Template input reference

Template inputs turn Compose references into labeled setup questions. Authors define the schema in the template editor; customers answer it when deploying the release. Input definitions are part of the immutable reviewed release.

For a custom stack without a registry schema, use stack private inputs. Those references do not automatically gain the registry’s labels, type validation, generation rules, or derived URL behavior.

Define an input

A release supports up to 100 input definitions. Reference a key as a complete environment value, for example DATABASE_URL: "${DATABASE_URL}". Declare every referenced private input. A label and key do not have to be identical.

Types and deployment validation

Values are passed to container environment variables as strings. An integer input does not convert YAML metadata such as a port or CPU allocation into an interpolated setting. Input expansion is for the supported runtime environment references, not arbitrary Compose fields.

Required and optional values

Customer provides a value requires a nonempty value unless a valid default supplies it. Optional with safe default allows omission and uses the defined default, or an empty value when the application can accept one.

Deployment treats an empty answer as omission/default selection. Do not design a question that depends on distinguishing an intentionally empty answer from an unanswered question. Explain any application-specific validation that the schema cannot express.

Defaults are included in template metadata. Use defaults only for non-sensitive configuration. Secret and generated inputs cannot contain saved defaults.

Generated secrets

Choose type secret and Generate a fresh secret. When the deployment answer is omitted, Infralane generates a fresh secret for that installation. A customer can provide an appropriate value instead.

Generation takes place privately during configuration preparation and the resolved values are stored in the encrypted deployment plan. Applying that reviewed plan uses those values. Do not assume that starting a new independent review preserves a previously generated value.

The resulting stack keeps saved values for later edits; blank replacement fields preserve them. A configuration copy does not copy saved inputs. Eligible generated fields resolve again for the new stack.

Generated credentials are not automatically application administrator accounts. Explain first-login and account setup separately. Database initialization variables also do not rotate accounts already stored in persistent data.

Derived database URLs

Choose a secret input with Build a private database URL to assemble a connection URL from ordinary inputs. Supported schemes are postgresql, mysql, and redis.

Provide:

• Username input key: an ordinary input defined in the same release.
• Password input key: an ordinary secret input, often generated.
• Database name input key: an ordinary input.
• Private database service: an existing service in the manifest.
• Private database port: an integer from 1 to 65535.

The backend builds the URL privately and URL-encodes username, password, and database components. The resulting input is derived, so customers do not need to enter it separately. Components cannot themselves be derived inputs.

This illustrative schema pattern connects an application to a database service:

[
  {
    "key": "DATABASE_USER",
    "label": "Database username",
    "type": "text",
    "required": true,
    "default": "app"
  },
  {
    "key": "DATABASE_PASSWORD",
    "label": "Database password",
    "type": "secret",
    "generate": true,
    "required": true
  },
  {
    "key": "DATABASE_NAME",
    "label": "Database name",
    "type": "text",
    "required": true,
    "default": "app"
  },
  {
    "key": "DATABASE_URL",
    "label": "Private database connection URL",
    "type": "secret",
    "required": true,
    "derived": {
      "scheme": "postgresql",
      "user": "DATABASE_USER",
      "password": "DATABASE_PASSWORD",
      "service": "database",
      "port": 5432,
      "database": "DATABASE_NAME"
    }
  }
]

In the database service, reference the same inputs for its initialization variables. In the consumer service, use DATABASE_URL: "${DATABASE_URL}". The template must also include that database service, declare persistent storage, and configure suitable dependencies and readiness checks.

This is an input-schema example, not a complete publishable template. In the dashboard, enter the fields using Add input rather than pasting the JSON into the Compose editor.

Protect inputs throughout the workflow

Configuration exports contain references rather than resolved environment values. Saved inputs are encrypted in stack revisions and masked when reopening the editor. Database connection details require a deliberate reveal/copy action and project write permission.

Do not embed credentials in defaults, image references, commands, descriptions, screenshots, support messages, or Markdown. Secret-pattern validation is a guard, not a complete secret scanner. Review the full release and any test evidence before submission.

Application code can still print a secret it receives at runtime. Review logs before sharing them. See Security and sensitive data and Create and publish templates.