Deploy Hexclave | Self-hosted Auth

Hexclave (self-hosted)

About Hosting Hexclave

Hexclave is an open-source "user infrastructure" platform: authentication, teams, and analytics for your app. This template runs Hexclave's official all-in-one server image (dashboard + API in one container) on Railway, alongside the Postgres and ClickHouse databases it needs.

Common Use Cases

• Running your own auth server for a SaaS product without depending on Hexclave Cloud
• Prototyping or testing Hexclave's authentication, teams, and analytics features in an environment you fully control
• Self-hosting user infrastructure for compliance or data-residency reasons

Dependencies for Hexclave Hosting

• Postgres — stores hexclave's own data (projects, users, teams). Included in this template.
• ClickHouse — stores the analytics data hexclave's dashboard reads. Included in this template.
• hexclave-cron — a small scheduled job that calls hexclave's internal maintenance endpoints (email queue, external DB sync) every 5 minutes over Railway's private network, since the Docker image doesn't run its own scheduler. Included in this template.

Why Deploy Hexclave on Railway?

Railway generates the Postgres and ClickHouse passwords for you and wires every service together automatically, so you get a working auth/teams/analytics backend without hand-managing three separate pieces of infrastructure. Railway's private networking also keeps the cron job's calls to hexclave's internal endpoints off the public internet.

Deploy and Host Hexclave on Railway

Click deploy, then complete the one manual step below — hexclave needs to know its own public URL before its dashboard can finish booting correctly.

After you deploy (required)

1. Deploy this template.
2. Open the hexclave service -> Settings -> Networking, and generate two public domains: one targeting container port 8101 (the dashboard) and one targeting port 8102 (the API).
3. Open the hexclave service -> Variables, and set:
   • NEXT_PUBLIC_HEXCLAVE_DASHBOARD_URL to https:// + the port-8101 domain
   • NEXT_PUBLIC_HEXCLAVE_API_URL to https:// + the port-8102 domain
4. Redeploy the hexclave service.
5. Visit the dashboard URL and sign in with the seeded admin account: the email you set in HEXCLAVE_SEED_INTERNAL_PROJECT_USER_EMAIL, and the password in HEXCLAVE_SEED_INTERNAL_PROJECT_USER_PASSWORD (check that service's Variables tab if you left it auto-generated).

Known limitations

• Don't let the seed script re-run on restart. This image's seed script currently errors on its second run — an upstream bug where it tries to update a project it's blocked from updating, which crashes the container. HEXCLAVE_SKIP_SEED_SCRIPT defaults to false so your first deploy seeds correctly; once that first boot succeeds, set it to true so later restarts don't crash.
• Email and webhooks aren't configured out of the box. Password verification codes need HEXCLAVE_EMAILABLE_API_KEY/SMTP configured for real delivery; webhooks need a Svix key. See hexclave's self-host docs for those variables.
• External DB sync runs inline (HEXCLAVE_EXTERNAL_DB_SYNC_DIRECT=true) instead of through Upstash QStash, which this template doesn't set up. Fine for most self-hosted use; configure QStash yourself if you need queued/retryable delivery.