Deploy and Host DumbPad on Railway

Built for an LLM agent to deploy and use. The deploy form has no fields to fill: a 10 digit PIN is generated, the notepad is locked behind it from the first request, and the REST API takes that PIN as a cookie. DumbPad is a self-hosted notepad: multiple notepads, auto-save, markdown, full-text search, notes kept as plain text files.

About Hosting DumbPad

This template runs one service, dumbpad (a single Node process serving the web app and the REST API), with every note on one volume mounted at /app/data. There is no separate database service to run.

Locked from boot. A stock DumbPad serves every note to anyone with the URL when its PIN variable is unset or malformed, counts failed PIN attempts per socket address (behind Railway's edge that is one address for all visitors, so one stranger's five wrong guesses lock the owner out), and cannot write a root-owned volume. This template's image refuses to start without a valid PIN, counts attempts per real client address, sets BASE_URL from the Railway domain and fixes the volume permissions.

What persists. Notepads and notes live on the volume at /app/data.

Using the web interface. Open the public URL and enter the DUMBPAD_PIN value from the service variables.

Agent contract

Public URL: https://RAILWAY_PUBLIC_DOMAIN (the generated domain of the dumbpad service)
Private URL: http://dumbpad.railway.internal:8080
Credentials: the variable DUMBPAD_PIN on the dumbpad service (10 digits)
Auth: send the header Cookie: dumbpad_auth=DUMBPAD_PIN_VALUE (the value of the DUMBPAD_PIN variable) on every /api request, or POST /api/verify-pin with {"pin":"..."} over https and reuse the cookie it sets; without the cookie the API answers 401
Health: GET /health returns 200 without credentials

# needs: SITE_URL (public https URL of the dumbpad service) and DUMBPAD_PIN (its variable); also curl, sed
AUTH="Cookie: dumbpad_auth=$DUMBPAD_PIN"
curl -s -o /dev/null -w "health: %{http_code}\n" "$SITE_URL/health"
curl -s -o /dev/null -w "read without pin: %{http_code}\n" "$SITE_URL/api/notepads"
curl -s -o /dev/null -w "write without key: %{http_code}\n" -X POST "$SITE_URL/api/notepads"
curl -s -o /dev/null -w "write wrong key: %{http_code}\n" -X POST -H "Cookie: dumbpad_auth=wrong" "$SITE_URL/api/notepads"
ID=$(curl -s -X POST -H "$AUTH" "$SITE_URL/api/notepads" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p')
echo "notepad created: $ID"
curl -s -o /dev/null -w "note write: %{http_code}\n" -X POST -H "$AUTH" -H "Content-Type: application/json" -d '{"content":"agent-check hello"}' "$SITE_URL/api/notes/$ID"
{ curl -s -H "$AUTH" "$SITE_URL/api/notes/$ID"; echo; } | sed -n 's/.*"content":"\([^"]*\)".*/note read: \1/p'
{ curl -s -H "$AUTH" "$SITE_URL/api/search?query=agent-check"; echo; } | sed -n 's/.*"match":"\([^"]*\)".*/search hit: \1/p'
curl -s -o /dev/null -w "notepad delete: %{http_code}\n" -X DELETE -H "$AUTH" "$SITE_URL/api/notepads/$ID"

A fresh deploy prints health: 200, read without pin: 401, write without key: 401, write wrong key: 401, a created notepad id, note write: 200, note read: agent-check hello, a search hit: line naming the notepad and notepad delete: 200.

Why Deploy DumbPad on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying DumbPad on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Agent-ready - no deployer fields, a contract block and one script that proves a read, a write, search, delete and the refusal without the PIN.
Locked by default - the deploy cannot start as an open notepad.
Data survives redeploys - every note sits on a volume.
Pinned - the image is pinned by digest.
Your notes stay yours - plain text files, no cloud account.

Common Use Cases

Self-hosted notepad and scratchpad - a private, auto-saving place for notes, snippets and checklists reachable from any browser.
Agent memory and handoff notes - a coding agent writes and reads plain-text notes over the REST API between runs.
Team scratch space - one shared PIN-protected notepad for a small group.
Markdown notes without a database - everything is a text file on a volume you can back up.

Dependencies for DumbPad Hosting

Nothing else: notes are files on the service's volume. A custom domain is optional.

Deploy DumbPad | (Just Updated) Self-Hosted Notepad, Notes API With Generated PIN, No Setup