Deploy and Host Infisical on Railway

Infisical is an open-source platform for secrets, certificates and keys. Your team stores API keys, database passwords and environment variables in one place, and apps, CI pipelines and servers pull them at runtime instead of reading .env files passed around in chat.

About Hosting Infisical

This template runs the official infisical/infisical image (pinned to v0.167.2) with Postgres and Redis on Railway's private network. The web app and API share one public HTTPS address. Database migrations run on every boot, so there is nothing to set up by hand.

It also closes the gap every plain Infisical install has: a fresh instance hands its admin account to whoever opens /admin/signup first. Here the admin account is created for your email on first boot, before the page is reachable, and open sign-ups are switched off at the same moment.

Common Use Cases

Replace shared .env files with one source of truth for development, staging and production
Inject secrets into apps and CI with the Infisical CLI (infisical run -- npm start) or the SDKs
Sync secrets to GitHub Actions, Vercel, AWS, Kubernetes and other platforms
Rotate database credentials, issue internal TLS certificates, and keep an audit log of who read what

Dependencies for Infisical Hosting

Postgres (stores secrets, encrypted with your ENCRYPTION_KEY)
Redis (job queues, rate limiting and caching)

Deployment Dependencies

Infisical source: https://github.com/Infisical/infisical
Self-hosting docs: https://infisical.com/docs/self-hosting/overview
Image: https://hub.docker.com/r/infisical/infisical

Implementation Details

Signing in. The deploy form asks for one thing: your email. On first boot the template creates the admin account for it, with a password generated in the INFISICAL_ADMIN_PASSWORD variable. Open the Infisical service's Variables tab, copy that password, then open the public URL and sign in. Infisical walks you through a short admin setup (invite-only access is already selected). Change your password afterwards under Personal Settings: the variable is read only once, at first boot, so editing it later does nothing.

You will see Create your Infisical administrator account at .../admin/signup in the first boot logs. That line is printed by Infisical before the template claims the instance; the next line, [railway-bootstrap] admin account created for , is the one that counts. Later boots log Instance has already been set up, which is expected.

Back up ENCRYPTION_KEY. It is generated per deploy and encrypts every secret in the database. If it is lost or changed, the data cannot be decrypted. Copy it somewhere safe right after deploying.

Email (optional, add any time). Without SMTP, Infisical shows an "SMTP has not been configured" banner and cannot send invites or password-reset mail; everything else works. To enable it, add these to the Infisical service and redeploy:

Variable	Example
`SMTP_HOST`	`smtp.resend.com`
`SMTP_PORT`	`587`
`SMTP_USERNAME`	your provider's username
`SMTP_PASSWORD`	your provider's API key
`SMTP_FROM_ADDRESS`	`infisical@yourdomain.com`
`SMTP_FROM_NAME`	`Infisical`

Variables

Variable	What it does
`INFISICAL_ADMIN_EMAIL`	Your email, used once to create the admin account
`INFISICAL_ADMIN_PASSWORD`	Generated first-login password, read once at first boot
`INFISICAL_ORG_NAME`	Name of the organization created for you
`ENCRYPTION_KEY`	Root encryption key. Never change it after the first boot
`AUTH_SECRET`	Signs login sessions. Changing it signs everyone out
`SITE_URL`	Public URL. Update it if you add a custom domain
`HOST`, `PORT`	Bind address and port. Leave them as they are

Custom domain. Add it in the Infisical service's Settings, Networking, then set SITE_URL to https://your.domain and redeploy.

Upgrading. Change the image tag in Settings, Source to a newer infisical/infisical:vX.Y.Z and redeploy. Migrations run automatically on boot. Back up Postgres first.

Troubleshooting

Lost the admin password, no SMTP configured: add SMTP (above), then use Forgot password on the sign-in page.
Login works but links in emails point to the wrong host: SITE_URL does not match the address you use.
Infisical restarts during the first deploy: it can start before Postgres accepts connections. It retries on its own and comes up once the database is ready.

Security. Postgres and Redis have no public address; only the Infisical web app is exposed. Turn on two-factor authentication for the admin account under Personal Settings.

Why Deploy Infisical on Railway?

A secrets manager has to be always on, reachable over HTTPS from your laptops and CI, and backed by a database you control. Railway gives you all three in one click, with private networking between the app and its data, and this template makes sure the instance is yours from the first second it is online.