Deploy and Host Documenso on Railway

Documenso is the open-source alternative to DocuSign: upload a PDF, place signature and form fields, send it to signers, and get back a sealed, digitally signed document. This template runs Documenso 2.16.0 with Postgres, and — unlike a stock deployment — it comes up with a signing certificate and an administrator account already in place.

About Hosting Documenso

Documenso is a Node application that stores everything in Postgres, including the uploaded and completed documents. It needs three things a plain container does not have on a hosting platform: a PKCS#12 signing certificate to seal completed envelopes, an account with the ADMIN role (Documenso creates every account as a plain user and ships no seeding command), and a writable place to keep the certificate across redeploys.

This template supplies all three. On first boot it generates a self-signed signing certificate onto the volume, seeds the administrator from a generated password before the web server accepts its first request, and repairs the volume's ownership for the non-root user the image runs as. The certificate is kept, so it does not change under you on the next deploy; the administrator password is re-applied on every boot, so changing the variable and redeploying is a working password reset even with no mail server configured.

Why Deploy Documenso on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Documenso on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

The app and its Postgres database run as two services on the private network, with a volume for the signing certificate and a healthcheck on /api/health. Documents live in Postgres, so a redeploy costs you nothing.

Common Use Cases

Send contracts, NDAs and offer letters for signature from your own domain, without a per-seat e-signature subscription.
Keep signed documents and their audit trail on infrastructure you control, for clients or regulators who will not accept a third-party signing vendor.
Drive signing from your own product through Documenso's REST API and webhooks — signing requests created by your backend, completed documents fetched back.

Dependencies for Documenso

PostgreSQL — deployed by this template as a second service, on its own volume.
A volume on the app service, mounted at /opt/documenso, holding the signing certificate.
Optional: an SMTP account, if you want Documenso to email signing requests, reminders and password resets. Everything else works without one.

Deployment Dependencies

Documenso — the upstream project.
Documenso self-hosting documentation
bon5co/documenso-railway — the Railway packaging used by this template, with the entrypoint that generates the certificate and seeds the administrator.

Implementation Details

After deploying, open the app service's Variables tab and read DOCUMENSO_ADMIN_EMAIL and DOCUMENSO_ADMIN_PASSWORD — that is your login. Self-registration is disabled by default; set NEXT_PUBLIC_DISABLE_SIGNUP=false if you want other people to be able to sign up on your instance.

The generated signing certificate is self-signed, which is what self-hosted Documenso is unless you bring a certificate from a certificate authority. Signature validators will show the signature as valid and the issuer as untrusted. To use your own certificate, place it on the volume at /opt/documenso/cert.p12 and set NEXT_PRIVATE_SIGNING_PASSPHRASE to its passphrase.

Do not change NEXT_PRIVATE_SIGNING_PASSPHRASE casually: it is the passphrase the stored certificate was written with. If it changes, the old certificate is backed up and a new one is generated, and documents already sealed keep their original signature.