Deploy and Host Agent Mesh One on Railway

Agent Mesh One is an all-in-one secure mesh server combining the Agent Mesh control plane, an authenticated libp2p router, SQLite-backed state, and a browser console in one container. It provides policy-aware enrollment, token exchange, service discovery, and administration for small deployments that need a zero-trust mesh and a straightforward web entry point.

About Hosting Agent Mesh One on Railway

Railway runs the published, version-pinned GHCR image as a single HTTP service. Railway supplies TLS, a public domain, health visibility, regional scheduling, and generated template secrets, so the console and API are available immediately after deployment.

Tech Stack

Agent Mesh One v0.1.1
Go control plane and embedded libp2p router
Embedded web console
SQLite storage
GitHub Container Registry image
Railway HTTPS networking and service variables

Why Deploy Agent Mesh One on Railway

Railway provides a fast one-click path to a working Agent Mesh endpoint without a source build or a multi-service cluster. The template uses a pinned upstream container, managed TLS, explicit port routing, and Railway-generated secrets for repeatable and safer setup.

Common Use Cases

Running a small private agent or service mesh
Testing node enrollment and policy workflows
Operating a browser-based mesh administration console
Prototyping secure service discovery and token exchange
Demonstrating Agent Mesh integrations locally or in a shared environment

Deployment Notes

The service listens on container port 8080 and exposes /readyz, /healthz, /info, and /console/. Railway sets PORT=8080 and AGENTMESH_EXTERNAL_URL from the public domain. AGENTMESH_ADMIN_TOKEN protects administrative APIs and AGENTMESH_TOKEN admits bootstrap enrollment; both are generated with Railway secret functions. The upstream image runs as a non-root user, so this template intentionally does not attach a Railway volume: the app database, router key, and generated local state are ephemeral across replacement deployments. For durable production state, use a storage setup that preserves non-root write access.

Template Variables

Variable	Default	Purpose
`PORT`	`8080`	HTTP listener and Railway routing port
`AGENTMESH_EXTERNAL_URL`	`https://${{RAILWAY_PUBLIC_DOMAIN}}`	Public URL advertised to mesh peers
`AGENTMESH_ADMIN_TOKEN`	`${{secret(64)}}`	Administrative bearer token
`AGENTMESH_TOKEN`	`${{secret(64)}}`	Bootstrap enrollment token

Dependencies for Agent Mesh One on Railway

Agent Mesh One is self-contained and has no database, cache, worker, or other service dependency. Railway only needs the single upstream Docker image and the generated HTTP domain shown below.

Deployment Dependencies

Service	Image	Port	Volume
agentmesh-one	ghcr.io/google/agentmesh-one:v0.1.1	8080	-