_ROLE_KEY}}" }, "PGRST_DB_MAX_ROWS": { "isOptional": true, "description": "Max rows per REST request (mirrors PostgREST).", "defaultValue": "${{REST.PGRST_DB_MAX_ROWS}}" }, "POSTGRES_PASSWORD": { "isOptional": true, "description": "Postgres password.", "defaultValue": "${{Postgres.POSTGRES_PASSWORD}}" }, "PG_META_CRYPTO_KEY": { "isOptional": true, "description": "Shared key for encrypted connection strings between Studio and postgres-meta.", "defaultValue": "${{Meta.CRYPTO_KEY}}" }, "STUDIO_PG_META_URL": { "isOptional": true, "description": "postgres-meta URL (private).", "defaultValue": "http://${{Meta.RAILWAY_PRIVATE_DOMAIN}}:8080" }, "SUPABASE_PUBLIC_URL": { "isOptional": true, "description": "Public project URL.", "defaultValue": "${{Gateway.SUPABASE_PUBLIC_URL}}" }, "SUPABASE_SECRET_KEY": { "isOptional": true, "description": "Optional new-style secret key.", "defaultValue": "${{Gateway.SUPABASE_SECRET_KEY}}" }, "DEFAULT_PROJECT_NAME": { "isOptional": true, "description": "Project name shown in Studio.", "defaultValue": "Default Project" }, "POSTGRES_USER_READ_WRITE": { "isOptional": true, "description": "Role Studio uses for read/write queries.", "defaultValue": "postgres" }, "SUPABASE_PUBLISHABLE_KEY": { "isOptional": true, "description": "Optional new-style publishable key.", "defaultValue": "${{Gateway.SUPABASE_PUBLISHABLE_KEY}}" }, "DEFAULT_ORGANIZATION_NAME": { "isOptional": true, "description": "Organization name shown in Studio.", "defaultValue": "Default Organization" }, "ENABLED_FEATURES_LOGS_ALL": { "isOptional": true, "description": "Logs Explorer needs Logflare + Vector, which this template does not run.", "defaultValue": "false" }, "PGRST_DB_EXTRA_SEARCH_PATH": { "isOptional": true, "description": "Extra search_path (mirrors PostgREST).", "defaultValue": "${{REST.PGRST_DB_EXTRA_SEARCH_PATH}}" }, "SNIPPETS_MANAGEMENT_FOLDER": { "isOptional": true, "description": "SQL snippets folder (on the volume).", "defaultValue": "/app/snippets" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} }, "volumeMounts": { "f9f03cea-50ea-5934-ba4b-7a88efc63e7c": { "mountPath": "/app/snippets" } } }, "c638813e-d044-5f63-8965-a2be6f1bf7e4": { "icon": "https://devicons.railway.app/i/postgresql.svg", "name": "Postgres", "build": { "builder": "DOCKERFILE" }, "deploy": { "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "repo": "baranberkay96/supabase-railway", "branch": "main", "rootDirectory": "/services/postgres" }, "variables": { "PGDATA": { "isOptional": true, "description": "Cluster directory inside the volume.", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "PGHOST": { "isOptional": true, "description": "Private host (Railway Data panel).", "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}" }, "PGPORT": { "isOptional": true, "description": "Postgres port.", "defaultValue": "5432" }, "PGUSER": { "isOptional": true, "description": "User for the Railway Data panel and app connections.", "defaultValue": "postgres" }, "JWT_EXP": { "isOptional": true, "description": "JWT lifetime stored as app.settings.jwt_exp on first init.", "defaultValue": "${{Gateway.JWT_EXPIRY}}" }, "PGDATABASE": { "isOptional": true, "description": "Database for the Railway Data panel.", "defaultValue": "${{POSTGRES_DB}}" }, "PGPASSWORD": { "isOptional": true, "description": "Password for PGUSER.", "defaultValue": "${{POSTGRES_PASSWORD}}" }, "POSTGRES_DB": { "isOptional": true, "description": "Main database name (Supabase expects postgres).", "defaultValue": "postgres" }, "DATABASE_URL": { "isOptional": true, "description": "Direct private connection string (user postgres).", "defaultValue": "postgresql://postgres:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{POSTGRES_DB}}" }, "POSTGRES_PORT": { "isOptional": true, "description": "Port used by the image's init scripts.", "defaultValue": "5432" }, "POSTGRES_USER": { "isOptional": true, "description": "Bootstrap superuser of the Supabase image. Must stay supabase_admin.", "defaultValue": "supabase_admin" }, "PGSODIUM_ROOT_KEY": { "isOptional": true, "description": "pgsodium/Vault root key (64 hex). Never change or lose it: Vault secrets become unreadable.", "defaultValue": "{{PGSODIUM_ROOT_KEY}}" }, "POSTGRES_PASSWORD": { "isOptional": true, "description": "Password of supabase_admin and of every Supabase role (postgres, authenticator, supabase_auth_admin, ...). Set once: changing it later does not update the roles.", "defaultValue": "{{POSTGRES_PASSWORD}}" }, "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": { "isOptional": true, "description": "Allow Postgres to shut down cleanly on redeploy.", "defaultValue": "60" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} }, "volumeMounts": { "81081dd8-37c8-556e-a9ae-467434cfc98d": { "mountPath": "/var/lib/postgresql/data" } } }, "d42c2e8a-9f17-519b-93f8-b41755537ead": { "icon": "https://cdn.simpleicons.org/postgresql/4169E1", "name": "Meta", "deploy": { "healthcheckPath": "/health", "restartPolicyType": "ON_FAILURE", "healthcheckTimeout": 120, "restartPolicyMaxRetries": 10 }, "source": { "image": "supabase/postgres-meta:v0.99.0" }, "variables": { "PORT": { "isOptional": true, "description": "postgres-meta port.", "defaultValue": "8080" }, "CRYPTO_KEY": { "isOptional": true, "description": "Key for encrypted connection strings (shared with Studio).", "defaultValue": "{{CRYPTO_KEY}}" }, "PG_META_HOST": { "isOptional": true, "description": "Listen on all IPv4/IPv6 interfaces.", "defaultValue": "::" }, "PG_META_PORT": { "isOptional": true, "description": "postgres-meta port.", "defaultValue": "8080" }, "PG_META_DB_HOST": { "isOptional": true, "description": "Postgres host (private).", "defaultValue": "${{Postgres.RAILWAY_PRIVATE_DOMAIN}}" }, "PG_META_DB_NAME": { "isOptional": true, "description": "Postgres database.", "defaultValue": "${{Postgres.POSTGRES_DB}}" }, "PG_META_DB_PORT": { "isOptional": true, "description": "Postgres port.", "defaultValue": "5432" }, "PG_META_DB_USER": { "isOptional": true, "description": "Role used by postgres-meta.", "defaultValue": "postgres" }, "PG_META_DB_PASSWORD": { "isOptional": true, "description": "Postgres password.", "defaultValue": "${{Postgres.POSTGRES_PASSWORD}}" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "de83d199-c401-5805-84f9-569a8fdbc6e7": { "icon": "https://devicons.railway.app/i/postgresql.svg", "name": "Supavisor", "build": { "builder": "DOCKERFILE" }, "deploy": { "healthcheckPath": "/api/health", "restartPolicyType": "ON_FAILURE", "healthcheckTimeout": 300, "restartPolicyMaxRetries": 10 }, "source": { "repo": "baranberkay96/supabase-railway", "branch": "main", "rootDirectory": "/services/supavisor" }, "variables": { "PORT": { "isOptional": true, "description": "Supavisor HTTP API port.", "defaultValue": "4000" }, "REGION": { "isOptional": true, "description": "Region label.", "defaultValue": "local" }, "ADDR_TYPE": { "isOptional": true, "description": "HTTP API listens on IPv6 (dual-stack).", "defaultValue": "inet6" }, "ERL_AFLAGS": { "isOptional": true, "description": "Erlang distribution transport (single node).", "defaultValue": "-proto_dist inet_tcp" }, "POSTGRES_DB": { "isOptional": true, "description": "Postgres database.", "defaultValue": "${{Postgres.POSTGRES_DB}}" }, "DATABASE_URL": { "isOptional": true, "description": "Supavisor metadata database.", "defaultValue": "ecto://supabase_admin:${{Postgres.POSTGRES_PASSWORD}}@${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/_supabase" }, "DB_POOL_SIZE": { "isOptional": true, "description": "Connections for Supavisor's own metadata.", "defaultValue": "5" }, "POSTGRES_HOST": { "isOptional": true, "description": "Postgres host (private).", "defaultValue": "${{Postgres.RAILWAY_PRIVATE_DOMAIN}}" }, "POSTGRES_PORT": { "isOptional": true, "description": "Postgres port.", "defaultValue": "5432" }, "VAULT_ENC_KEY": { "isOptional": true, "description": "Encryption key for tenant config (exactly 32 chars).", "defaultValue": "{{VAULT_ENC_KEY}}" }, "API_JWT_SECRET": { "isOptional": true, "description": "JWT secret for the management API.", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "SECRET_KEY_BASE": { "isOptional": true, "description": "Phoenix secret key base.", "defaultValue": "{{SECRET_KEY_BASE}}" }, "CLUSTER_POSTGRES": { "isOptional": true, "description": "Store cluster state in Postgres.", "defaultValue": "true" }, "POOLER_POOL_MODE": { "isOptional": true, "description": "Default pool mode.", "defaultValue": "transaction" }, "POOLER_TENANT_ID": { "isOptional": true, "description": "Tenant id; pooled connections log in as postgres..", "defaultValue": "supabase" }, "POSTGRES_PASSWORD": { "isOptional": true, "description": "Postgres password (pgbouncer role).", "defaultValue": "${{Postgres.POSTGRES_PASSWORD}}" }, "METRICS_JWT_SECRET": { "isOptional": true, "description": "JWT secret for metrics.", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "POOLER_URL_SESSION": { "isOptional": true, "description": "Pooled connection string, session mode (private network).", "defaultValue": "postgresql://postgres.${{POOLER_TENANT_ID}}:${{Postgres.POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{Postgres.POSTGRES_DB}}" }, "POOLER_MAX_CLIENT_CONN": { "isOptional": true, "description": "Client connections per pool.", "defaultValue": "100" }, "POOLER_URL_TRANSACTION": { "isOptional": true, "description": "Pooled connection string, transaction mode (private network).", "defaultValue": "postgresql://postgres.${{POOLER_TENANT_ID}}:${{Postgres.POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:6543/${{Postgres.POSTGRES_DB}}" }, "SUPAVISOR_DB_IP_VERSION": { "isOptional": true, "description": "Reach the metadata DB over IPv6 (works in all Railway environments).", "defaultValue": "ipv6" }, "POOLER_DEFAULT_POOL_SIZE": { "isOptional": true, "description": "Server connections per pool.", "defaultValue": "20" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "f35a3e10-44a8-5a3f-ad9b-21b0f627cef2": { "icon": "https://github.com/imgproxy.png", "name": "imgproxy", "deploy": { "healthcheckPath": "/health", "restartPolicyType": "ON_FAILURE", "healthcheckTimeout": 120, "restartPolicyMaxRetries": 10 }, "source": { "image": "darthsim/imgproxy:v3.31.4" }, "variables": { "PORT": { "isOptional": true, "description": "imgproxy port.", "defaultValue": "5001" }, "IMGPROXY_BIND": { "isOptional": true, "description": "Listen address.", "defaultValue": ":5001" }, "IMGPROXY_USE_ETAG": { "isOptional": true, "description": "Send ETags.", "defaultValue": "true" }, "IMGPROXY_AUTO_WEBP": { "isOptional": true, "description": "Serve WebP when the browser supports it.", "defaultValue": "true" }, "IMGPROXY_MAX_SRC_RESOLUTION": { "isOptional": true, "description": "Max source image size in megapixels.", "defaultValue": "16.8" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "f7782d09-e915-5e54-944b-4a2eaf563aaf": { "icon": "https://avatars.githubusercontent.com/u/15115011", "name": "REST", "deploy": { "healthcheckPath": "/", "restartPolicyType": "ALWAYS", "healthcheckTimeout": 1200 }, "source": { "image": "postgrest/postgrest:v14.17" }, "variables": { "PORT": { "isOptional": true, "description": "PostgREST port.", "defaultValue": "3000" }, "PGRST_DB_URI": { "isOptional": true, "description": "Database connection as the authenticator role (private).", "defaultValue": "postgres://authenticator:${{Postgres.POSTGRES_PASSWORD}}@${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/${{Postgres.POSTGRES_DB}}" }, "PGRST_DB_SCHEMAS": { "isOptional": true, "description": "Schemas exposed via the REST API.", "defaultValue": "public,graphql_public" }, "PGRST_JWT_SECRET": { "isOptional": true, "description": "JWT verification secret (or a JWKS when using new API keys).", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "PGRST_DB_MAX_ROWS": { "isOptional": true, "description": "Max rows returned per request.", "defaultValue": "1000" }, "PGRST_SERVER_HOST": { "isOptional": true, "description": "Listen on all IPv4/IPv6 interfaces.", "defaultValue": "*" }, "PGRST_SERVER_PORT": { "isOptional": true, "description": "PostgREST port.", "defaultValue": "3000" }, "PGRST_DB_ANON_ROLE": { "isOptional": true, "description": "Role for unauthenticated requests.", "defaultValue": "anon" }, "PGRST_ADMIN_SERVER_HOST": { "isOptional": true, "description": "Admin server bind address.", "defaultValue": "localhost" }, "PGRST_ADMIN_SERVER_PORT": { "isOptional": true, "description": "Admin/health server port (container-local).", "defaultValue": "3001" }, "PGRST_DB_USE_LEGACY_GUCS": { "isOptional": true, "description": "Use current GUC names.", "defaultValue": "false" }, "PGRST_APP_SETTINGS_JWT_EXP": { "isOptional": true, "description": "JWT lifetime exposed as app.settings.jwt_exp.", "defaultValue": "${{Gateway.JWT_EXPIRY}}" }, "PGRST_DB_EXTRA_SEARCH_PATH": { "isOptional": true, "description": "Extra schemas on every request's search_path.", "defaultValue": "public" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "ff3943d7-5711-52ce-8e10-bf88761049b0": { "icon": "https://cdn.simpleicons.org/supabase/3FCF8E", "name": "Auth", "deploy": { "healthcheckPath": "/health", "restartPolicyType": "ALWAYS", "healthcheckTimeout": 1200 }, "source": { "image": "supabase/gotrue:v2.196.0" }, "variables": { "PORT": { "isOptional": true, "description": "Auth port.", "defaultValue": "9999" }, "GOTRUE_JWT_AUD": { "isOptional": true, "description": "JWT audience.", "defaultValue": "authenticated" }, "GOTRUE_JWT_EXP": { "isOptional": true, "description": "Access token lifetime (s).", "defaultValue": "${{Gateway.JWT_EXPIRY}}" }, "GOTRUE_API_HOST": { "isOptional": true, "description": "Listen on all IPv4/IPv6 interfaces.", "defaultValue": "::" }, "GOTRUE_API_PORT": { "isOptional": true, "description": "Auth port.", "defaultValue": "9999" }, "GOTRUE_SITE_URL": { "isOptional": true, "description": "Your app's URL: default redirect after sign-up/sign-in. Set this to your frontend URL.", "defaultValue": "${{Gateway.SUPABASE_PUBLIC_URL}}" }, "API_EXTERNAL_URL": { "isOptional": true, "description": "Public URL of the Auth API (OAuth callbacks, email links).", "defaultValue": "${{Gateway.SUPABASE_PUBLIC_URL}}/auth/v1" }, "GOTRUE_DB_DRIVER": { "isOptional": true, "description": "Database driver.", "defaultValue": "postgres" }, "GOTRUE_SMTP_HOST": { "isOptional": true, "description": "SMTP host for confirmation/recovery emails. Empty = auth emails are not delivered.", "defaultValue": "" }, "GOTRUE_SMTP_PASS": { "isOptional": true, "description": "SMTP password.", "defaultValue": "" }, "GOTRUE_SMTP_PORT": { "isOptional": true, "description": "SMTP port.", "defaultValue": "587" }, "GOTRUE_SMTP_USER": { "isOptional": true, "description": "SMTP username.", "defaultValue": "" }, "GOTRUE_JWT_ISSUER": { "isOptional": true, "description": "JWT issuer.", "defaultValue": "${{API_EXTERNAL_URL}}" }, "GOTRUE_JWT_SECRET": { "isOptional": true, "description": "JWT signing secret (HS256).", "defaultValue": "${{Gateway.JWT_SECRET}}" }, "GOTRUE_DISABLE_SIGNUP": { "isOptional": true, "description": "Set true to allow only invited/admin-created users.", "defaultValue": "false" }, "GOTRUE_URI_ALLOW_LIST": { "isOptional": true, "description": "Comma-separated extra redirect URLs allowed after auth (e.g. http://localhost:3000/**).", "defaultValue": "" }, "GOTRUE_DB_DATABASE_URL": { "isOptional": true, "description": "Auth database connection (private).", "defaultValue": "postgres://supabase_auth_admin:${{Postgres.POSTGRES_PASSWORD}}@${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/${{Postgres.POSTGRES_DB}}" }, "GOTRUE_JWT_ADMIN_ROLES": { "isOptional": true, "description": "Roles allowed to use the admin API.", "defaultValue": "service_role" }, "GOTRUE_SMS_AUTOCONFIRM": { "isOptional": true, "description": "Auto-confirm phone sign-ups.", "defaultValue": "false" }, "GOTRUE_SMTP_ADMIN_EMAIL": { "isOptional": true, "description": "Sender address for auth emails (needed once SMTP is configured).", "defaultValue": "" }, "GOTRUE_SMTP_SENDER_NAME": { "isOptional": true, "description": "Sender display name.", "defaultValue": "Supabase" }, "GOTRUE_MAILER_AUTOCONFIRM": { "isOptional": true, "description": "Auto-confirm email sign-ups. Keep true until SMTP is configured, then set false to require email confirmation.", "defaultValue": "true" }, "GOTRUE_EXTERNAL_EMAIL_ENABLED": { "isOptional": true, "description": "Enable email/password sign-in.", "defaultValue": "true" }, "GOTRUE_EXTERNAL_PHONE_ENABLED": { "isOptional": true, "description": "Phone sign-in (needs an SMS provider; see Supabase docs).", "defaultValue": "false" }, "GOTRUE_JWT_DEFAULT_GROUP_NAME": { "isOptional": true, "description": "Default role for signed-in users.", "defaultValue": "authenticated" }, "GOTRUE_MAILER_URLPATHS_INVITE": { "isOptional": true, "description": "Invite link path.", "defaultValue": "/auth/v1/verify" }, "GOTRUE_MAILER_URLPATHS_RECOVERY": { "isOptional": true, "description": "Recovery link path.", "defaultValue": "/auth/v1/verify" }, "GOTRUE_MAILER_URLPATHS_CONFIRMATION": { "isOptional": true, "description": "Confirmation link path.", "defaultValue": "/auth/v1/verify" }, "GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE": { "isOptional": true, "description": "Email-change link path.", "defaultValue": "/auth/v1/verify" }, "GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED": { "isOptional": true, "description": "Enable anonymous sign-ins.", "defaultValue": "false" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } } } } } } } } }, "post_deploy": { "healthcheck": { "service": "Gateway", "method": "GET", "path": "/health", "expect_status": 200 } }, "resources": { "expected_services": 11, "needs_volume": true }, "generated_at": "2026-10-11T16:14:40.554Z", "generator_version": "0.1.0", "status": "degraded", "validated_at": "2026-10-11T14:38:41.413Z", "success_rate_30d": 0, "validation": { "last_run_id": "run_35f8f0478a6b467d98fb", "checks": [ { "name": "workflow_completed", "passed": false, "detail": "Your workspace has been restricted. Please contact support to resolve this." } ] } }