platform.yaml

# The one file that decides your Railway project. Edit it, then:
#   make railway-plan    # what would change (read-only)
#   make railway-apply   # create or update the project to match
# Re-running converges; changing a value here updates every environment.
# Removing things (admin: false after true, an environment) never deletes
# anything unless you pass CONFIRM_DESTRUCTIVE=1. See docs/deploy.md.
version: 1

# Railway project name: created on the first apply if it does not exist,
# otherwise reused (matched by exact name in the workspace). auto: the
# GitHub repo name (or this directory's name).
project: auto
# Railway workspace name or id. Empty: your only workspace (required when you
# belong to more than one).
workspace: ""

# How code reaches Railway. "" (the default): never through Railway's GitHub
# integration. GitHub Actions deploy every environment by upload instead
# (docs/RELEASES.md): Deploy staging ships each attested merge to main,
# Deploy production ships a published release. By hand: make railway-up.
# auto (this checkout's origin) or owner/repo turns Railway's own
# deploy-on-push back on, from the branches below, beside the workflows;
# leave it off so only attested commits deploy.
repo: ""
# With repo set: the branch production deploys, and per environment its own
# (branches.<env>, default dev). Unused in upload mode.
branch: main

# The admin dashboard (apps/admin) as its own service with its own small
# Postgres. Adds two services per environment.
admin: false

# production | staging,production | staging,qa,production
# The release pipeline (docs/RELEASES.md) needs staging: staging always runs
# the latest main, and production only takes a release staging already ran.
environments: staging,production

# Railway PR environments: a temporary copy of staging per pull request
# (needs staging in environments; a preview never copies production). Off by
# default: each preview runs its own web + Postgres while the PR is open.
previews: false

# Railway region for every service and database. Empty: Railway's default.
# List: railway api 'query { regions { name location } }'
region: ""

# Where live secrets (RESEND_API_KEY, ...) come from: doppler polls a
# Doppler config per service and environment, so they rotate without a
# redeploy; env reads Railway variables at boot. With doppler, setup moves
# the secrets into Doppler when the Doppler CLI is logged in (doppler login;
# or later: make doppler-setup); until then services run on env.
secrets:
  provider: doppler
  # Doppler project (created if missing; auto: the Railway project's name).
  # Environments map
  # production->prd, staging->stg, qa->qa, local->dev; admin reads a branch
  # config (prd_admin, ...) the web token cannot read.
  project: go-fast-stack

# Required: the sender of every auth email (FROM_EMAIL), on a domain your
# mail provider (Resend) has verified. The apps run with APP_ENV=production,
# which refuses to boot without one or with an example address, so plan and
# apply refuse first. Or pass --email-from / PLATFORM_EMAIL_FROM.
email:
  from: ""

# What one environment's apps see as their origin and sender. public_url
# (web PUBLIC_URL) and admin_public_url (ADMIN_PUBLIC_URL): railway for the
# Railway-generated domain (the default), or an https origin (a custom
# domain). from_email: FROM_EMAIL (default email.from). manual: you set it
# by hand in Railway, and apply never sets, resets or deletes it.
# secrets (with secrets.provider: doppler): doppler (default) switches the
# environment's services to Doppler; staged fills Doppler and seals the
# token without a deploy, so they keep their Railway secrets until a release
# sets it to doppler (docs/secrets.md "Staged environments").
# per_environment:
#   production:
#     public_url: https://app.example.com
#     from_email: manual
#     secrets: staged

# admin_bootstrap_email: you@example.com   # first admin, seeded by `admin migrate`

# Nightly database backups (docs/backups.md): a small cron
# service, backup, dumps the app database (pg_dump, compressed), encrypts it
# with BACKUP_ENCRYPTION_KEY (generated; keep a copy outside Railway) and
# stores it in a Railway storage bucket, then prunes. Restore: make
# railway-restore. Costs cents a month at template sizes.
backups:
  enabled: true
  schedule: "0 3 * * *"   # cron, UTC
  keep_daily: 7           # the newest backup of each of the last 7 days
  keep_weekly: 4          # and of each of the last 4 weeks
  admin: true             # also admin-postgres, when admin: true
  region: ""              # bucket region: sjc, iad, ams, sin ("": nearest region:, else sjc)
  # railway: a Railway storage bucket (no other account). external: your own
  # S3-compatible bucket off Railway (Cloudflare R2, Backblaze B2, AWS S3);
  # set backup/BACKUP_S3_* yourself (docs/backups.md).
  storage: railway
  # Railway's own snapshots of every Postgres volume (Pro plan only): daily
  # (kept 6 days), weekly (27 days), monthly (89 days). Setup sets the
  # schedule through Railway's API, without a redeploy, and re-runs change
  # nothing. Commented out: left as set in the dashboard. []: none.
  # per_environment.<env>.volume_snapshots overrides it (e.g. [daily]).
  # volume_snapshots: [daily, weekly, monthly]

# Per-service caps (per replica). Railway bills actual usage, so caps only
# bound a runaway process; a Go service idles at a few tens of MB.
resources:
  web:   { cpu: 1, memory_mb: 512, replicas: 1 }
  admin: { cpu: 0.5, memory_mb: 256, replicas: 1 }

# Extra variables IaC leaves alone (set them in the dashboard or with
# `railway variable set`): NAME, a glob like STRIPE_*, or service/NAME.
# The project is managed: a variable neither set by IaC nor listed here (or
# a bootstrap secret) is deleted by the next apply. make deploy-vars fails
# when a name in .env.example is neither, or when IaC sets a listed one.
# The defaults are the optional settings the apps read.
unmanaged_variables:
  - TRUSTED_ORIGINS
  - ADMIN_TRUSTED_ORIGINS
  - INTERNAL_URL
  - APP_NAME
  - ADMIN_APP_NAME
  - AUTH_SECRET_GRACE
  - ADMIN_AUTH_SECRET_GRACE
  - ADMIN_REQUIRE_2FA
  - ADMIN_AUDIT_RECONCILE_AFTER
  - SECRETS_REFRESH_INTERVAL
  - SECRETS_MAX_STALENESS
  # Sign in with Google / Apple and object storage: the non-secret halves
  # (their secrets are Doppler's, or setup-owned on env).
  - GOOGLE_CLIENT_ID
  - APPLE_CLIENT_ID
  - APPLE_TEAM_ID
  - STORAGE_S3_REGION
  - STORAGE_S3_PATH_STYLE
  - backup/BACKUP_S3_PATH_STYLE