Deploy and Host Engram Cloud on Railway

Built for an LLM agent to deploy and use. There is no setup form and nothing to fill in: the access token is generated at deploy time, and the contract below lists every address, variable name and one script that proves a write and a read work.

Engram is a persistent memory system for AI coding agents. Agents save decisions, bug fixes and conventions as observations during a session and recall them in later sessions. Engram Cloud is its server mode: a sync API with a web dashboard that keeps one shared memory for several machines or several agents, stored in PostgreSQL.

About Hosting Engram Cloud

This template runs two services. engram is the official ghcr.io/gentleman-programming/engram 3.6.1 image, pinned by digest, started with engram cloud serve on Railway's injected port. postgres is PostgreSQL 17 on an attached volume, so every saved memory survives redeploys. The server creates its own schema on first boot.

Every sync route needs the bearer token from ENGRAM_CLOUD_TOKEN. The dashboard accepts the same token on its login page and then sets a session cookie. The token and the signing secret are generated per deploy and stay the same across redeploys. All projects are allowed by default; set ENGRAM_CLOUD_ALLOWED_PROJECTS to a comma separated list on the engram service to restrict them.

Agent contract

Public URL: ENGRAM_PUBLIC_URL (https:// plus the service's RAILWAY_PUBLIC_DOMAIN). The dashboard is at /dashboard/.
Private URL: http://engram.railway.internal:8080, exposed as ENGRAM_PRIVATE_URL.
Credentials: ENGRAM_CLOUD_TOKEN (the access token) and ENGRAM_JWT_SECRET (signing secret, not for clients).
Auth: send Authorization: Bearer followed by the token on every /sync/* request. Anonymous requests get 401. For the dashboard, post the token to /dashboard/login.
Health: GET /health returns 200 without credentials.
API: POST /sync/mutations/push and GET /sync/mutations/pull for observations, GET /sync/pull and POST /sync/push for chunks.

# run with ENGRAM_PUBLIC_URL and ENGRAM_CLOUD_TOKEN set
KEY="obs-$(date +%s)"
curl -s -o /dev/null -w "health: %{http_code}\n" "$ENGRAM_PUBLIC_URL/health"
curl -s -o /dev/null -w "anonymous pull: %{http_code}\n" -G "$ENGRAM_PUBLIC_URL/sync/mutations/pull" --data-urlencode "project=agent-demo"
curl -s -o /dev/null -w "push: %{http_code}\n" -H "Authorization: Bearer $ENGRAM_CLOUD_TOKEN" -H "Content-Type: application/json" \
  -d "{\"entries\":[{\"project\":\"agent-demo\",\"entity\":\"observation\",\"entity_key\":\"$KEY\",\"op\":\"upsert\",\"payload\":{\"sync_id\":\"$KEY\",\"session_id\":\"s1\",\"type\":\"note\",\"title\":\"hello\",\"content\":\"remember this\",\"project\":\"agent-demo\",\"scope\":\"project\"}}]}" \
  "$ENGRAM_PUBLIC_URL/sync/mutations/push"
curl -s -H "Authorization: Bearer $ENGRAM_CLOUD_TOKEN" -G "$ENGRAM_PUBLIC_URL/sync/mutations/pull" --data-urlencode "project=agent-demo" --data-urlencode "since_seq=0" | grep -c "$KEY"
curl -s -o /dev/null -w "dashboard login: %{http_code}\n" -X POST "$ENGRAM_PUBLIC_URL/dashboard/login" --data-urlencode "token=$ENGRAM_CLOUD_TOKEN"

A fresh deploy prints health: 200, anonymous pull: 401, push: 200, a count of 1 (the saved observation read back) and dashboard login: 303.

Why Deploy Engram Cloud on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Engram Cloud on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Agent-ready - generated access token, contract block and one working script; no setup form.
Shared memory - several machines and agents read and write one store instead of one local file each.
State survives redeploys - memories live in Postgres on a volume.
Token on every route - sync routes reject anonymous callers, and the dashboard needs the same token.
One small Go binary - low memory use, so it costs little to leave running.

Common Use Cases

One memory for a team of coding agents - agents on different machines recall the same decisions and fixes.
Backup and sync of local Engram memory - push a laptop's memory to the server and pull it on another machine.
Browsing what agents learned - open the dashboard to review saved observations by project.

Dependencies for Engram Cloud Hosting

PostgreSQL 17 with one Railway volume, created by the template.

Deployment Dependencies

Implementation Details

Variable	Purpose
`ENGRAM_CLOUD_TOKEN`	Bearer token for the sync API and dashboard login, generated per deploy.
`ENGRAM_JWT_SECRET`	Signing secret for dashboard sessions, generated per deploy.
`ENGRAM_PUBLIC_URL`	HTTPS address for clients outside Railway.
`ENGRAM_PRIVATE_URL`	Address on the private network, for services in the same project.
`ENGRAM_DATABASE_URL`	Connection string to the Postgres service, built from its generated password.

The start command sets the listen host to all interfaces and the port to Railway's injected PORT. Point a local Engram install at the server with its cloud server URL and this token.