--- title: "Deploy Ghost | (Just Updated) Substack Alternative With a Login Nobody Can Steal" description: "Own your newsletter. Admin seeded before boot, nobody can hijack the site." category: "Blogs" url: https://railway.com/deploy/ghost-or-just-updated-substack-alternati --- # Deploy Ghost | (Just Updated) Substack Alternative With a Login Nobody Can Steal Own your newsletter. Admin seeded before boot, nobody can hijack the site. **[Deploy Ghost | (Just Updated) Substack Alternative With a Login Nobody Can Steal on Railway](https://railway.com/template/ghost-or-just-updated-substack-alternati)** - **Creator:** SuperSlowSloth - **Category:** Blogs ## Template content ### ghost - **Image:** ghcr.io/bon5co/ghost-railway:6.60.0 - **Health check:** /healthz - **Public domain:** Yes ### mysql - **Image:** mysql:8.4 - **Start command:** `/bin/sh -c 'MEM=$(cat /sys/fs/cgroup/memory.max 2>/dev/null || echo max); case "$MEM" in ""|max|*[!0-9]*) MEM=2147483648;; esac; BP=$((MEM / 1024 / 1024 * 50 / 100)); [ "$BP" -lt 128 ] && BP=128; echo "[railway] innodb_buffer_pool_size=${BP}M"; exec docker-entrypoint.sh mysqld --innodb-use-native-aio=0 --disable-log-bin --performance_schema=0 --innodb-buffer-pool-size=${BP}M'` ## Documentation # Deploy and Host Ghost on Railway Ghost is the open-source publishing platform behind modern blogs and newsletters — a Substack and Medium alternative you own, with a full editor, members and paid subscriptions, email newsletters and a REST API. This template deploys Ghost 6.60.0 with MySQL on a persistent volume, and it fixes two things a stock Ghost deploy gets wrong on Railway: the admin account is claimed by the first stranger who reaches the URL, and sign-in is impossible without an email server. ## About Hosting Ghost A fresh Ghost install has no owner account. It publishes its setup endpoint at `/ghost/api/admin/authentication/setup/`, and that endpoint is unauthenticated until someone completes it — so on a public Railway URL the first visitor to POST it becomes the Owner, and the person who deployed the site is locked out with no recovery, because Ghost's password reset is an emailed link and a bare deploy cannot send mail. This template closes that window: it seeds the Owner from your variables before the public port ever opens, refuses to boot without a password, and re-applies the credential on every boot so a redeploy is a working password reset. The second problem is the mail server itself. Ghost 6 enforces two-factor authentication for a sign-in from a new device, and the verification code is delivered by email — so with no SMTP configured you can hold the right password and still never get in. This template bundles a self-contained mailbox: verification and test mail land in an inbox served at `/inbox`, behind HTTP basic auth, so you can sign in end-to-end with no third-party email account. Point the `SMTP_*` variables at a real provider when you are ready to send member newsletters, and outbound mail switches over. Ghost runs as one service with a volume at `/var/lib/ghost/content` for uploaded images, themes and settings, alongside a MySQL service with its data on its own volume. The app binds Railway's injected port, is healthchecked, and the image is pinned rather than rebuilt on your build minutes. ## Why Deploy Ghost on Railway? Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it. By deploying Ghost on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway. - **Nobody can steal your site** — the Owner is seeded before the public port opens, so the setup endpoint is already closed the first time anyone reaches it; a stranger's takeover attempt gets a 403. - **You can actually sign in** — a built-in mailbox at `/inbox` delivers the 2FA code Ghost 6 requires, so no external email account is needed to log in for the first time. - **A redeploy is a password reset** — the credential is re-applied on every boot, which is the recovery path a fresh Ghost otherwise does not have. - **Your content survives a redeploy** — uploads, themes and the database are on volumes, not the disposable layer. - **Current Ghost, pinned** — Ghost 6.60.0 on an image that is pulled, not rebuilt, on your build minutes. - **Nothing blank to fill in** — the admin password and database secrets are generated for you; there are no required fields left empty. ## Common Use Cases - **A newsletter you own** — run a paid or free newsletter with members and subscriptions instead of renting an audience on Substack. - **A company or personal blog** — a fast, SEO-ready publication with a real editor and a theme you control. - **A headless content API** — use Ghost's Content and Admin APIs to feed posts into a separate front end. ## Dependencies for Ghost Hosting - A MySQL database (included as a second service on its own volume). - A volume mounted at `/var/lib/ghost/content` (included) for images, themes and settings. ### Deployment Dependencies - [Ghost](https://github.com/TryGhost/Ghost) — the upstream project (MIT) - [bon5co/ghost-railway](https://github.com/bon5co/ghost-railway) — the Railway wrapper image this template deploys ### Implementation Details Open your deployment's URL at `/ghost` and sign in with `GHOST_ADMIN_EMAIL` and the generated `GHOST_ADMIN_PASSWORD` from the Ghost service variables. Ghost 6 will email a verification code on the first sign-in from a new device; read it from the inbox at `/inbox` (log in with `GHOST_INBOX_USER`, default `admin`, and the same admin password). To change the admin password, edit `GHOST_ADMIN_PASSWORD` and redeploy. To send real newsletters and member emails, set `SMTP_HOST`, `SMTP_PORT`, `SMTP_USER` and `SMTP_PASSWORD` to your email provider; outbound mail then leaves the built-in mailbox and goes through them. ## Similar templates - [Pixelfed](https://railway.com/deploy/OZSdEw) — Explore + Share beautiful photos and videos on the Fediverse - [Hexo](https://railway.com/deploy/hexo) — Hexo — fast static blog framework with admin editor and S3 media storage - [Bluesky PDS (Atproto Spaces Alpha)](https://railway.com/deploy/bluesky-pds-atproto-spaces-alpha) — "The Atproto Spaces Alpha" version of Bluesky PDS. Open this page in a browser: https://railway.com/deploy/ghost-or-just-updated-substack-alternati