---
title: "Deploy Apache APISIX"
description: "API gateway that routes and secures traffic to your services"
category: "Other"
url: https://railway.com/deploy/apisix
---

# Deploy Apache APISIX

API gateway that routes and secures traffic to your services

**[Deploy Apache APISIX on Railway](https://railway.com/template/apisix)**

- **Creator:** A3A
- **Category:** Other

## Template content

### apisix https://raw.githubusercontent.com/apache/apisix-website/master/website/static/img/logo2.svg

- **Source:** https://github.com/gridalpha/apisix-railway
- **Health check:** /status/ready
- **Public domain:** Yes

### etcd https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/etcd.svg

- **Source:** https://github.com/gridalpha/apisix-railway
- **Health check:** /readyz

### apisix-dashboard https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/caddy.svg

- **Source:** https://github.com/gridalpha/apisix-railway
- **Health check:** /healthz
- **Public domain:** Yes

## Documentation

# Deploy and Host Apache APISIX on Railway

Apache APISIX is a high-performance, open-source API gateway that sits in front of your backend services and handles routing, authentication, rate limiting, observability and request transformation, so none of that logic lives in your application code. Built on NGINX and OpenResty and governed by the Apache Software Foundation, it keeps every route, upstream, consumer and plugin in etcd and pushes changes to running workers in milliseconds, so traffic can be reshaped without restarting anything.

This template lets you self-host Apache APISIX on Railway with three services wired together: the `apisix` gateway, which takes public traffic on its own domain; an `etcd` service holding all configuration on a persistent volume; and `apisix-dashboard`, a Caddy proxy publishing the Admin API and the dashboard UI that ships inside APISIX 3.13 and later on a second domain. The gateway reads its configuration from etcd over Railway's private network.

![Diagram of the APISIX, etcd and dashboard services on Railway](https://res.cloudinary.com/rroe4rtk/image/upload/v1788299556/apisix-architecture.png)

## Getting Started with Apache APISIX on Railway

After the deploy finishes, open the `apisix-dashboard` service's public URL. It redirects to `/ui/` and opens a Settings dialog asking for an Admin Key — paste the value of `APISIX_ADMIN_KEY` from the `apisix` service's variables and close the dialog. The key is kept in your browser, so you enter it once per device.

Your first useful action is to publish a backend. In **Upstreams**, add one pointing at a host you control — a Railway service on the same private network works, using `your-service.railway.internal` and its port. Then in **Routes**, create a route whose URI matches the paths you want to expose and whose upstream is the one you just made. The gateway's public domain starts proxying immediately, with no reload step.

To confirm the deployment works, open the route's detail page and use the built-in **Test request** panel: set the Gateway URL to the `apisix` service's public domain, enter a path and send. A 200 means routing, the etcd connection and the public domain are all healthy. An unmatched path returns a JSON `404 Route Not Found` from APISIX itself.

![APISIX Dashboard listing two configured gateway routes](https://res.cloudinary.com/rroe4rtk/image/upload/v1788299558/apisix-routes.png)
![Testing a gateway route and reading a 200 response](https://res.cloudinary.com/rroe4rtk/image/upload/v1788299560/apisix-route-test.png)
![APISIX Dashboard showing an API consumer with key authentication](https://res.cloudinary.com/rroe4rtk/image/upload/v1788299561/apisix-consumers.png)

## About Hosting Apache APISIX

An API gateway gives every service behind it one front door with a shared set of policies. Instead of each backend re-implementing API keys, JWT validation, CORS and quotas, you attach plugins to a route and APISIX applies them before the request reaches your code. Teams self-host once they run several internal services, or need API traffic and its logs on infrastructure they control.

Key capabilities:

- **Dynamic routing** by path, host, method, header, query argument or remote address, with regex rewriting.
- **Authentication plugins** — key auth, JWT, HMAC, basic auth, LDAP and OpenID Connect, on a shared consumer model.
- **Traffic control** through rate limiting, quotas, circuit breaking, canary release and mirroring.
- **Observability** with Prometheus, OpenTelemetry, SkyWalking, Datadog and Kafka or Loki loggers.
- **AI gateway plugins** that proxy, cache, rate-limit and guard LLM provider requests.
- **Service discovery** from DNS, Consul, Nacos and Eureka, plus gRPC and WebSocket support.

The `etcd` service is the configuration store, not a cache: routes, upstreams, consumers, certificates and plugin settings live there, which is why it carries the volume. APISIX keeps a copy in memory, so proxying continues even while etcd restarts. The dashboard is a separate service because Railway gives each service one public hostname, so the gateway's traffic port and the Admin API cannot share one.

## Why Deploy Apache APISIX on Railway

Railway removes the infrastructure work of running a gateway:

- Both public domains and TLS certificates are issued automatically.
- etcd, its volume and its credentials are provisioned and wired for you.
- The gateway reaches etcd over private networking, never the public internet.
- Health checks watch APISIX's own readiness endpoint, not just the port.
- The gateway is stateless, so you can raise replicas as traffic grows.

## Common Use Cases for Self-Hosted Apache APISIX

- One authenticated, rate-limited front door for several internal microservices elsewhere on Railway.
- A partner or customer API with per-consumer keys, quotas and usage metrics, none of it in the application.
- One endpoint in front of LLM providers that enforces token budgets, caches responses and hides provider keys.

## Dependencies for Apache APISIX

- **`apache/apisix`** — the gateway. Proxy traffic on 9080, Admin API and dashboard on 9180.
- **`quay.io/coreos/etcd:v3.6.14`** — the configuration store, a single node with authentication enabled and a volume at `/var/lib/etcd`.
- **`caddy:2-alpine`** — publishes the Admin API and dashboard on their own domain.

### Environment Variables Reference

| Variable | Service | Purpose |
|---|---|---|
| `APISIX_ADMIN_KEY` | apisix | Key every Admin API request and the dashboard must send |
| `APISIX_KEYRING` | apisix | Encrypts consumer credentials and TLS keys in etcd |
| `APISIX_ETCD_URL` / `APISIX_ETCD_PASSWORD` | apisix | Private etcd endpoint and password |
| `APISIX_WORKER_PROCESSES` | apisix | NGINX worker count; raise it on larger plans |
| `ETCD_ROOT_PASSWORD` | etcd | Enables etcd authentication on first boot |

`APISIX_KEYRING` must be exactly 16 or 32 characters and must never change once consumers or certificates exist, or those values stop decrypting.

### Deployment Dependencies

- Source repository: 
- Upstream project: 
- Admin API reference: 

## Hardware Requirements for Self-Hosting Apache APISIX

| Resource | Minimum | Recommended |
|---|---|---|
| CPU | 1 vCPU | 2–4 vCPU |
| RAM | 512 MB gateway, 256 MB etcd | 2 GB gateway, 1 GB etcd |
| Storage | 1 GB volume for etcd | 5 GB volume for etcd |
| Runtime | NGINX/OpenResty with LuaJIT | Same, plus replicas |

APISIX holds its configuration in memory, so throughput scales with CPU rather than RAM.

## Self-Hosting Apache APISIX

The quickest way to try APISIX locally is the official image with a single-node etcd beside it:

```
services:
  etcd:
    image: quay.io/coreos/etcd:v3.6.14
    environment:
      ETCD_LISTEN_CLIENT_URLS: http://0.0.0.0:2379
      ETCD_ADVERTISE_CLIENT_URLS: http://etcd:2379
  apisix:
    image: apache/apisix:latest
    depends_on: [etcd]
    ports: ["9080:9080", "9180:9180"]
```

Objects are then created through the Admin API. This adds a route proxying `/gh/*` to a public API, then calls it:

```
curl http://127.0.0.1:9180/apisix/admin/routes/example \
  -H "X-API-KEY: $ADMIN_KEY" -X PUT -d '{
    "uri": "/gh/*",
    "upstream": {"type":"roundrobin","scheme":"https","pass_host":"node",
                 "nodes":{"api.github.com:443":1}},
    "plugins": {"proxy-rewrite": {"regex_uri": ["^/gh/(.*)", "/$1"]}}
  }'

curl http://127.0.0.1:9080/gh/zen
```

The same calls work here: point the first at the dashboard domain, the second at the gateway domain.

## How Much Does Apache APISIX Cost to Self-Host?

Apache APISIX is free and open source under the Apache 2.0 licence, and unusually for this category nothing is held back: the plugin catalogue, the dashboard and the AI gateway features are all in the open-source build, with no enterprise tier gating rate limiting or authentication. API7 sells a commercial distribution with support, but you never need it. On Railway you pay for the compute and storage the three services use.

## FAQ

**What is Apache APISIX?**
An open-source, cloud-native API gateway built on NGINX and OpenResty. It routes incoming HTTP, gRPC, WebSocket and TCP traffic to your backend services and applies authentication, rate limiting and observability plugins along the way.

**What does this Railway template deploy?**
Three services: the APISIX gateway on its own public domain, a single-node etcd store on a persistent volume, and a proxy publishing the Admin API and dashboard on a second domain. Credentials for both are generated during deploy.

**Why does Apache APISIX need etcd?**
etcd stores routes, upstreams, consumers, certificates and plugin configuration. Every gateway instance watches it and gets changes in milliseconds, which is what lets you reconfigure a live gateway without restarting it.

**How do I add authentication to a route in self-hosted Apache APISIX?**
Create a consumer in the dashboard with the `key-auth` plugin and a key of your choice, then enable `key-auth` on the route. Requests must send that key in the `apikey` header; anything else gets a 401.

**Can I run more than one APISIX instance behind the same domain?**
Yes. The gateway keeps no local state, so raising the replica count on the `apisix` service is safe — every replica reads the same configuration from etcd. Keep etcd at one replica, since it owns the volume.

**How do I secure the Admin API on this template?**
It requires the `APISIX_ADMIN_KEY` header and returns 401 without it. Rotate the key by changing that variable, and for a second layer put basic auth or an IP allow list on the dashboard service.


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/apisix