---
title: "Deploy Hashicorp Vault"
description: "Deploy and Host Hashicorp Vault with Railway"
category: "Other"
url: https://railway.com/deploy/hashicorp-vault
---

# Deploy Hashicorp Vault

Deploy and Host Hashicorp Vault with Railway

**[Deploy Hashicorp Vault on Railway](https://railway.com/template/hashicorp-vault)**

- **Creator:** Jonas Atienza's Projects
- **Category:** Other
- **Total deploys:** 13

## Template content

### Vault https://www.datocms-assets.com/2885/1676497447-vault-favicon-color.png?h=192&w=192

- **Source:** jratienza65/vault-railway
- **Public domain:** Yes

## Documentation

# Deploy and Host HashiCorp Vault on Railway

HashiCorp Vault is an open-source secrets management platform that securely stores and manages sensitive data such as API keys, database credentials, tokens, certificates, and encryption keys. With dynamic secrets, encryption-as-a-service, and policy-based access control, Vault provides centralized security for modern applications.

This template deploys Vault on Railway using a single-node Raft storage backend, ready for horizontal scaling into a multi-node HA cluster.

## Quickstart
### Deployment

1. Generate TLS certificates for Vault’s API & cluster interface

```
openssl req -new -x509 -nodes -newkey ec:<(openssl ecparam -name secp384r1) \
  -keyout ./vault.key -out ./vault.crt -days 1095 -subj "/CN=vault"
```


2. Create a new Railway project

3. Add the HashiCorp Vault template to your project

4. Upload the TLS certificate and key as Railway service variables

5. Deploy your Vault instance, which will start in a sealed state

### Post-Deployment

1. Install vault CLI

2. Store your generated/custom API address for Vault in your environment variables

```
export VAULT_ADDR=https://
```

3. Initialize Vault

```
vault operator init
```
Store the unseal keys and initial root token securely.

4. Unseal the Vault server
Run 
```
vault operator unseal
```
until the unseal threshold is met.

5. Log in and enable your desired secret engines and auth methods

```
vault login 
```

6. Vault is now ready to serve secrets over the API and UI.

## About Hosting Vault on Railway

This Vault template uses:

- A single-node Raft backend for durable storage

- TLS-enabled Vault API for secure interactions

- Railway persistent volumes for Raft data

- Private networking for future cluster members
  - Note: Public networking is also possible for clustering with additional configuration. (e.g. using a custom domain or a tunnel, etc...)

Railway handles networking, secret injection, volumes, and scaling, allowing you to run Vault securely without complex infrastructure overhead. You can later add additional nodes to the Raft cluster simply by duplicating the Vault service and adjusting environment variables.

## Common Use Cases

- Secure centralized secrets management for apps and services
- Dynamic database credentials and cloud keys
- Encryption-as-a-service using the Transit engine
- Policy-based access control with audit logging
- Identity federation with JWT/OIDC, Kubernetes, or AppRole

## Single-Node Raft Deployment Overview

This template includes one Vault server configured as:

- Raft leader for storage + coordination

- TLS-secured API endpoint for applications

- Cluster port listener for future scaling

- Persistent data directory for Raft WAL + snapshots

The system is production-ready, and can scale to full HA by adding additional nodes later.

## Dependencies for Hashicorp Vault Hosting

- No external dependencies needed

### Deployment Dependencies

- Hashicorp Vault documentation: https://developer.hashicorp.com/vault/docs
- Vault Docker images: https://hub.docker.com/_/vault

---

## Main Vault Server (vault)
### Purpose

The primary Vault server:
- Runs the Vault API on port 8200
- Exposes the cluster endpoint on port 8201
- Stores encrypted data using integrated Raft storage
- Requires initialization and unsealing
- Serves as the first Raft node in an HA-ready cluster

---

## Storage Backend (Raft)
### Purpose

Integrated storage (Raft):
- Offers secure, high-performance data storage
- Eliminates external database dependencies
- Supports multi-node clustering
- Stores all Vault data encrypted at rest

### Railway Integration

The storage directory `/vault/data` is mounted to a Railway persistent volume, ensuring:

- Durability across deployments

- Safe data recovery

- Smooth vertical/horizontal scaling

## High-Level Flow

1. Vault boots with Raft storage + TLS listeners.

2. Vault starts sealed.

3. Operator runs vault operator init to generate keys.

4. Vault is unsealed and becomes active.

5. Applications authenticate + request secrets via the API.

6. All secrets and metadata are encrypted by Vault and stored in Raft.

## Scaling to HA

This deployment is **ready to scale**. To add a new Vault node:

1. Duplicate the Vault service in Railway

2.1 Join the existing raft cluster using

```
vault operator raft join ""
```
2.2 Or you can use join through the UI

### Why Deploy HashiCorp Vault on Railway?
Railway provides a unified environment for running secure infrastructure components without manual configuration. By hosting Vault on Railway, you gain:

- Automatic persistent storage
- No database dependency (Raft)
- TLS-secured service-to-service networking
- One-click scaling into a multi-node HA cluster
- Straightforward secrets injection into your deployed apps

Railway empowers you to securely manage full-stack application secrets with minimal overhead.

## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — [Jul'26] Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/hashicorp-vault