{ "manifest_version": "1.0.0", "template": { "id": "08084d92-fe7c-4fc3-a793-eaa3ada2e580", "slug": "windmill-v1-scripts-flows-and-internal-a", "name": "Windmill v1 Scripts, Flows and Internal Apps", "description": "Turn Python and TS scripts into workflows, UIs and cron jobs with workers.", "url": "https://railway.com/deploy/windmill-v1-scripts-flows-and-internal-a", "upstream": { "repo_url": "https://github.com/baranberkay96/windmill-railway" } }, "services": [ { "name": "Windmill Extra", "source": { "image": "ghcr.io/windmill-labs/windmill-extra:1.830.0" }, "needs_volume": false, "http": false }, { "name": "Windmill", "source": { "image": "ghcr.io/windmill-labs/windmill:1.830.0" }, "needs_volume": false, "http": false }, { "name": "Windmill Native Worker", "source": { "image": "ghcr.io/windmill-labs/windmill:1.830.0" }, "needs_volume": false, "http": false }, { "name": "Admin Bootstrap", "source": { "repo": "https://github.com/baranberkay96/windmill-railway" }, "needs_volume": false, "http": false }, { "name": "Postgres", "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:18" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "http": false }, { "name": "Windmill Worker", "source": { "image": "ghcr.io/windmill-labs/windmill:1.830.0" }, "needs_volume": false, "http": false }, { "name": "Proxy", "source": { "repo": "https://github.com/baranberkay96/windmill-railway" }, "needs_volume": false, "http": true } ], "required_inputs": [ { "key": "PORT", "service": "Windmill Extra", "description": "Gateway port; Railway healthchecks /health here (forwarded to the LSP).", "secret": false, "strategy": "default", "default": "3000" }, { "key": "ENABLE_LSP", "service": "Windmill Extra", "description": "Language servers for editor autocompletion and diagnostics (Python, TS, Go, Bash).", "secret": false, "strategy": "default", "default": "true" }, { "key": "GATEWAY_HOST", "service": "Windmill Extra", "description": "Bind the gateway on all IPv6/IPv4 interfaces for the private network.", "secret": false, "strategy": "default", "default": "::" }, { "key": "GATEWAY_PORT", "service": "Windmill Extra", "description": "Port of the built-in gateway that fans out /ws/*, /ws_debug/*, /ws_mp/*.", "secret": false, "strategy": "default", "default": "3000" }, { "key": "ENABLE_NSJAIL", "service": "Windmill Extra", "description": "nsjail for debug sessions needs privileged containers, which Railway does not offer.", "secret": false, "strategy": "default", "default": "false" }, { "key": "ENABLE_DEBUGGER", "service": "Windmill Extra", "description": "Step-through debugger for scripts in the editor (upstream compose default).", "secret": false, "strategy": "default", "default": "true" }, { "key": "WINDMILL_BASE_URL", "service": "Windmill Extra", "description": "Private URL of the Windmill server; the debugger fetches its signing keys from it.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "ENABLE_MULTIPLAYER", "service": "Windmill Extra", "description": "Real-time co-editing; Enterprise Edition only, so off.", "secret": false, "strategy": "default", "default": "false" }, { "key": "DEBUG_ALLOWED_ORIGINS", "service": "Windmill Extra", "description": "Browser origins allowed to open debugger websockets; add your custom domain here if you add one.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "REQUIRE_SIGNED_DEBUG_REQUESTS", "service": "Windmill Extra", "description": "Only accept debug sessions signed by the Windmill server. Never set to false on a public deployment.", "secret": false, "strategy": "default", "default": "true" }, { "key": "MODE", "service": "Windmill", "description": "Runs the API server and UI only; jobs run on the worker services.", "secret": false, "strategy": "default", "default": "server" }, { "key": "PORT", "service": "Windmill", "description": "HTTP port of the Windmill server (Proxy and healthcheck use it).", "secret": false, "strategy": "default", "default": "8000" }, { "key": "BASE_URL", "service": "Windmill", "description": "Public URL of the instance; Instance settings > Base URL overrides it once saved.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "RUST_LOG", "service": "Windmill", "description": "Log level of the Windmill server.", "secret": false, "strategy": "default", "default": "info" }, { "key": "DATABASE_URL", "service": "Windmill", "description": "Postgres connection string over the private network (TLS off, as in upstream .env).", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "SERVER_BIND_ADDR", "service": "Windmill", "description": "Bind on all IPv6/IPv4 interfaces so the Railway private network can reach the server.", "secret": false, "strategy": "default", "default": "::" }, { "key": "MODE", "service": "Windmill Native Worker", "description": "Runs a job worker only (no API server).", "secret": false, "strategy": "default", "default": "worker" }, { "key": "BASE_URL", "service": "Windmill Native Worker", "description": "Public URL used in links that jobs generate.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "RUST_LOG", "service": "Windmill Native Worker", "description": "Log level of the native worker.", "secret": false, "strategy": "default", "default": "info" }, { "key": "NATIVE_MODE", "service": "Windmill Native Worker", "description": "Native mode: forces 8 workers per replica and accepts native jobs only (upstream compose setting).", "secret": false, "strategy": "default", "default": "true" }, { "key": "SLEEP_QUEUE", "service": "Windmill Native Worker", "description": "Milliseconds between queue polls, multiplied by worker count (upstream compose value).", "secret": false, "strategy": "default", "default": "200" }, { "key": "DATABASE_URL", "service": "Windmill Native Worker", "description": "Postgres connection string over the private network.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "WORKER_GROUP", "service": "Windmill Native Worker", "description": "Worker group for lightweight in-process jobs (native TS, SQL queries, HTTP calls).", "secret": false, "strategy": "default", "default": "native" }, { "key": "WINDMILL_ADMIN_EMAIL", "service": "Admin Bootstrap", "description": "Seeded superadmin account whose default password the job replaces.", "secret": false, "strategy": "default", "default": "admin@windmill.dev" }, { "key": "WINDMILL_INTERNAL_URL", "service": "Admin Bootstrap", "description": "Private URL of the Windmill server used by this one-shot job.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "BOOTSTRAP_WAIT_SECONDS", "service": "Admin Bootstrap", "description": "How long the job waits for the server (first boot runs all database migrations).", "secret": false, "strategy": "default", "default": "900" }, { "key": "WINDMILL_ADMIN_PASSWORD", "service": "Admin Bootstrap", "description": "Generated first-login password for admin@windmill.dev. Change it after your first login.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "PGDATA", "service": "Postgres", "description": "Location where the database will be initialized", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "PGHOST", "service": "Postgres", "description": "Railway Private Domain Name.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PGPORT", "service": "Postgres", "description": "Port to connect to Postgres.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "PGUSER", "service": "Postgres", "description": "Required variable for Data panel", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGDATABASE", "service": "Postgres", "description": "Required variable for the data panel.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGPASSWORD", "service": "Postgres", "description": "Required variable for Data panel", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_DB", "service": "Postgres", "description": "Default database created when image is started.", "secret": false, "strategy": "default", "default": "railway" }, { "key": "DATABASE_URL", "service": "Postgres", "description": "URL to connect to Postgres database.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_USER", "service": "Postgres", "description": "User to connect to Postgres DB", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "SSL_CERT_DAYS", "service": "Postgres", "description": "SSL certificate expiry in days.", "secret": false, "strategy": "default", "default": "820" }, { "key": "POSTGRES_PASSWORD", "service": "Postgres", "description": "Password to connect to DB", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS", "service": "Postgres", "description": "Allow Postgres to cleanly shut down", "secret": false, "strategy": "default", "default": "60" }, { "key": "MODE", "service": "Windmill Worker", "description": "Runs a job worker only (no API server).", "secret": false, "strategy": "default", "default": "worker" }, { "key": "BASE_URL", "service": "Windmill Worker", "description": "Public URL used in links that jobs generate (e.g. approval/resume URLs).", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "RUST_LOG", "service": "Windmill Worker", "description": "Log level of the worker.", "secret": false, "strategy": "default", "default": "info" }, { "key": "NUM_WORKERS", "service": "Windmill Worker", "description": "Workers per replica; Windmill forces 1 outside native mode. Scale with replicas instead.", "secret": false, "strategy": "default", "default": "1" }, { "key": "DATABASE_URL", "service": "Windmill Worker", "description": "Postgres connection string over the private network (the queue lives in Postgres).", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "WORKER_GROUP", "service": "Windmill Worker", "description": "Worker group whose tags and settings (Workers page) this service pulls; runs Python, TS, Bash, Go and other jobs.", "secret": false, "strategy": "default", "default": "default" }, { "key": "FAVOR_UNSHARE_PID", "service": "Windmill Worker", "description": "Upstream default: PID-namespace isolation per job; Windmill logs a warning and runs unisolated if the container does not allow it.", "secret": false, "strategy": "default", "default": "true" }, { "key": "PORT", "service": "Proxy", "description": "Port Caddy listens on; the public domain and the healthcheck target it.", "secret": false, "strategy": "default", "default": "8080" }, { "key": "WINDMILL_EXTRA_UPSTREAM", "service": "Proxy", "description": "Private address of the windmill-extra gateway; receives /ws/*, /ws_debug/* and /ws_mp/*.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "WINDMILL_SERVER_UPSTREAM", "service": "Proxy", "description": "Private address of the Windmill server; receives every path except the editor websockets.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "windmill-v1-scripts-flows-and-internal-a" } }, "cli": "railway deploy --template windmill-v1-scripts-flows-and-internal-a", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "08084d92-fe7c-4fc3-a793-eaa3ada2e580", "serializedConfig": { "buckets": {}, "services": { "115bb00a-2cf2-50c9-a7a6-209c708bd77b": { "icon": "https://avatars.githubusercontent.com/u/98025271?v=4", "name": "Windmill Extra", "deploy": { "healthcheckPath": "/health", "restartPolicyType": "ALWAYS", "healthcheckTimeout": 300 }, "source": { "image": "ghcr.io/windmill-labs/windmill-extra:1.830.0" }, "variables": { "PORT": { "isOptional": true, "description": "Gateway port; Railway healthchecks /health here (forwarded to the LSP).", "defaultValue": "3000" }, "ENABLE_LSP": { "isOptional": true, "description": "Language servers for editor autocompletion and diagnostics (Python, TS, Go, Bash).", "defaultValue": "true" }, "GATEWAY_HOST": { "isOptional": true, "description": "Bind the gateway on all IPv6/IPv4 interfaces for the private network.", "defaultValue": "::" }, "GATEWAY_PORT": { "isOptional": true, "description": "Port of the built-in gateway that fans out /ws/*, /ws_debug/*, /ws_mp/*.", "defaultValue": "3000" }, "ENABLE_NSJAIL": { "isOptional": true, "description": "nsjail for debug sessions needs privileged containers, which Railway does not offer.", "defaultValue": "false" }, "ENABLE_DEBUGGER": { "isOptional": true, "description": "Step-through debugger for scripts in the editor (upstream compose default).", "defaultValue": "true" }, "WINDMILL_BASE_URL": { "isOptional": true, "description": "Private URL of the Windmill server; the debugger fetches its signing keys from it.", "defaultValue": "http://${{Windmill.RAILWAY_PRIVATE_DOMAIN}}:${{Windmill.PORT}}" }, "ENABLE_MULTIPLAYER": { "isOptional": true, "description": "Real-time co-editing; Enterprise Edition only, so off.", "defaultValue": "false" }, "DEBUG_ALLOWED_ORIGINS": { "isOptional": true, "description": "Browser origins allowed to open debugger websockets; add your custom domain here if you add one.", "defaultValue": "https://${{Proxy.RAILWAY_PUBLIC_DOMAIN}}" }, "REQUIRE_SIGNED_DEBUG_REQUESTS": { "isOptional": true, "description": "Only accept debug sessions signed by the Windmill server. Never set to false on a public deployment.", "defaultValue": "true" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "20768d19-ca71-5df6-9f3a-e7b892aa7e78": { "icon": "https://avatars.githubusercontent.com/u/98025271?v=4", "name": "Windmill", "deploy": { "healthcheckPath": "/api/health/status", "restartPolicyType": "ALWAYS", "healthcheckTimeout": 600 }, "source": { "image": "ghcr.io/windmill-labs/windmill:1.830.0" }, "variables": { "MODE": { "isOptional": true, "description": "Runs the API server and UI only; jobs run on the worker services.", "defaultValue": "server" }, "PORT": { "isOptional": true, "description": "HTTP port of the Windmill server (Proxy and healthcheck use it).", "defaultValue": "8000" }, "BASE_URL": { "isOptional": true, "description": "Public URL of the instance; Instance settings > Base URL overrides it once saved.", "defaultValue": "https://${{Proxy.RAILWAY_PUBLIC_DOMAIN}}" }, "RUST_LOG": { "isOptional": true, "description": "Log level of the Windmill server.", "defaultValue": "info" }, "DATABASE_URL": { "isOptional": true, "description": "Postgres connection string over the private network (TLS off, as in upstream .env).", "defaultValue": "${{Postgres.DATABASE_URL}}?sslmode=disable" }, "SERVER_BIND_ADDR": { "isOptional": true, "description": "Bind on all IPv6/IPv4 interfaces so the Railway private network can reach the server.", "defaultValue": "::" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "55658b9a-f4e0-5100-b241-92a5b41387da": { "icon": "https://avatars.githubusercontent.com/u/98025271?v=4", "name": "Windmill Native Worker", "deploy": { "restartPolicyType": "ALWAYS" }, "source": { "image": "ghcr.io/windmill-labs/windmill:1.830.0" }, "variables": { "MODE": { "isOptional": true, "description": "Runs a job worker only (no API server).", "defaultValue": "worker" }, "BASE_URL": { "isOptional": true, "description": "Public URL used in links that jobs generate.", "defaultValue": "https://${{Proxy.RAILWAY_PUBLIC_DOMAIN}}" }, "RUST_LOG": { "isOptional": true, "description": "Log level of the native worker.", "defaultValue": "info" }, "NATIVE_MODE": { "isOptional": true, "description": "Native mode: forces 8 workers per replica and accepts native jobs only (upstream compose setting).", "defaultValue": "true" }, "SLEEP_QUEUE": { "isOptional": true, "description": "Milliseconds between queue polls, multiplied by worker count (upstream compose value).", "defaultValue": "200" }, "DATABASE_URL": { "isOptional": true, "description": "Postgres connection string over the private network.", "defaultValue": "${{Postgres.DATABASE_URL}}?sslmode=disable" }, "WORKER_GROUP": { "isOptional": true, "description": "Worker group for lightweight in-process jobs (native TS, SQL queries, HTTP calls).", "defaultValue": "native" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "7fbed885-076e-58b9-bf0a-3cb548684879": { "icon": "https://avatars.githubusercontent.com/u/98025271?v=4", "name": "Admin Bootstrap", "build": { "builder": "DOCKERFILE" }, "deploy": { "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "repo": "baranberkay96/windmill-railway", "branch": "main", "rootDirectory": "/services/admin-bootstrap" }, "variables": { "WINDMILL_ADMIN_EMAIL": { "isOptional": true, "description": "Seeded superadmin account whose default password the job replaces.", "defaultValue": "admin@windmill.dev" }, "WINDMILL_INTERNAL_URL": { "isOptional": true, "description": "Private URL of the Windmill server used by this one-shot job.", "defaultValue": "http://${{Windmill.RAILWAY_PRIVATE_DOMAIN}}:${{Windmill.PORT}}" }, "BOOTSTRAP_WAIT_SECONDS": { "isOptional": true, "description": "How long the job waits for the server (first boot runs all database migrations).", "defaultValue": "900" }, "WINDMILL_ADMIN_PASSWORD": { "isOptional": true, "description": "Generated first-login password for admin@windmill.dev. Change it after your first login.", "defaultValue": "{{WINDMILL_ADMIN_PASSWORD}}" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "87cdc23c-b5eb-5feb-becf-302538a5dcc6": { "icon": "https://devicons.railway.app/i/postgresql.svg", "name": "Postgres", "deploy": { "restartPolicyType": "ON_FAILURE", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:18" }, "variables": { "PGDATA": { "isOptional": true, "description": "Location where the database will be initialized", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "PGHOST": { "isOptional": true, "description": "Railway Private Domain Name.", "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}" }, "PGPORT": { "isOptional": true, "description": "Port to connect to Postgres.", "defaultValue": "5432" }, "PGUSER": { "isOptional": true, "description": "Required variable for Data panel", "defaultValue": "${{ POSTGRES_USER }}" }, "PGDATABASE": { "isOptional": true, "description": "Required variable for the data panel.", "defaultValue": "${{POSTGRES_DB}}" }, "PGPASSWORD": { "isOptional": true, "description": "Required variable for Data panel", "defaultValue": "${{POSTGRES_PASSWORD}}" }, "POSTGRES_DB": { "isOptional": true, "description": "Default database created when image is started.", "defaultValue": "railway" }, "DATABASE_URL": { "isOptional": true, "description": "URL to connect to Postgres database.", "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{PGDATABASE}}" }, "POSTGRES_USER": { "isOptional": true, "description": "User to connect to Postgres DB", "defaultValue": "postgres" }, "SSL_CERT_DAYS": { "isOptional": true, "description": "SSL certificate expiry in days.", "defaultValue": "820" }, "POSTGRES_PASSWORD": { "isOptional": true, "description": "Password to connect to DB", "defaultValue": "{{POSTGRES_PASSWORD}}" }, "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": { "isOptional": true, "description": "Allow Postgres to cleanly shut down", "defaultValue": "60" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} }, "volumeMounts": { "e7b0c062-a06e-5e0b-a1b4-cc18f0da86a7": { "mountPath": "/var/lib/postgresql/data" } } }, "ac86480c-4452-55e9-b035-ebc7bc8236f9": { "icon": "https://avatars.githubusercontent.com/u/98025271?v=4", "name": "Windmill Worker", "deploy": { "restartPolicyType": "ALWAYS" }, "source": { "image": "ghcr.io/windmill-labs/windmill:1.830.0" }, "variables": { "MODE": { "isOptional": true, "description": "Runs a job worker only (no API server).", "defaultValue": "worker" }, "BASE_URL": { "isOptional": true, "description": "Public URL used in links that jobs generate (e.g. approval/resume URLs).", "defaultValue": "https://${{Proxy.RAILWAY_PUBLIC_DOMAIN}}" }, "RUST_LOG": { "isOptional": true, "description": "Log level of the worker.", "defaultValue": "info" }, "NUM_WORKERS": { "isOptional": true, "description": "Workers per replica; Windmill forces 1 outside native mode. Scale with replicas instead.", "defaultValue": "1" }, "DATABASE_URL": { "isOptional": true, "description": "Postgres connection string over the private network (the queue lives in Postgres).", "defaultValue": "${{Postgres.DATABASE_URL}}?sslmode=disable" }, "WORKER_GROUP": { "isOptional": true, "description": "Worker group whose tags and settings (Workers page) this service pulls; runs Python, TS, Bash, Go and other jobs.", "defaultValue": "default" }, "FAVOR_UNSHARE_PID": { "isOptional": true, "description": "Upstream default: PID-namespace isolation per job; Windmill logs a warning and runs unisolated if the container does not allow it.", "defaultValue": "true" } }, "networking": { "tcpProxies": {}, "serviceDomains": {} } }, "ebbb178c-662f-528d-89af-8e02b22fff9e": { "icon": "https://avatars.githubusercontent.com/u/12955528?v=4", "name": "Proxy", "build": { "builder": "DOCKERFILE" }, "deploy": { "healthcheckPath": "/__proxy/health", "restartPolicyType": "ALWAYS", "healthcheckTimeout": 120 }, "source": { "repo": "baranberkay96/windmill-railway", "branch": "main", "rootDirectory": "/services/proxy" }, "variables": { "PORT": { "isOptional": true, "description": "Port Caddy listens on; the public domain and the healthcheck target it.", "defaultValue": "8080" }, "WINDMILL_EXTRA_UPSTREAM": { "isOptional": true, "description": "Private address of the windmill-extra gateway; receives /ws/*, /ws_debug/* and /ws_mp/*.", "defaultValue": "${{Windmill Extra.RAILWAY_PRIVATE_DOMAIN}}:${{Windmill Extra.PORT}}" }, "WINDMILL_SERVER_UPSTREAM": { "isOptional": true, "description": "Private address of the Windmill server; receives every path except the editor websockets.", "defaultValue": "${{Windmill.RAILWAY_PRIVATE_DOMAIN}}:${{Windmill.PORT}}" } }, "networking": { "tcpProxies": {}, "serviceDomains": { ":8080": { "port": 8080 } } } } } } } } } } }, "post_deploy": { "healthcheck": { "service": "Proxy", "method": "GET", "path": "/__proxy/health", "expect_status": 200 } }, "resources": { "expected_services": 7, "needs_volume": true }, "generated_at": "2026-10-11T16:14:40.554Z", "generator_version": "0.1.0", "status": "validated", "validated_at": "2026-10-11T14:54:49.816Z", "success_rate_30d": 1, "validation": { "last_run_id": "run_62d4655f84d94f3bb6d7", "checks": [ { "name": "workflow_completed", "passed": true }, { "name": "all_services_deployed", "passed": true }, { "name": "healthcheck", "passed": true }, { "name": "stays_up", "passed": true } ], "typical_ready_seconds": 78, "typical_build_seconds": 0, "typical_start_seconds": 20, "slowest_service": "Windmill Native Worker" } }