Deploy cvengine

Deploy and Host CVEngine on Railway

CVEngine is a self-hosted attack-surface management platform that continuously discovers internet-facing assets, inventories services, correlates current CVEs with observed products and versions, and validates findings with read-only checks. Its Django dashboard, REST API, MCP integration, Celery workers, scanners, PostgreSQL database, and Redis broker provide one operational security workspace.

About Hosting CVEngine on Railway

Railway runs CVEngine as a Docker-only deployment with a bundled web and worker service, plus dedicated PostgreSQL and Redis services. Railway provides managed networking, persistent volumes, public HTTPS routing, deployment logs, and service health status.

Tech Stack

• Ubuntu 26.04 Docker image
• Python 3.14
• Django 5.2 and Gunicorn
• Celery with Redis broker and backend
• PostgreSQL 18
• Nginx reverse proxy
• Nmap, Nuclei, Naabu, BBOT, and WPScan
• REST API and MCP server

Why Deploy CVEngine on Railway

Railway provides a simple HTTPS endpoint, private service networking, persistent storage, environment variable management, and one-click operational visibility for a complex multi-process security application. The Docker image contains the application and scanner toolchain, while Railway services provide isolated database and queue dependencies.

Common Use Cases

• External attack-surface discovery for owned domains and IP ranges
• Continuous inventory of ports, services, versions, and technologies
• CVE correlation against observed infrastructure
• Evidence-based, read-only vulnerability validation
• Security team dashboards and operational triage
• REST API and MCP access for developer agents

Deployment Notes

The public CVEngine service listens on port 8080 and bundles Nginx, Gunicorn, Celery workers, and Celery Beat. PostgreSQL listens on 5432 and Redis listens on 6379 over Railway private networking. The initial username is admin; the password is generated through DJANGO_SUPERUSER_PASSWORD. Persist /usr/src/scan_results for scan artifacts, /var/lib/postgresql for database data, and /data for Redis persistence. CVENGINE_CVE_SEED=0 avoids a large first-start catalog import; enable it later if desired. CVENGINE_NAABU=0 disables full SYN discovery by default. The image entrypoint handles migrations, static files, admin creation, Nginx, and background workers, so no Railway start command override is required.

Dependencies for CVEngine on Railway

CVEngine requires PostgreSQL for application state and Redis for Celery queues, task results, locks, and cache data. The web and worker processes use Railway private-domain references to connect to both dependency services.

Deployment Dependencies