Deploy and Host Casdoor on Railway

Built for an LLM agent to deploy and use. There is no welcome-page password step and nothing to fill in: the admin password is generated at deploy time and valid from the first boot. The contract below lists every URL, variable name and the one script that proves it works.

Casdoor is an open-source identity and access management (IAM) platform: single sign-on (SSO), OAuth 2.0 and OpenID Connect (OIDC) provider, SAML, LDAP, social login, multi-factor authentication and an admin UI, with SDKs for most languages. This template runs Casdoor together with a PostgreSQL database.

About Hosting Casdoor

This template runs two services. casdoor is the official Casdoor 4.25.0 image (casbin/casdoor, pinned by digest). It is stateless: organizations, applications, users and signing certificates all live in PostgreSQL. postgres is the official postgres:17 image (pinned by digest) with a volume at /var/lib/postgresql, reachable only on the private network. The casdoor start command waits for the database, points Casdoor at it, sets the public origin from the Railway domain (so the OIDC issuer URL is right) and hands the generated admin password to the stock server, so the same values apply after every redeploy. Allow about a minute for the first deploy to turn healthy.

Agent contract

Public URL: https:// plus the RAILWAY_PUBLIC_DOMAIN of the casdoor service, used below as CASDOOR_URL. It serves the admin UI at /, the REST API under /api, OIDC discovery at /.well-known/openid-configuration and the OAuth endpoints under /login/oauth.
Private URL: http://casdoor.railway.internal:8080
Credentials: the built-in administrator admin (organization built-in) with the password in CASDOOR_ADMIN_PASSWORD. The database password is DB_PASSWORD, shared with the postgres service as POSTGRES_PASSWORD.
Auth: POST the login to /api/login (body below) and keep the session cookie, or read clientId and clientSecret of the app-built-in application after login and send them as HTTP basic auth. There is no default 123 password.
Health: GET /api/health returns 200 with no credentials

# run with CASDOOR_URL and CASDOOR_ADMIN_PASSWORD set; needs curl
J=$(mktemp); N="agent-check-$(date +%s)"
curl -s -o /dev/null -w 'health %{http_code}\n' "$CASDOOR_URL/api/health"
curl -s "$CASDOOR_URL/.well-known/openid-configuration" | grep -o "\"issuer\": \"$CASDOOR_URL\""
curl -s "$CASDOOR_URL/api/get-organizations?owner=admin" | grep -o 'Please sign in first'
curl -s -c "$J" -H 'Content-Type: application/json' -d "{\"application\":\"app-built-in\",\"organization\":\"built-in\",\"username\":\"admin\",\"password\":\"$CASDOOR_ADMIN_PASSWORD\",\"type\":\"login\"}" "$CASDOOR_URL/api/login" | grep -o '"data": "built-in/admin"'
curl -s -b "$J" -H 'Content-Type: application/json' -d "{\"owner\":\"admin\",\"name\":\"$N\",\"displayName\":\"$N\",\"passwordType\":\"plain\"}" "$CASDOOR_URL/api/add-organization" | grep -o '"data": "Affected"'
curl -s -b "$J" "$CASDOOR_URL/api/get-organization?id=admin/$N" | grep -o "\"name\": \"$N\""
curl -s -b "$J" -H 'Content-Type: application/json' -d "{\"owner\":\"admin\",\"name\":\"$N\"}" "$CASDOOR_URL/api/delete-organization" | grep -o '"data": "Affected"'

A fresh deploy prints health 200, the issuer line, Please sign in first, "data": "built-in/admin" and then "data": "Affected", the organization's own name, and "data": "Affected" again. Point an application at CASDOOR_URL as its OIDC issuer, or open CASDOOR_URL and sign in as admin.

Why Deploy Casdoor on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Casdoor on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Agent-ready - a generated admin password that works on first boot, a contract block and one working script; no admin / 123 login and no welcome-page step.
Correct issuer - the public origin comes from the Railway domain, so OIDC discovery advertises the URL your applications can actually reach.
State survives redeploys - organizations, applications, users and signing certificates live in PostgreSQL on a volume.
Private database - PostgreSQL has no public domain and is reached over the private network.
Pinned images - both images are pinned by digest, so a redeploy never changes the server version underneath you.

Common Use Cases

Single sign-on for your own apps - one OIDC or OAuth 2.0 provider in front of internal tools and customer-facing products.
Self-hosted Auth0 or Keycloak alternative - users, social login, MFA and SAML on infrastructure you control.
Agent-driven identity management - let an AI agent create organizations, applications and users through the REST API.

Dependencies for Casdoor Hosting

A PostgreSQL database (included in this template, volume at /var/lib/postgresql).

Deployment Dependencies

casdoor/casdoor - upstream project
Casdoor documentation - API reference, OIDC setup and SDKs