Deploy Apache APISIX

Deploy and Host Apache APISIX on Railway

Apache APISIX is a high-performance, open-source API gateway that sits in front of your backend services and handles routing, authentication, rate limiting, observability and request transformation, so none of that logic lives in your application code. Built on NGINX and OpenResty and governed by the Apache Software Foundation, it keeps every route, upstream, consumer and plugin in etcd and pushes changes to running workers in milliseconds, so traffic can be reshaped without restarting anything.

This template lets you self-host Apache APISIX on Railway with three services wired together: the apisix gateway, which takes public traffic on its own domain; an etcd service holding all configuration on a persistent volume; and apisix-dashboard, a Caddy proxy publishing the Admin API and the dashboard UI that ships inside APISIX 3.13 and later on a second domain. The gateway reads its configuration from etcd over Railway's private network.

Getting Started with Apache APISIX on Railway

After the deploy finishes, open the apisix-dashboard service's public URL. It redirects to /ui/ and opens a Settings dialog asking for an Admin Key — paste the value of APISIX_ADMIN_KEY from the apisix service's variables and close the dialog. The key is kept in your browser, so you enter it once per device.

Your first useful action is to publish a backend. In Upstreams, add one pointing at a host you control — a Railway service on the same private network works, using your-service.railway.internal and its port. Then in Routes, create a route whose URI matches the paths you want to expose and whose upstream is the one you just made. The gateway's public domain starts proxying immediately, with no reload step.

To confirm the deployment works, open the route's detail page and use the built-in Test request panel: set the Gateway URL to the apisix service's public domain, enter a path and send. A 200 means routing, the etcd connection and the public domain are all healthy. An unmatched path returns a JSON 404 Route Not Found from APISIX itself.

About Hosting Apache APISIX

An API gateway gives every service behind it one front door with a shared set of policies. Instead of each backend re-implementing API keys, JWT validation, CORS and quotas, you attach plugins to a route and APISIX applies them before the request reaches your code. Teams self-host once they run several internal services, or need API traffic and its logs on infrastructure they control.

Key capabilities:

• Dynamic routing by path, host, method, header, query argument or remote address, with regex rewriting.
• Authentication plugins — key auth, JWT, HMAC, basic auth, LDAP and OpenID Connect, on a shared consumer model.
• Traffic control through rate limiting, quotas, circuit breaking, canary release and mirroring.
• Observability with Prometheus, OpenTelemetry, SkyWalking, Datadog and Kafka or Loki loggers.
• AI gateway plugins that proxy, cache, rate-limit and guard LLM provider requests.
• Service discovery from DNS, Consul, Nacos and Eureka, plus gRPC and WebSocket support.

The etcd service is the configuration store, not a cache: routes, upstreams, consumers, certificates and plugin settings live there, which is why it carries the volume. APISIX keeps a copy in memory, so proxying continues even while etcd restarts. The dashboard is a separate service because Railway gives each service one public hostname, so the gateway's traffic port and the Admin API cannot share one.

Why Deploy Apache APISIX on Railway

Railway removes the infrastructure work of running a gateway:

• Both public domains and TLS certificates are issued automatically.
• etcd, its volume and its credentials are provisioned and wired for you.
• The gateway reaches etcd over private networking, never the public internet.
• Health checks watch APISIX's own readiness endpoint, not just the port.
• The gateway is stateless, so you can raise replicas as traffic grows.

Common Use Cases for Self-Hosted Apache APISIX

• One authenticated, rate-limited front door for several internal microservices elsewhere on Railway.
• A partner or customer API with per-consumer keys, quotas and usage metrics, none of it in the application.
• One endpoint in front of LLM providers that enforces token budgets, caches responses and hides provider keys.

Dependencies for Apache APISIX

• apache/apisix — the gateway. Proxy traffic on 9080, Admin API and dashboard on 9180.
• quay.io/coreos/etcd:v3.6.14 — the configuration store, a single node with authentication enabled and a volume at /var/lib/etcd.
• caddy:2-alpine — publishes the Admin API and dashboard on their own domain.

Environment Variables Reference

APISIX_KEYRING must be exactly 16 or 32 characters and must never change once consumers or certificates exist, or those values stop decrypting.

Deployment Dependencies

• Source repository:
• Upstream project:
• Admin API reference:

Hardware Requirements for Self-Hosting Apache APISIX

APISIX holds its configuration in memory, so throughput scales with CPU rather than RAM.

Self-Hosting Apache APISIX

The quickest way to try APISIX locally is the official image with a single-node etcd beside it:

services:
  etcd:
    image: quay.io/coreos/etcd:v3.6.14
    environment:
      ETCD_LISTEN_CLIENT_URLS: http://0.0.0.0:2379
      ETCD_ADVERTISE_CLIENT_URLS: http://etcd:2379
  apisix:
    image: apache/apisix:latest
    depends_on: [etcd]
    ports: ["9080:9080", "9180:9180"]

Objects are then created through the Admin API. This adds a route proxying /gh/* to a public API, then calls it:

curl http://127.0.0.1:9180/apisix/admin/routes/example \
  -H "X-API-KEY: $ADMIN_KEY" -X PUT -d '{
    "uri": "/gh/*",
    "upstream": {"type":"roundrobin","scheme":"https","pass_host":"node",
                 "nodes":{"api.github.com:443":1}},
    "plugins": {"proxy-rewrite": {"regex_uri": ["^/gh/(.*)", "/$1"]}}
  }'

curl http://127.0.0.1:9080/gh/zen

The same calls work here: point the first at the dashboard domain, the second at the gateway domain.

How Much Does Apache APISIX Cost to Self-Host?

Apache APISIX is free and open source under the Apache 2.0 licence, and unusually for this category nothing is held back: the plugin catalogue, the dashboard and the AI gateway features are all in the open-source build, with no enterprise tier gating rate limiting or authentication. API7 sells a commercial distribution with support, but you never need it. On Railway you pay for the compute and storage the three services use.

FAQ

What is Apache APISIX? An open-source, cloud-native API gateway built on NGINX and OpenResty. It routes incoming HTTP, gRPC, WebSocket and TCP traffic to your backend services and applies authentication, rate limiting and observability plugins along the way.

What does this Railway template deploy? Three services: the APISIX gateway on its own public domain, a single-node etcd store on a persistent volume, and a proxy publishing the Admin API and dashboard on a second domain. Credentials for both are generated during deploy.

Why does Apache APISIX need etcd? etcd stores routes, upstreams, consumers, certificates and plugin configuration. Every gateway instance watches it and gets changes in milliseconds, which is what lets you reconfigure a live gateway without restarting it.

How do I add authentication to a route in self-hosted Apache APISIX? Create a consumer in the dashboard with the key-auth plugin and a key of your choice, then enable key-auth on the route. Requests must send that key in the apikey header; anything else gets a 401.

Can I run more than one APISIX instance behind the same domain? Yes. The gateway keeps no local state, so raising the replica count on the apisix service is safe — every replica reads the same configuration from etcd. Keep etcd at one replica, since it owns the volume.

How do I secure the Admin API on this template? It requires the APISIX_ADMIN_KEY header and returns 401 without it. Rotate the key by changing that variable, and for a second layer put basic auth or an IP allow list on the dashboard service.