Deploy and Host DumbAssets on Railway

Built for an LLM agent to deploy and use. The deploy form has no fields to fill: a 10 digit PIN is generated, the asset register is locked behind it from the first request, and the REST API takes that PIN as a cookie. DumbAssets is a self-hosted asset tracker: assets and sub-components, warranties, maintenance events, photos, receipts, manuals, tags and notifications, kept as plain files.

About Hosting DumbAssets

This template runs one service, dumbassets (a single Node process serving the web app and the REST API), with every record and uploaded file on one volume mounted at /app/data. There is no separate database service to run.

Locked from boot. A stock DumbAssets serves the whole register to anyone with the URL when its PIN variable is unset or empty, prints the PIN in clear text to the deploy log on every start, counts failed PIN attempts per socket address (behind Railway's edge that address rotates per request, so the lockout never reliably fires), and builds its links from localhost. This template's image refuses to start without a valid PIN, keeps the PIN out of the log, counts attempts per real client address and sets BASE_URL from the Railway domain.

What persists. Assets, components, warranties, maintenance events, images, receipts and manuals live on the volume at /app/data.

Using the web interface. Open the public URL and enter the DUMBASSETS_PIN value from the service variables.

Agent contract

Public URL: https://RAILWAY_PUBLIC_DOMAIN (the generated domain of the dumbassets service)
Private URL: http://dumbassets.railway.internal:8080
Credentials: the variable DUMBASSETS_PIN on the dumbassets service (10 digits)
Auth: send the header Cookie: DUMBASSETS_PIN=DUMBASSETS_PIN_VALUE (the value of the DUMBASSETS_PIN variable) on every /api request; without it the API answers 401
Health: GET /login returns 200 without credentials

# needs: SITE_URL (public https URL of the dumbassets service) and DUMBASSETS_PIN (its variable); also curl, sed
AUTH="Cookie: DUMBASSETS_PIN=$DUMBASSETS_PIN"
curl -s -o /dev/null -w "health: %{http_code}\n" "$SITE_URL/login"
curl -s -o /dev/null -w "read without pin: %{http_code}\n" "$SITE_URL/api/assets"
curl -s -o /dev/null -w "write without key: %{http_code}\n" -X POST -H "Content-Type: application/json" -d '{"name":"x"}' "$SITE_URL/api/asset"
curl -s -o /dev/null -w "write wrong key: %{http_code}\n" -X POST -H "Cookie: DUMBASSETS_PIN=wrong" -H "Content-Type: application/json" -d '{"name":"x"}' "$SITE_URL/api/asset"
ID=$(curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" -d '{"name":"agent-check laptop","modelNumber":"M1","serialNumber":"SN-1"}' "$SITE_URL/api/asset" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p')
echo "asset created: $ID"
{ curl -s -H "$AUTH" "$SITE_URL/api/assets"; echo; } | sed -n 's/.*"name":"\(agent-check laptop\)".*/asset read: \1/p'
curl -s -o /dev/null -w "asset delete: %{http_code}\n" -X DELETE -H "$AUTH" "$SITE_URL/api/asset/$ID"

A fresh deploy prints health: 200, read without pin: 401, write without key: 401, write wrong key: 401, a created asset id, asset read: agent-check laptop and asset delete: 200.

Why Deploy DumbAssets on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying DumbAssets on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Agent-ready - no deployer fields, a contract block and one script that proves a read, a write, a delete and the refusal without the PIN.
Locked by default - the deploy cannot start as an open asset register.
Data survives redeploys - every record and file sits on a volume.
Pinned - the image is pinned by digest.
Your inventory stays yours - plain files, no cloud account.

Common Use Cases

Home and small-office asset inventory - track equipment, serial numbers, purchase details, photos and manuals in one searchable place.
Warranty and maintenance tracking - record warranty end dates and maintenance events and get reminded before they lapse.
Agent-maintained inventory - a coding or ops agent registers and updates assets over the REST API.
Insurance and resale records - keep receipts, manuals and photos attached to each item.

Dependencies for DumbAssets Hosting

Nothing else: records are files on the service's volume. A custom domain is optional.

Deploy DumbAssets | (Just Updated) Self-Hosted Asset Tracker, Warranty and Maintenance API, PIN Locked