Deploy and Host self hosted Argus SecOps on Railway

Argus SecOps is a self-hosted agentic security operations platform that you can run on Railway as a set of four services: the API and console, a queue worker, Postgres and Redis.

About Hosting Argus SecOps open-source software on Railway (self hosted Argus SecOps template)

This template runs upstream Argus at commit 6c057e1, an MIT licensed agentic security operations platform, as four Railway services: argus-api, argus-worker, argus-db on Postgres 16 and argus-redis on Redis 7.4.

Why Deploy Argus SecOps, the self-hosted agentic security operations platform on Railway (Railway Free Trial)

Wazuh is a capable self-hosted SIEM, but running it yourself means owning the servers, upgrades and on-call.

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Argus SecOps on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Railway vs Other Hosting Providers and VPS for Argus SecOps self hosting

Argus SecOps runs four services, so the hosting choice mostly decides how much of that stack you wire up yourself.

Provider	What You Get with Railway	What You Get with the Other Provider
DigitalOcean	Four services from one template, private networking, volumes and generated secrets.	A Droplet or managed database you size and configure yourself.
AWS	One template wiring the api, worker, database and queue together.	Full control over VPC, compute, RDS and IAM, but more setup before Argus runs.
Hetzner	The same four-service layout without provisioning servers or installing Docker.	Low-cost bare servers where you install Docker Compose, Postgres and Redis yourself.

Choose a VPS route if you already run a hardened Linux host and want every component under your own configuration.

Common Use Cases for hosted Argus SecOps

Detections console across your estate: Connect cloud, identity, code, endpoint, network and Kubernetes sources yourself and triage detections in one place.
Read-only AI investigations: Nine specialist agents use read-only tools and can propose a fix, but cannot execute one.
Gated response actions: The action broker offers approvals, dry-run previews, rollback and a kill switch.
Org-held model keys: The AI gateway keeps provider keys under your control. AI agents are off by default and need a provider and key added to both argus-api and argus-worker.
Tamper-evident audit trail: A hash-linked, signed audit chain is mirrored as JSONL on the /app/data volume. In-app backups are disabled in this template because they need a separate privileged pg_dump, so use Railway volume backups and your own pg_dump.

Dependencies for Argus SecOps Docker hosted on Railway

Four services make up this template: the console and API, a Redis queue worker, Postgres 16 and Redis 7.4. Only argus-api is public.

Deployment Dependencies for Managed Argus SecOps Service (api, worker, Postgres 16 and Redis 7.4)

argus-api: FastAPI console and API, public HTTPS, health check on /ready, volume at /app/data.
argus-worker: Redis queue worker, volume at /app/data.
argus-db: Postgres 16, private, with its own volume.
argus-redis: Redis 7.4 with AOF, noeviction and a 256 MB default maxmemory, private, volume at /data.
Variables: eighteen in total. argus-api holds SESSION_SECRET, ADMIN_PASSWORD, DATA_ENCRYPTION_KEY, AUDIT_SIGNING_KEY, DATABASE_URL (runtime role), ALEMBIC_DATABASE_URL (migrations only), REDIS_URL and BASE_URL. The worker references the same secrets plus DATABASE_URL, REDIS_URL and BASE_URL. argus-db holds POSTGRES_PASSWORD and ARGUS_RUNTIME_PASSWORD, and argus-redis holds REDIS_PASSWORD.

Implementation Details for Argus SecOps (unmodified Argus 6c057e1 build plus a Railway start script and restricted Postgres role)

The images ghcr.io/onepush-dev/argus-secops:6c057e1 and the matching worker tag are built unmodified from upstream commit 6c057e1, with a start script added.

How does Argus SecOps compare against other tools

Argus SecOps vs Wazuh (Wazuh Alternative)

Scope: Wazuh is a self-hosted SIEM and endpoint security platform with a long history. Argus SecOps is a young project (upstream repository created 24 October 2026) focused on detections, investigation agents and an action broker.
Response model: Argus puts actions behind approvals, dry runs and rollback, and agents propose fixes without executing them. Wazuh is the stronger choice if you need a mature, widely deployed agent fleet today.

Argus SecOps vs Microsoft Sentinel (Microsoft Sentinel Alternative)

Hosting: Microsoft Sentinel is a hosted SIEM that runs in Azure. Argus SecOps is self-hosted, so the data stays on infrastructure you operate.
Ecosystem: Sentinel has a large connector and content ecosystem. Argus ships collectors for common sources, but you add credentials and integrations yourself.

Argus SecOps vs Elastic Security (Elastic Security Alternative)

Search: Elastic Security is a SIEM and security analytics suite built on Elasticsearch, strong for large-scale search and hunting. Argus is built around detections and agent-driven investigation.
Maturity: Elastic has years of production use and a large community. Argus is a young project, so expect a smaller ecosystem and faster-moving code.

Argus with Docker Compose vs Railway (Railway Alternative)

Setup: Docker Compose on your own host gives full control of networking and storage. On Railway, the four services (api, worker, Postgres 16 and Redis 7.4) are wired up from one template.
Operations: Railway handles the platform layer, but in-app backups are disabled in this template, so plan your own pg_dump and volume backups.

How to use Argus SecOps on Railway?

Open the argus-api URL from the Railway dashboard. The console is served over HTTPS at the public domain Railway assigns to the service.
Sign in as admin@argus.local. Copy ADMIN_PASSWORD from the argus-api Variables tab, since the password is generated at deploy time and you will not see it anywhere else.
When prompted, enrol an authenticator app. TOTP is mandatory in production mode, so you cannot skip this step. Once enrolment is complete, change the admin password.
AI agents stay off by default (AI_PROVIDER=none). To turn them on, add AI_PROVIDER=anthropic plus ANTHROPIC_API_KEY, or AI_PROVIDER=openai plus OPENAI_API_KEY, to both argus-api and argus-worker. These variables are not part of the template, so you add them yourself.
Keep DATA_ENCRYPTION_KEY and AUDIT_SIGNING_KEY unchanged after first boot. Changing either one makes encrypted data or the signed audit chain unreadable.

Check that the stack is healthy with:

curl -s https://your-domain/ready

How to self host Argus SecOps on other VPS Services (Argus SecOps self hosting guide)

Clone the Repository

Clone the upstream repository and check out the pinned commit.

git clone https://github.com/thomasunise/argus.git
cd argus
git checkout 6c057e1

Install Dependencies

Install Docker with the Compose plugin on your VPS. The pilot stack runs API, worker, PostgreSQL and Redis as containers, so nothing else is required.

Configure Environment Variables

Copy the example file and generate secrets.

cp .env.example .env
python scripts/generate_secrets.py --write

Set APP_ENV=production, COOKIE_SECURE=true, BASE_URL=https://your-domain and TOTP_REQUIRED=true.

Start the Argus SecOps Application

Run Docker Compose for a pilot, or use compose.prod.yaml for a single host with Caddy TLS. Kubernetes uses Helm, and AWS or Azure use Terraform.

Pricing and License of Argus SecOps (Argus SecOps pricing)

Argus SecOps is open-source software released under the MIT license, so you can self-host it for free and modify it to suit your team.

Argus SecOps hosted vs self hosted comparison (Pricing, features, costs, and more)

Argus SecOps is free, MIT-licensed open-source software, and upstream does not describe a hosted plan. You own upgrades, backups and TLS.

Monthly cost of self hosting Argus SecOps on Railway

Railway bills by usage, so your monthly cost depends on the RAM, CPU, volume size and services across argus-api, argus-worker, argus-db and argus-redis.

System Requirements for Hosting Argus SecOps on a VPS

Upstream does not publish a minimum machine size, so measure your own. Put it behind HTTPS and watch /ready.

Frequently Asked Questions (FAQs)

How do I sign in to Argus SecOps for the first time?

Open the argus-api URL and sign in as admin@argus.local with the ADMIN_PASSWORD value from the argus-api Variables tab.

Why do I have to set up two-factor authentication?

Upstream production mode requires TOTP on first login, and this template runs in production mode. Enrol an authenticator app when prompted, then change the admin password.

Do I need an AI key to use Argus SecOps?

No. AI_PROVIDER defaults to none, so investigation agents stay off.

What happens if I change DATA_ENCRYPTION_KEY or AUDIT_SIGNING_KEY?

Encrypted columns and the signed audit chain become unreadable. Never change either value after first boot.

Can I use the in-app backup button?

No. Use Railway volume backups and run your own pg_dump against the Postgres service.

Is this the same as the Argus template already on the Railway marketplace?

No. That template is a different recon toolkit. This template deploys Argus SecOps from thomasunise/argus, and it is not related to other projects named Argus.