Control plane for the OpenAnalytics Railway template: auth, sites, keys, sharing, funnels, widgets, revenue, MCP.
Runs the published ghcr.io/openlabs-so/openanalytics/api:v0.2.0 image with one
addition — an entrypoint that derives this deployment's three Ed25519 signing
pairs from OA_KEY_SEED and hands the api the private halves.
Upstream ships those pairs through Docker volumes written by a one-shot keygen
container. Railway has no shared volumes and no variable function that can
produce a keypair whose halves match across two services, so they are derived
instead: one random seed, the same three pairs on every service, different on
every deployment. See oa-derive-keys.mjs.
| Variable | Notes |
|---|---|
OA_KEY_SEED |
64 hex chars. Minted here; the gateway, realtime and collector reference ${{api.OA_KEY_SEED}}. |
DATABASE_URL |
Postgres. |
REALTIME_CACHE_REDIS_URL |
The losable cache instance. |
QUERY_GATEWAY_URL |
http://<gateway>.railway.internal:8081. |
AUTH_BASE_URL / APP_BASE_URL / COLLECTOR_BASE_URL / AUTH_TRUSTED_ORIGINS |
Public origins. Without the last one the browser gets no CORS header and every dashboard call is refused. |
AUTH_SECRET, TRIAL_IDENTITY_SECRET, CREDENTIAL_SOURCE_SECRET, OA_CREDENTIAL_KEYRING |
Secrets. The keyring must be byte-identical to the worker's. |
AUTH_PASSWORD_SIGNIN=enabled |
The first-run "create the first account" screen depends on it. |
Licensed AGPL-3.0, as upstream.