---
title: "Deploy Infisical (Auto-Bootstrapped)"
description: "Secrets manager, Doppler and Vault alternative, admin claimed on first boot"
category: "Other"
url: https://railway.com/deploy/infisical-auto-bootstrapped
---

# Deploy Infisical (Auto-Bootstrapped)

Secrets manager, Doppler and Vault alternative, admin claimed on first boot

**[Deploy Infisical (Auto-Bootstrapped) on Railway](https://railway.com/template/infisical-auto-bootstrapped)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/infisical-auto-bootstrapped/manifest.json

- **Creator:** Auromations
- **Category:** Other
- **Total deploys:** 1

## Template content

### Infisical https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/png/infisical.png

- **Image:** infisical/infisical:v0.167.2
- **Start command:** `/bin/sh -c "node -e 'const e=process.env,u=`http://127.0.0.1:`+e.PORT;(async()=>{if(!e.INFISICAL_ADMIN_EMAIL)return;for(let i=0;i<300;i++){try{if((await fetch(u+`/api/status`)).ok)break}catch{}await new Promise(r=>setTimeout(r,2000))}const r=await fetch(u+`/api/v1/admin/bootstrap`,{method:`POST`,headers:{[`content-type`]:`application/json`},body:JSON.stringify({email:e.INFISICAL_ADMIN_EMAIL,password:e.INFISICAL_ADMIN_PASSWORD,organization:e.INFISICAL_ORG_NAME||`Infisical`})});const t=await r.text();console.log(`[railway-bootstrap] `+(r.ok?`admin account created for `+e.INFISICAL_ADMIN_EMAIL:r.status+` `+t.slice(0,200)))})()' & exec /backend/standalone-entrypoint.sh"`
- **Health check:** /api/status
- **Public domain:** Yes

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

### Redis https://cdn.sanity.io/images/sy1jschh/production/0ce0bfdcfbdbf69662b1116671f97c2dd788b655-157x157.svg

- **Image:** redis:8.2
- **Start command:** `/bin/sh -c "rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH"`

## Documentation

# Deploy and Host Infisical on Railway

[Infisical](https://github.com/Infisical/infisical) is an open-source platform for secrets, certificates and keys. Your team stores API keys, database passwords and environment variables in one place, and apps, CI pipelines and servers pull them at runtime instead of reading `.env` files passed around in chat.

## About Hosting Infisical

This template runs the official `infisical/infisical` image (pinned to v0.167.2) with Postgres and Redis on Railway's private network. The web app and API share one public HTTPS address. Database migrations run on every boot, so there is nothing to set up by hand.

It also closes the gap every plain Infisical install has: a fresh instance hands its admin account to whoever opens `/admin/signup` first. Here the admin account is created for your email on first boot, before the page is reachable, and open sign-ups are switched off at the same moment.

## Common Use Cases

- Replace shared `.env` files with one source of truth for development, staging and production
- Inject secrets into apps and CI with the Infisical CLI (`infisical run -- npm start`) or the SDKs
- Sync secrets to GitHub Actions, Vercel, AWS, Kubernetes and other platforms
- Rotate database credentials, issue internal TLS certificates, and keep an audit log of who read what

## Dependencies for Infisical Hosting

- Postgres (stores secrets, encrypted with your `ENCRYPTION_KEY`)
- Redis (job queues, rate limiting and caching)

### Deployment Dependencies

- Infisical source: https://github.com/Infisical/infisical
- Self-hosting docs: https://infisical.com/docs/self-hosting/overview
- Image: https://hub.docker.com/r/infisical/infisical

### Implementation Details

**Signing in.** The deploy form asks for one thing: your email. On first boot the template creates the admin account for it, with a password generated in the `INFISICAL_ADMIN_PASSWORD` variable. Open the Infisical service's **Variables** tab, copy that password, then open the public URL and sign in. Infisical walks you through a short admin setup (invite-only access is already selected). Change your password afterwards under **Personal Settings**: the variable is read only once, at first boot, so editing it later does nothing.

You will see `Create your Infisical administrator account at .../admin/signup` in the first boot logs. That line is printed by Infisical before the template claims the instance; the next line, `[railway-bootstrap] admin account created for `, is the one that counts. Later boots log `Instance has already been set up`, which is expected.

**Back up `ENCRYPTION_KEY`.** It is generated per deploy and encrypts every secret in the database. If it is lost or changed, the data cannot be decrypted. Copy it somewhere safe right after deploying.

**Email (optional, add any time).** Without SMTP, Infisical shows an "SMTP has not been configured" banner and cannot send invites or password-reset mail; everything else works. To enable it, add these to the Infisical service and redeploy:

| Variable | Example |
| --- | --- |
| `SMTP_HOST` | `smtp.resend.com` |
| `SMTP_PORT` | `587` |
| `SMTP_USERNAME` | your provider's username |
| `SMTP_PASSWORD` | your provider's API key |
| `SMTP_FROM_ADDRESS` | `infisical@yourdomain.com` |
| `SMTP_FROM_NAME` | `Infisical` |

**Variables**

| Variable | What it does |
| --- | --- |
| `INFISICAL_ADMIN_EMAIL` | Your email, used once to create the admin account |
| `INFISICAL_ADMIN_PASSWORD` | Generated first-login password, read once at first boot |
| `INFISICAL_ORG_NAME` | Name of the organization created for you |
| `ENCRYPTION_KEY` | Root encryption key. Never change it after the first boot |
| `AUTH_SECRET` | Signs login sessions. Changing it signs everyone out |
| `SITE_URL` | Public URL. Update it if you add a custom domain |
| `HOST`, `PORT` | Bind address and port. Leave them as they are |

**Custom domain.** Add it in the Infisical service's **Settings, Networking**, then set `SITE_URL` to `https://your.domain` and redeploy.

**Upgrading.** Change the image tag in **Settings, Source** to a newer `infisical/infisical:vX.Y.Z` and redeploy. Migrations run automatically on boot. Back up Postgres first.

**Troubleshooting**

- *Lost the admin password, no SMTP configured*: add SMTP (above), then use **Forgot password** on the sign-in page.
- *Login works but links in emails point to the wrong host*: `SITE_URL` does not match the address you use.
- *Infisical restarts during the first deploy*: it can start before Postgres accepts connections. It retries on its own and comes up once the database is ready.

**Security.** Postgres and Redis have no public address; only the Infisical web app is exposed. Turn on two-factor authentication for the admin account under **Personal Settings**.

## Why Deploy Infisical on Railway?

A secrets manager has to be always on, reachable over HTTPS from your laptops and CI, and backed by a database you control. Railway gives you all three in one click, with private networking between the app and its data, and this template makes sure the instance is yours from the first second it is online.


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/infisical-auto-bootstrapped