---
title: "Deploy Nginx proxy auth"
description: "Deploy and Host bearer-proxy with Railway"
category: "Other"
url: https://railway.com/deploy/bearer-proxy
---

# Deploy Nginx proxy auth

Deploy and Host bearer-proxy with Railway

**[Deploy Nginx proxy auth on Railway](https://railway.com/template/bearer-proxy)**

- **Creator:** Sendly
- **Category:** Other

## Template content

### bearer-proxy https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/nginx.svg

- **Source:** usesendly/bearer-proxy
- **Public domain:** Yes

## Documentation

# Deploy and Host bearer-proxy on Railway

bearer-proxy is a lightweight nginx reverse proxy that protects any HTTP service behind Bearer token authentication. Drop it in front of any internal service to add secure, token-based access control without modifying the service itself.

## About Hosting bearer-proxy

Hosting bearer-proxy involves running an nginx container that sits between your clients and an upstream service. On startup, it dynamically detects the DNS resolver (critical for Railway's internal networking), generates the nginx config from environment variables, and begins proxying requests. Only requests with a valid `Authorization: Bearer ` header are forwarded to the upstream. All others receive a 401. The container is stateless and requires no persistent storage.

## Common Use Cases

- **Protect internal Railway services** — expose services like Prometheus, internal APIs, or admin tools to the internet with token authentication
- **Secure microservice communication** — add an auth layer in front of services that don't natively support authentication
- **API gateway for private tools** — gate access to internal dashboards or services without modifying their code

## Dependencies for bearer-proxy Hosting

- A running upstream HTTP service to proxy to (the `ORIGIN`)
- A securely generated Bearer token (`BEARER_TOKEN`)

### Deployment Dependencies

- [nginx:alpine](https://hub.docker.com/_/nginx) — base image
- [gettext](https://pkgs.alpinelinux.org/package/edge/main/x86_64/gettext) — provides `envsubst` for config templating

### Implementation Details

Set these environment variables before deploying:

```env
BEARER_TOKEN=your_secret_token_here
ORIGIN=http://your-service.railway.internal:PORT
```

Then call your proxied service with:

```bash
curl https://your-proxy.railway.app/your-endpoint \
  -H "Authorization: Bearer your_secret_token_here"
```

## Why Deploy bearer-proxy on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying bearer-proxy on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — [Jul'26] Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/bearer-proxy