Deploy and Host hodor on Railway

Hero image for the hodor reverse proxy

hodor is an ultra-lightweight reverse proxy written in Rust that gates access to any web application behind a single shared password. Operating without user databases or OAuth overhead, hodor delivers instant password protection, HMAC-SHA256 signed session cookies, bidirectional WebSocket support, and automated brute-force defense.

About Hosting hodor

Hodor login page protecting a preview

Deploying hodor on Railway takes seconds. The template automatically generates cryptographically secure values for the cookie-signing secret and access password, leaving you to simply connect your target application using Railway's private networking variables (UPSTREAM_DOMAIN and UPSTREAM_PORT). Because authentication state and brute-force tracking live entirely in memory, no databases or persistent volumes are required. hodor runs with an ultra-lean footprint—consuming approximately 7MB of RAM and negligible CPU—costing mere pennies per month. For additional efficiency, services can enable Railway's sleep-on-idle feature to scale down to zero when traffic stops.

Common Use Cases

Protecting Internal Tools and Dashboards: Gate admin interfaces, internal analytics, remote agents (such as open hands), and monitoring systems (like Prometheus or Grafana) that lack native authentication mechanisms.
Securing Previews and Staging Environments: Shield pre-production deployments, staging previews, or client prototypes behind a private password without configuring an identity provider.
Access Control for Private Microservices: Place a fast, streaming authentication layer with built-in per-IP rate limiting and WebSocket proxying in front of any internal container.

Dependencies for hodor Hosting

Upstream Web Service: An existing service or web app running on Railway (or accessible via network URL) to receive proxied traffic.
Railway Template Variables: Configured parameters for routing (UPSTREAM_DOMAIN, UPSTREAM_PORT) and credentials (PASSWORD, SECRET).
No External Database or Cache: Operates statelessly in memory with zero database or Redis requirements.

Implementation Details

Template Configuration Variables

This template pre-populates secure random defaults while allowing seamless linkage to other Railway services:

Variable	Default / Format	Description
`SECRET`	`${{secret(32)}}`	Auto-generated 32-byte secret used to sign HMAC-SHA256 session cookies.
`PASSWORD`	`${{secret(32)}}`	Auto-generated shared password required to unlock the gate (customizable).
`UPSTREAM`	`http://${{hodor.UPSTREAM_DOMAIN}}:${{hodor.UPSTREAM_PORT}}`	Derived target endpoint that hodor proxies authenticated requests to.
`UPSTREAM_DOMAIN`	e.g., `${{app.RAILWAY_PRIVATE_DOMAIN}}`	The private domain or hostname of your protected upstream container.
`UPSTREAM_PORT`	e.g., `${{app.PORT}}` or `8080`	The listening port on your upstream container.

Routing & Edge Considerations

Private Networking: By routing requests through Railway's private domain network, your upstream app remains entirely unexposed to the public internet.
Proxy Headers: Set TRUST_PROXY=true so hodor inspects incoming X-Forwarded-For headers from Railway's edge proxy, ensuring per-IP brute-force limits track individual visitors accurately.
Health Checks: Orchestrators can monitor liveness at /_gate/health.
UI Customization: Modify styling via CUSTOM_CSS or attach custom HTML templates with TEMPLATE.

Why Deploy hodor on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying hodor on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.