---
title: "Deploy Heimdall"
description: "One page of tiles linking to every app and service you run"
category: "Other"
url: https://railway.com/deploy/heimdall
---

# Deploy Heimdall

One page of tiles linking to every app and service you run

**[Deploy Heimdall on Railway](https://railway.com/template/heimdall)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/heimdall/manifest.json

- **Creator:** A3A
- **Category:** Other
- **Total deploys:** 1

## Template content

### heimdall https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/heimdall-light.svg

- **Source:** https://github.com/gridalpha/heimdall-railway
- **Health check:** /up
- **Public domain:** Yes

## Documentation

# Deploy and Host Heimdall on Railway

Heimdall is an application dashboard and launcher: one clean page holding a tile for every service you run, with a search bar and live status for apps that expose an API. Built by the LinuxServer.io team in PHP and Laravel and MIT-licensed, it is the default start page for tens of thousands of homelabs and small teams tired of hunting through bookmarks for an internal tool's URL. Pick an app from a catalogue of roughly 700 services and Heimdall fills in its name, colour, description and icon.

This template runs Heimdall as a single Railway service — nginx, PHP-FPM and Heimdall's background queue worker in one container, with a volume at `/config` holding the SQLite database, uploaded icons, backgrounds, sessions and the app catalogue. Railway's edge terminates HTTPS and proxies to nginx, which serves the dashboard and hands PHP requests to PHP-FPM. Self-host Heimdall with no database to size, no mail relay to configure, and an admin password set before the app accepts a request.

![Diagram of the single Heimdall service and its volume on Railway](https://res.cloudinary.com/rroe4rtk/image/upload/v1788988524/heimdall-architecture.png)

## Getting Started with Heimdall on Railway

Open the deployed URL and you land on a login page, not an open dashboard. Sign in with the username in `HEIMDALL_ADMIN_USERNAME` (`admin` unless you changed it) and the password in `HEIMDALL_ADMIN_PASSWORD`; if you left that blank, one was generated and printed once in the deploy log. Change it later by editing the variable, or from the user page inside Heimdall, which redeploys will not overwrite. Then click the grid icon in the right-hand rail, press **ADD**, and pick a service from the Application Type dropdown: Heimdall fills in the title, colour and description, so all you supply is the URL. Toggle **PINNED** and save. Repeat for the services you use daily, add a tag to group them into a folder, and set a background from the settings cog. If the tiles render with their real logos the deployment is working end to end, because those icons are downloaded by the background worker.

![Heimdall dashboard with six pinned self-hosted applications](https://res.cloudinary.com/rroe4rtk/image/upload/v1788988527/heimdall-dashboard.png)
![Heimdall add-application form prefilled from its app catalogue](https://res.cloudinary.com/rroe4rtk/image/upload/v1788988528/heimdall-add-application.png)
![Heimdall application list with titles, links and tags](https://res.cloudinary.com/rroe4rtk/image/upload/v1788988533/heimdall-application-list.png)

## About Hosting Heimdall

Heimdall solves a small problem that gets worse the more you self-host: remembering where everything lives. A team running Grafana, Gitea, a media server and three internal tools ends up with four port numbers and no single door. Heimdall is that door.

Key features:

- **A catalogue of ~700 applications** with icons, brand colours and descriptions filled in
- **Enhanced apps** that poll a supported service's API and show live figures on the tile
- **Search** from the dashboard via Google, Bing, DuckDuckGo, Startpage or your own provider
- **Tags** that behave as folders, so fifty entries still fit on one screen
- **Multiple users** with their own tiles, plus an optional public front page
- **Custom icon uploads** and background images

The dashboard, the API and the worker share one container, and the volume is the whole backup story: snapshot `/config` and you have the deployment.

## Why Deploy Heimdall on Railway

Railway removes the parts of self-hosting Heimdall nobody enjoys.

- HTTPS, a public domain and certificate renewal handled for you
- A persistent volume at `/config` that survives every redeploy
- An admin password set at boot, so the dashboard is never briefly open
- One service to watch, with logs and metrics in the same place
- Redeploys pick up new Heimdall releases automatically
- No database, cache or mail service to provision

## Common Use Cases for Self-Hosted Heimdall

- **A homelab start page** listing every container you run, set as the default browser tab
- **An internal tool index** so new joiners find the wiki, CI server and metrics dashboard on day one
- **A shared kiosk screen** using the public front page, readable without signing in
- **A per-user launcher**, where each account keeps its own tiles on one instance

## Dependencies for Heimdall

- `lscr.io/linuxserver/heimdall:latest` — the LinuxServer.io image, bundling nginx, PHP-FPM and Heimdall
- A Railway volume at `/config` — SQLite database, `.env`, uploads, sessions and the app catalogue
- Outbound HTTPS to `appslist.heimdall.site` and GitHub on first boot, for the catalogue and icons

No database, cache, queue broker or object storage is required. Heimdall's queue runs on the same SQLite file and shares the container so it can write icons to the volume.

### Environment Variables Reference

| Variable | Default | What it does |
|---|---|---|
| `HEIMDALL_ADMIN_USERNAME` | `admin` | Username of the first Heimdall user |
| `HEIMDALL_ADMIN_PASSWORD` | generated | Password applied to that user at boot |
| `APP_URL` | public domain | Root of every URL Heimdall generates |
| `TRUSTED_PROXIES` | `0.0.0.0/0,::/0` | Lets Heimdall read the real client address |
| `ALLOW_INTERNAL_REQUESTS` | `false` | Allows lookups of private or reserved addresses |
| `LOG_LEVEL` | `info` | Laravel log verbosity |
| `TZ` | `Etc/UTC` | Timezone for the container and PHP |

### Deployment Dependencies

- Source repository: [github.com/gridalpha/heimdall-railway](https://github.com/gridalpha/heimdall-railway)
- Heimdall upstream: [github.com/linuxserver/Heimdall](https://github.com/linuxserver/Heimdall)
- Container image: [github.com/linuxserver/docker-heimdall](https://github.com/linuxserver/docker-heimdall)
- Runtime: PHP 8.5, Laravel 13, nginx, SQLite

## Hardware Requirements for Self-Hosting Heimdall

| Resource | Minimum | Recommended |
|---|---|---|
| CPU | 0.25 vCPU | 0.5 vCPU |
| RAM | 256 MB | 512 MB |
| Storage | 1 GB volume | 5 GB volume |
| Runtime | PHP 8.3+, SQLite | PHP 8.5, SQLite |

Heimdall is light: server-rendered HTML, a database measured in hundreds of kilobytes, and no sustained work beyond fetching an icon when you add an app.

## Self-Hosting Heimdall with Docker

The upstream image runs anywhere Docker does. The minimal Docker command:

```
docker run -d --name=heimdall \
  -e PUID=1000 -e PGID=1000 -e TZ=Etc/UTC \
  -p 8080:80 -v /srv/heimdall:/config \
  --restart unless-stopped \
  lscr.io/linuxserver/heimdall:latest
```

The same thing as Docker Compose:

```
services:
  heimdall:
    image: lscr.io/linuxserver/heimdall:latest
    environment: [PUID=1000, PGID=1000, TZ=Etc/UTC]
    volumes: ["./config:/config"]
    ports: ["8080:80"]
    restart: unless-stopped
```

Note what the stock image does *not* do: it creates its first user with an empty password, and every route stays open until you set one. Upstream's answer is to run `htpasswd` in the container by hand and uncomment a block in the nginx config. This template does it for you, before nginx starts.

## How Much Does Heimdall Cost to Self-Host?

Heimdall is free and open source under the MIT licence, with no paid tier, licence key or hosted edition. The only cost is the infrastructure it runs on: on Railway, a small always-on container and a volume, billed by usage with no per-user or per-tile pricing.

## Heimdall vs Homer, Dashy and Homarr

| | Heimdall | Homer | Dashy | Homarr |
|---|---|---|---|---|
| Configuration | Web UI | YAML file | YAML or UI | Web UI |
| App catalogue | ~700 built in | manual | manual | integrations |
| Live app stats | Yes | No | Widgets | Widgets |
| Multi-user | Yes | No | Single auth | Yes |
| Storage | SQLite | Static files | Static files | Database |

## FAQ

**What is Heimdall?**

Heimdall is an open-source application dashboard from LinuxServer.io: a single page of tiles linking to the services you run, with a search bar, tags and a catalogue of around 700 applications supplying each one's icon, colour and description.

**What does this Railway template deploy?**

One service running the official `lscr.io/linuxserver/heimdall:latest` image with a volume at `/config`, a public HTTPS domain, and an admin account created from `HEIMDALL_ADMIN_USERNAME` and `HEIMDALL_ADMIN_PASSWORD` before the app serves its first request.

**Why does Heimdall need a volume instead of a database service?**

Heimdall stores everything in a single SQLite file, and also writes uploaded icons, avatars, backgrounds and its app catalogue to disk. A volume covers both, so backing up `/config` backs up the whole deployment.

**Is self-hosted Heimdall secured by default on Railway?**

Yes. A stock container creates its first user with no password and leaves every route open; this template hashes your password onto that user at boot, closes the registration and password-reset routes, and marks session cookies `Secure` and `HttpOnly`.

**How do I add an application with live stats to my Heimdall dashboard?**

Add the app, then edit it and open the Application Type section. For a supported service — Sonarr, Radarr, Pi-hole, Nextcloud and many more — Heimdall asks for the URL and API key and the tile shows live figures. The request is server-side, so the target must be reachable from the container.

**Can Heimdall link to services on my private network?**

It can link to anything, because your browser follows the link, not the server. Server-side features differ: the website lookup and icon fetch refuse private and reserved addresses unless `ALLOW_INTERNAL_REQUESTS` is `true`, which suits an instance not exposed to the internet.


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/heimdall