---
title: "Deploy Flipt"
description: "Run Flipt: REST, gRPC and OpenFeature flag evaluation on your own server"
category: "Other"
url: https://railway.com/deploy/flipt-v2
---

# Deploy Flipt

Run Flipt: REST, gRPC and OpenFeature flag evaluation on your own server

**[Deploy Flipt on Railway](https://railway.com/template/flipt-v2)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/flipt-v2/manifest.json

- **Creator:** A3A
- **Category:** Other
- **Total deploys:** 1

## Template content

### flipt https://cdn.jsdelivr.net/gh/flipt-io/flipt@v2.12.0/ui/src/assets/logo-flag.png

- **Source:** https://github.com/gridalpha/flipt-railway
- **Health check:** /health

### gateway https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/caddy.svg

- **Source:** https://github.com/gridalpha/flipt-railway
- **Health check:** /healthz
- **Public domain:** Yes

## Documentation

# Deploy and Host Flipt on Railway

Flipt is an open-source feature flag and experimentation server. Rather than keeping flag state in a proprietary database, Flipt v2 stores every flag, segment and rollout as YAML in a Git repository, so a change made in the web UI is an ordinary commit you can review, revert and diff. Teams use it to ship code behind flags, run percentage rollouts and target releases at specific customers without redeploying. Evaluation happens on your own server, so no user attribute leaves your infrastructure — the usual reason to self-host Flipt instead of paying per seat.

This template runs two services. `flipt` is the server: the UI, the REST and gRPC evaluation APIs and an OpenFeature-compatible OFREP endpoint, with its Git repository on a persistent volume. `gateway` is a Caddy reverse proxy holding the only public domain, which puts HTTP basic authentication in front of everything and forwards requests to `flipt` privately with the server's own API token attached. Applications in the same project call `flipt.railway.internal` directly.

![Flipt server and Caddy gateway services on Railway](https://res.cloudinary.com/rroe4rtk/image/upload/f_auto,q_auto/v1789516835/flipt-architecture.webp)

## Getting Started with Flipt on Railway

The deploy generates `GATEWAY_PASSWORD` on the `gateway` service; copy it from that service's Variables tab, or set your own. With the username `admin` it protects the whole deployment. Open the gateway's public URL, answer the browser's prompt, and you land on an onboarding page — click **Continue to Dashboard** to reach **Flags**. There is no sign-up or setup wizard.

Create your first flag with **New Flag**. Choose **Boolean** for an on/off switch or **Variant** to return one of several values, name it, save, then add variants or a percentage rollout on the flag's page. Create a **Segment** next — a named set of constraints such as `plan == beta` — and attach it as a rule so the flag returns a specific value for matching users.

The quickest way to confirm everything works is the **Playground**: pick the flag, enter any entity ID, put a context like `{"plan": "beta"}` in the request box and press **Evaluate**. A response reading `"reason": "MATCH_EVALUATION_REASON"` means storage, rules and evaluation are all working. Every change is a commit in the repository on the volume, and the API returns that commit SHA as its `revision`.

![Flipt flag list showing a boolean and a variant flag](https://res.cloudinary.com/rroe4rtk/image/upload/f_auto,q_auto/v1789516837/flipt-flag-list.webp)

![Flipt variant flag with two named ranking variants](https://res.cloudinary.com/rroe4rtk/image/upload/f_auto,q_auto/v1789516839/flipt-variant-flag.webp)

![Flipt playground returning the neural variant for a beta user](https://res.cloudinary.com/rroe4rtk/image/upload/f_auto,q_auto/v1789516840/flipt-playground.webp)

## About Hosting Flipt

Flipt is a single Go binary with no external database requirement, which makes it cheap to self-host. Teams reach for it when flag data is sensitive, when evaluation latency matters, or when they want flags in version control beside the code they gate.

- Boolean flags, multivariate flags and percentage rollouts
- Segments with string, number, boolean and date constraints
- REST, gRPC and OFREP (OpenFeature) APIs, with SDKs for Go, Java, JavaScript, Python, Ruby, Rust, PHP and .NET
- Multiple environments and namespaces, mapped to Git branches or directories
- Server-Sent Events streaming, so SDKs pick up changes without polling
- API tokens, OIDC, GitHub OAuth, JWT and Kubernetes auth

The `flipt` service owns all state: its volume holds a real Git repository at `/var/opt/flipt/data`, so history and blame come for free. The `gateway` service adds the authentication layer Flipt cannot supply without an external identity provider, and is where `/metrics` and the profiling endpoints stay closed to the internet.

## Why Deploy Flipt on Railway

Railway removes most of the setup:

- The volume, private networking and health checks are configured for you
- Both services build from a public repository and redeploy on push
- A public HTTPS domain with certificates is issued automatically
- No database to provision, tune or back up separately
- Basic authentication is on from the first deploy, not added later

## Common Use Cases

- **Trunk-based development** — merge unfinished work behind a disabled flag, turn it on when ready
- **Gradual rollouts** — release a risky change to 5% of traffic, watch your metrics, widen it
- **Customer-specific features** — gate a beta module on a segment matching plan, region or account ID, or kill a failing code path in seconds without a deploy

## Dependencies for Flipt

- `flipt` — from `flipt/flipt:v2`, the stable v2 line (`latest` still points at Flipt v1). Serves HTTP on 8080 and gRPC on 9000, with a 5 GB volume at `/var/opt/flipt`.
- `gateway` — from `caddy:2-alpine`. Terminates the public domain, enforces basic authentication and proxies to `flipt` privately.

There is no database, cache or object storage service: Git-backed storage replaces all three.

### Environment Variables Reference

| Variable | Service | Purpose |
|---|---|---|
| `GATEWAY_USERNAME` | gateway | Basic-auth username, `admin` by default |
| `GATEWAY_PASSWORD` | gateway | Basic-auth password, generated at deploy |
| `FLIPT_AUTH_TOKEN` | gateway | API token the proxy sends upstream |
| `FLIPT_AUTHENTICATION_REQUIRED` | flipt | Rejects unauthenticated API calls |
| `FLIPT_STORAGE_DEFAULT_BACKEND_TYPE` | flipt | `local` keeps flags on the volume |
| `FLIPT_LOG_LEVEL` | flipt | `INFO`, or `DEBUG` when troubleshooting |

### Deployment Dependencies

- Source repository: https://github.com/gridalpha/flipt-railway
- Upstream project: https://github.com/flipt-io/flipt
- Documentation: https://docs.flipt.io/v2/introduction

## Hardware Requirements for Self-Hosting Flipt

| Resource | Minimum | Recommended |
|---|---|---|
| CPU | 0.5 vCPU | 1–2 vCPU |
| RAM | 256 MB | 512 MB–1 GB |
| Storage | 1 GB volume | 5 GB volume |
| Runtime | Linux container | Linux container |

Flipt loads flag state into memory and evaluates locally, so responses are sub-millisecond and the server stays small even with thousands of flags.

## Self-Hosting Flipt with Docker

One command starts the server with an in-memory Git repository — fine for a look around, but it loses state on restart:

```
docker run --rm -p 8080:8080 -p 9000:9000 docker.flipt.io/flipt/flipt:v2
```

For anything real, mount a directory and switch the backend to `local` so changes are committed to disk. The image runs as UID 100, so that directory must be writable by it. The `TOKEN_` variables enable a static API token:

```
mkdir -p ./flipt-data && chown 100:1000 ./flipt-data

docker run -d --name flipt -p 8080:8080 -p 9000:9000 \
  -v "$PWD/flipt-data:/var/opt/flipt/data" \
  -e FLIPT_STORAGE_DEFAULT_BACKEND_TYPE=local \
  -e FLIPT_STORAGE_DEFAULT_BACKEND_PATH=/var/opt/flipt/data \
  -e FLIPT_AUTHENTICATION_REQUIRED=true \
  -e FLIPT_AUTHENTICATION_METHODS_TOKEN_ENABLED=true \
  -e FLIPT_AUTHENTICATION_METHODS_TOKEN_STORAGE_TYPE=static \
  -e FLIPT_AUTHENTICATION_METHODS_TOKEN_STORAGE_TOKENS_ADMIN_CREDENTIAL=change-me \
  flipt/flipt:v2
```

Evaluate a flag by `POST`ing `flagKey`, `entityId` and an optional `context` to `/evaluate/v1/variant`.

## How Much Does Flipt Cost to Self-Host?

Flipt is free and source-available under the Fair Core License, which converts to MIT two years after each release. Everything in this template — flags, segments, rollouts, every evaluation API and all authentication methods — is in the free edition. Flipt Pro, $200/month or $2,000/year, adds merge proposals through GitHub, GitLab, Bitbucket, Azure DevOps or Gitea, GPG-signed commits, and secrets providers such as HashiCorp Vault. On Railway you pay only for compute and storage.

## FAQ

**What is Flipt?**
Flipt is an open-source feature flag server. It stores flags, segments and rollout rules, then answers evaluation requests from your applications over REST, gRPC or OpenFeature's OFREP.

**What does this Railway template deploy?**
Two services: `flipt`, the feature flag server with a volume for its Git-backed storage, and `gateway`, a Caddy proxy that owns the public domain and requires HTTP basic authentication.

**Why does the template include a separate gateway service?**
Flipt v2 only establishes a browser session through OIDC or GitHub OAuth, both of which need credentials you register with an identity provider first. The gateway supplies basic authentication instead, so the deployment is protected from the moment it is live.

**Does Flipt need a database?**
No. Flipt v2 keeps flag state as YAML in a Git repository on the attached volume, so there is no Postgres, MySQL or Redis service to run. Deleting the volume deletes your flags.

**How do I connect an SDK to self-hosted Flipt?**
Point the SDK at `http://flipt.railway.internal:8080` if your application runs in the same Railway project, or at the public gateway URL otherwise, and send the API token as an `Authorization: Bearer` header. Bearer requests pass straight through the gateway to Flipt, which validates them itself.

**Can I sync my flags to a GitHub repository?**
Yes. Set a remote and credentials on the `flipt` service and it pushes and pulls flag changes against your own repository. Opening merge proposals from the UI is a Flipt Pro feature; Git push and pull is not.

**How do I enable OIDC or GitHub login on self-hosted Flipt?**
Set `FLIPT_AUTHENTICATION_METHODS_OIDC_ENABLED=true` on the `flipt` service with your provider's client ID, client secret and redirect address, or the GitHub equivalents. Flipt then manages browser sessions itself.


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/flipt-v2