Deploy and Host Cerbos with Railway

Run a Cerbos policy decision point that loads authorization policies from Git and exposes the HTTP decision API. The template pins Cerbos 0.54.0, checks readiness at /_cerbos/health, and polls your policy repository every 60 seconds.

About Hosting Cerbos

Cerbos keeps authorization rules outside application code. Your services send principal, resource, and action context to the PDP, and Cerbos returns allow or deny decisions from version-controlled policies. This template exposes the HTTP API through Railway and keeps the gRPC endpoint available to services over private networking.

The default repository contains Cerbos's official sample policies so deployment can be verified immediately. Fork it or point the variables at your own public HTTPS Git repository before application integration.

Why Deploy Cerbos on Railway?

Railway supplies the running service, TLS endpoint, health monitoring, and private networking. Cerbos polls Git for policy changes, so policy deployment remains a normal reviewed repository workflow.

This is a single-replica small-team baseline. Use Cerbos Hub or a supported shared policy backend when you need private policy sources, coordinated multi-replica updates, or advanced deployment controls.

Common Use Cases

• Centralize authorization rules across APIs and services.
• Review and test access-control changes through Git.
• Add contextual role and attribute-based authorization.
• Keep policy evaluation close to Railway-hosted applications.

Dependencies for Cerbos Hosting

• A public HTTPS Git repository containing valid Cerbos policies.
• An application that calls the Cerbos HTTP or private gRPC API.

Deployment Dependencies

• Cerbos documentation
• Cerbos policy examples