---
title: "Deploy DumbPad | (Just Updated) Self-Hosted Notepad, Notes API With Generated PIN, No Setup"
description: "DumbPad self-hosted notepad app, REST API, PIN login, file storage"
category: "Other"
url: https://railway.com/deploy/dumbpad-or-just-updated-self-hosted-note
---

# Deploy DumbPad | (Just Updated) Self-Hosted Notepad, Notes API With Generated PIN, No Setup

DumbPad self-hosted notepad app, REST API, PIN login, file storage

**[Deploy DumbPad | (Just Updated) Self-Hosted Notepad, Notes API With Generated PIN, No Setup on Railway](https://railway.com/template/dumbpad-or-just-updated-self-hosted-note)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/dumbpad-or-just-updated-self-hosted-note/manifest.json

- **Creator:** SuperSlowSloth
- **Category:** Other

## Template content

### dumbpad

- **Image:** ghcr.io/bon5co/dumbpad-railway:1.0.5@sha256:45058e25889708b2b53c6fdc98f92a52f7aec9ebdb7eb63a7478b0fd6b93d27f
- **Health check:** /health
- **Public domain:** Yes

## Documentation

# Deploy and Host DumbPad on Railway

**Built for an LLM agent to deploy and use.** The deploy form has no fields to fill: a 10 digit PIN is generated, the notepad is locked behind it from the first request, and the REST API takes that PIN as a cookie. DumbPad is a self-hosted notepad: multiple notepads, auto-save, markdown, full-text search, notes kept as plain text files.

## About Hosting DumbPad

This template runs one service, **dumbpad** (a single Node process serving the web app and the REST API), with every note on one volume mounted at `/app/data`. There is no separate database service to run.

**Locked from boot.** A stock DumbPad serves every note to anyone with the URL when its PIN variable is unset or malformed, counts failed PIN attempts per socket address (behind Railway's edge that is one address for all visitors, so one stranger's five wrong guesses lock the owner out), and cannot write a root-owned volume. This template's image refuses to start without a valid PIN, counts attempts per real client address, sets `BASE_URL` from the Railway domain and fixes the volume permissions.

**What persists.** Notepads and notes live on the volume at `/app/data`.

**Using the web interface.** Open the public URL and enter the `DUMBPAD_PIN` value from the service variables.

### Agent contract

- Public URL: `https://RAILWAY_PUBLIC_DOMAIN` (the generated domain of the `dumbpad` service)
- Private URL: `http://dumbpad.railway.internal:8080`
- Credentials: the variable `DUMBPAD_PIN` on the `dumbpad` service (10 digits)
- Auth: send the header `Cookie: dumbpad_auth=DUMBPAD_PIN_VALUE` (the value of the `DUMBPAD_PIN` variable) on every `/api` request, or `POST /api/verify-pin` with `{"pin":"..."}` over https and reuse the cookie it sets; without the cookie the API answers `401`
- Health: `GET /health` returns 200 without credentials

```bash
# needs: SITE_URL (public https URL of the dumbpad service) and DUMBPAD_PIN (its variable); also curl, sed
AUTH="Cookie: dumbpad_auth=$DUMBPAD_PIN"
curl -s -o /dev/null -w "health: %{http_code}\n" "$SITE_URL/health"
curl -s -o /dev/null -w "read without pin: %{http_code}\n" "$SITE_URL/api/notepads"
curl -s -o /dev/null -w "write without key: %{http_code}\n" -X POST "$SITE_URL/api/notepads"
curl -s -o /dev/null -w "write wrong key: %{http_code}\n" -X POST -H "Cookie: dumbpad_auth=wrong" "$SITE_URL/api/notepads"
ID=$(curl -s -X POST -H "$AUTH" "$SITE_URL/api/notepads" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p')
echo "notepad created: $ID"
curl -s -o /dev/null -w "note write: %{http_code}\n" -X POST -H "$AUTH" -H "Content-Type: application/json" -d '{"content":"agent-check hello"}' "$SITE_URL/api/notes/$ID"
{ curl -s -H "$AUTH" "$SITE_URL/api/notes/$ID"; echo; } | sed -n 's/.*"content":"\([^"]*\)".*/note read: \1/p'
{ curl -s -H "$AUTH" "$SITE_URL/api/search?query=agent-check"; echo; } | sed -n 's/.*"match":"\([^"]*\)".*/search hit: \1/p'
curl -s -o /dev/null -w "notepad delete: %{http_code}\n" -X DELETE -H "$AUTH" "$SITE_URL/api/notepads/$ID"
```

A fresh deploy prints `health: 200`, `read without pin: 401`, `write without key: 401`, `write wrong key: 401`, a created notepad id, `note write: 200`, `note read: agent-check hello`, a `search hit:` line naming the notepad and `notepad delete: 200`.

## Why Deploy DumbPad on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying DumbPad on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

- **Agent-ready** - no deployer fields, a contract block and one script that proves a read, a write, search, delete and the refusal without the PIN.
- **Locked by default** - the deploy cannot start as an open notepad.
- **Data survives redeploys** - every note sits on a volume.
- **Pinned** - the image is pinned by digest.
- **Your notes stay yours** - plain text files, no cloud account.

## Common Use Cases

- **Self-hosted notepad and scratchpad** - a private, auto-saving place for notes, snippets and checklists reachable from any browser.
- **Agent memory and handoff notes** - a coding agent writes and reads plain-text notes over the REST API between runs.
- **Team scratch space** - one shared PIN-protected notepad for a small group.
- **Markdown notes without a database** - everything is a text file on a volume you can back up.

## Dependencies for DumbPad Hosting

- Nothing else: notes are files on the service's volume. A custom domain is optional.

### Deployment Dependencies

- [DumbPad repository](https://github.com/DumbWareio/DumbPad)
- [DumbPad documentation](https://github.com/DumbWareio/DumbPad#readme)
- [Official Docker image](https://hub.docker.com/r/dumbwareio/dumbpad)
- [Wrapper image source](https://github.com/bon5co/dumbpad-railway)


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/dumbpad-or-just-updated-self-hosted-note