{"_id":"@akeyless-community/railway-sync","name":"@akeyless-community/railway-sync","dist-tags":{"latest":"0.1.1"},"versions":{"0.1.1":{"name":"@akeyless-community/railway-sync","version":"0.1.1","description":"Sync secrets from Akeyless to Railway service or shared environment variables","type":"module","license":"Apache-2.0","author":{"name":"Akeyless Community"},"repository":{"type":"git","url":"git+https://github.com/akeyless-community/railway-akeyless-sync.git"},"homepage":"https://github.com/akeyless-community/railway-akeyless-sync#readme","bin":{"akeyless-railway-sync":"bin/akeyless-railway-sync.js"},"main":"./dist/index.js","scripts":{"build":"tsc","dev":"tsx src/cli.ts","sync":"tsx src/cli.ts sync","lint":"tsc --noEmit","test":"node --import tsx --test src/*.test.ts","prepublishOnly":"npm run build && npm test"},"keywords":["akeyless","railway","secrets","sync","github-actions","devops"],"publishConfig":{"access":"public"},"engines":{"node":">=18"},"dependencies":{"dotenv":"^16.4.7"},"devDependencies":{"@types/node":"^22.10.0","tsx":"^4.19.2","typescript":"^5.7.2"},"gitHead":"05faf07223acf231c64316e4a3d8dd33770f3537","types":"./dist/index.d.ts","_id":"@akeyless-community/railway-sync@0.1.1","bugs":{"url":"https://github.com/akeyless-community/railway-akeyless-sync/issues"},"_nodeVersion":"26.3.0","_npmVersion":"11.16.0","dist":{"integrity":"sha512-6QqPX1kpiPaFeTw52lOSfaJzwmCwFrBrSvCefCKe+FDy3lgDPWlIqzFdbwbP5+dVeGhdyWSKu8MYEEEslRdgMw==","shasum":"5d2d588e9dc5a20e4fa696a04edeb74181f10e26","tarball":"https://registry.npmjs.org/@akeyless-community/railway-sync/-/railway-sync-0.1.1.tgz","fileCount":20,"unpackedSize":38984,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQDQ4Wmx88v6i3+2FbmBmSw1V54L+1ORxknL0eL5A5CjyQIhALa0UvjurV01mEiUGsQzodm46/SbsIwIhHJc9B+V6+cJ"}]},"_npmUser":{"name":"barak-akeyless","email":"barak.a@akeyless.io"},"directories":{},"maintainers":[{"name":"barak-akeyless","email":"barak.a@akeyless.io"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/railway-sync_0.1.1_1782994196793_0.10997516259318574"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-02T12:09:56.657Z","0.1.1":"2026-07-02T12:09:56.941Z","modified":"2026-07-02T12:09:57.141Z"},"maintainers":[{"name":"barak-akeyless","email":"barak.a@akeyless.io"}],"description":"Sync secrets from Akeyless to Railway service or shared environment variables","homepage":"https://github.com/akeyless-community/railway-akeyless-sync#readme","keywords":["akeyless","railway","secrets","sync","github-actions","devops"],"repository":{"type":"git","url":"git+https://github.com/akeyless-community/railway-akeyless-sync.git"},"author":{"name":"Akeyless Community"},"bugs":{"url":"https://github.com/akeyless-community/railway-akeyless-sync/issues"},"license":"Apache-2.0","readme":"# Akeyless + Railway Push Sync\n\nSync static secrets from [Akeyless](https://www.akeyless.io) to [Railway](https://railway.com) service or shared environment variables — the same push pattern used by Doppler and Infisical.\n\n**Repository:** [github.com/akeyless-community/railway-akeyless-sync](https://github.com/akeyless-community/railway-akeyless-sync)\n\nPair with [@akeyless-community/railway-runtime](https://github.com/akeyless-community/railway-runtime) if you prefer runtime pull instead of push sync.\n\n## Why this integration\n\nRailway injects configuration as environment variables at deploy time. Akeyless stays the source of truth; this tool pushes secrets to Railway via the public GraphQL API (`variableCollectionUpsert`).\n\n**Use cases:**\n- Sync API keys and database credentials to a Railway service\n- Rotate secrets in Akeyless and propagate via GitHub Actions\n- Keep bootstrap-only vars on Railway and push application secrets from Akeyless\n\n## Quick start\n\n### 1. Prerequisites\n\n- [Akeyless](https://console.akeyless.io) static secrets under a folder, e.g. `/railway/my-project/production`\n- A Railway **account or workspace** API token ([railway.com/account/tokens](https://railway.com/account/tokens))\n- Railway project, environment, and optional service IDs (Cmd/Ctrl+K in dashboard → Copy … ID)\n\n> **Note:** Project-scoped tokens do not work with Railway’s sync API. Use an account or workspace token.\n\n### 2. Install\n\n```bash\nnpm install -g @akeyless-community/railway-sync\n```\n\nOr clone and run locally:\n\n```bash\ngit clone https://github.com/akeyless-community/railway-akeyless-sync.git\ncd railway-akeyless-sync\nnpm install\ncp .env.example .env\n# Edit .env\nnpm run sync\n```\n\n### 3. Configure\n\n```bash\nexport AKEYLESS_ACCESS_ID=\"p-...\"\nexport AKEYLESS_ACCESS_KEY=\"...\"\nexport AKEYLESS_SECRET_PATH=\"/railway/my-project/production\"\nexport RAILWAY_API_TOKEN=\"...\"\nexport RAILWAY_PROJECT_ID=\"...\"\nexport RAILWAY_ENVIRONMENT_ID=\"...\"\nexport RAILWAY_SERVICE_ID=\"...\"   # optional — omit for shared variables\n```\n\n### 4. Sync\n\n```bash\n# Preview\nakeyless-railway-sync sync --dry-run\n\n# Apply\nakeyless-railway-sync sync\n```\n\n## GitHub Action\n\nAdd [`.github/workflows/sync-secrets.yml`](./examples/github-workflow/sync-secrets.yml):\n\n```yaml\nname: Sync secrets to Railway\n\non:\n  schedule:\n    - cron: \"0 */6 * * *\"\n  workflow_dispatch:\n\njobs:\n  sync:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - uses: akeyless-community/railway-akeyless-sync/action@v1\n        with:\n          akeyless-access-id: ${{ secrets.AKEYLESS_ACCESS_ID }}\n          akeyless-access-key: ${{ secrets.AKEYLESS_ACCESS_KEY }}\n          akeyless-secret-path: /railway/my-project/production\n          railway-api-token: ${{ secrets.RAILWAY_API_TOKEN }}\n          railway-project-id: ${{ secrets.RAILWAY_PROJECT_ID }}\n          railway-environment-id: ${{ secrets.RAILWAY_ENVIRONMENT_ID }}\n          railway-service-id: ${{ secrets.RAILWAY_SERVICE_ID }}\n```\n\n### GitHub secrets to configure\n\n| Secret | Description |\n|--------|-------------|\n| `AKEYLESS_ACCESS_ID` | Akeyless access ID (read-only on sync path) |\n| `AKEYLESS_ACCESS_KEY` | Akeyless access key |\n| `RAILWAY_API_TOKEN` | Railway account/workspace token |\n| `RAILWAY_PROJECT_ID` | Target project ID |\n| `RAILWAY_ENVIRONMENT_ID` | Target environment ID |\n| `RAILWAY_SERVICE_ID` | Optional service ID |\n\n## Secret naming\n\n| Akeyless path | Railway variable |\n|---------------|------------------|\n| `/railway/my-project/production/database-url` | `DATABASE_URL` |\n| `/railway/my-project/production/stripe-secret-key` | `STRIPE_SECRET_KEY` |\n\nRules:\n- Folder path is stripped; only the item name is used\n- Non-alphanumeric characters become underscores\n- Names are uppercased\n- `RAILWAY_*` variables are never overwritten (Railway-provided)\n- Reference variables (`${{ Service.VAR }}`) are skipped by default\n\n## Configuration reference\n\n| Variable | Default | Description |\n|----------|---------|-------------|\n| `DELETE_ORPHANED` | `false` | Remove Railway vars not in Akeyless |\n| `SKIP_DEPLOYS` | `false` | Pass `skipDeploys` to Railway API |\n| `REPLACE_ALL` | `false` | Replace entire variable set (dangerous) |\n| `SKIP_RAILWAY_PREFIX` | `true` | Never sync `RAILWAY_*` names |\n| `SKIP_REFERENCE_VARIABLES` | `true` | Skip existing `${{ … }}` references |\n\n## Push sync vs runtime pull\n\n| Pattern | Tool |\n|---------|------|\n| **Push sync** (this repo) | Secrets copied into Railway variables |\n| **Runtime pull** | [`@akeyless-community/railway-runtime`](https://github.com/akeyless-community/railway-runtime) — app fetches at startup |\n\n## Related projects\n\n- [railway-runtime](https://github.com/akeyless-community/railway-runtime) — fetch secrets at runtime on Railway\n- [supabase-akeyless-integration](https://github.com/akeyless-community/supabase-akeyless-integration) — same push-sync pattern for Supabase\n\n## License\n\nApache-2.0\n","readmeFilename":"README.md","_rev":"1-ba517bb5cb45aa3344d20c3ce640a250"}