Railway & DigitalOcean
Keep Railway service variables in sync automatically, and inject secrets into DigitalOcean App Platform at build or run time.
Railway — auto-sync
Connect a Railway API token, map a vault environment to a service, and every secret change upserts to Railway automatically (delete removes it).
Connect + map
# Connect (Railway API token from railway.app account settings)
curl -X POST https://api.meowpass.dev/integrations/railway/connect \
-H "Authorization: Bearer $MEOWPASS_TOKEN" -d '{"token":"<railway-token>"}'
# Map a vault env → a Railway service (project/environment/service ids)
curl -X PATCH https://api.meowpass.dev/integrations/<integration-id>/mappings \
-H "Authorization: Bearer $MEOWPASS_TOKEN" \
-d '{"project_mappings":[
{"vault_id":"<vault>","env":"production","project_id":"<p>","environment_id":"<e>","service_id":"<s>"}
]}'
# Writes now auto-sync:
mp set DATABASE_URL postgres://... --env production # → upserted in Railway
Alternatively, inject at run time without storing anything in Railway: mp run -- your-start-command as the service start command.
DigitalOcean App Platform
DigitalOcean stores env vars inside the whole app spec, so changing one triggers a full redeploy. Rather than redeploy per secret, inject secrets at build or run time:
.do/app.yaml (build/run command)
# App env vars: MEOWPASS_TOKEN = mp_... · MEOWPASS_VAULT_ID = <vault>
services:
- name: web
# Runtime injection — secrets never stored in DO:
run_command: |
curl -fsSL https://meowpass.dev/install.sh | bash
mp run --vault $MEOWPASS_VAULT_ID -- npm start
Prefer a one-shot batch sync into the app spec instead? That's on the roadmap (mp do sync). For now, build/run injection is the recommended path.