Deploy and Host Infisical Self-Hosted on Railway

Infisical is the open-source platform for storing, syncing, and managing secrets and environment variables across your team, CI/CD pipeline, and infrastructure. Secrets are encrypted end-to-end, and role-based access control keeps every environment's credentials scoped to the people who actually need them, not shared in a Slack message or a .env file nobody remembers to delete.

About Hosting Infisical-Self-Hosted

Infisical Cloud's Pro plan runs $20/identity/month billed annually ($23 month-to-month), and the Advanced plan, needed for dynamic secrets and SOC 2 features, runs $40/identity/month. Both scale directly with how many team members and machine identities you add, which adds up fast for a team issuing separate identities to CI pipelines, staging servers, and production services. Self-hosted Infisical on Railway costs a flat infrastructure fee no matter how many identities or secrets you're managing.

The bigger reason to self-host a secrets manager specifically isn't only the per-identity pricing curve. A secrets manager is, by definition, the one service that touches every other credential in your stack, database passwords, API keys, signing certificates. Keeping that on infrastructure you control, rather than a third party's cloud, is a meaningfully different security posture than self-hosting something lower-stakes.

It's worth being direct about something easy to get wrong when picking an Infisical image to self-host: some existing templates use the infisical/infisical:latest-postgres tag, but that specific tag hasn't been pushed in over a year, confirmed directly via Docker Hub's tags API, well behind Infisical's actual current release. Infisical's own current docker-compose.prod.yml uses a plain, unsuffixed tag, a leftover naming convention from when the image needed to distinguish database backends. This template pins a real current numbered version instead of either the stale suffixed tag or an unpinned floating one.

This isn't a small or unproven project either. Infisical has real production traction specifically among engineering teams that outgrew a shared password manager or scattered .env files, with official SDKs and CLI integrations across most major languages and CI platforms. That matters for infrastructure you're depending on: a secrets manager with real momentum keeps adding integrations and security features, a smaller project can fall behind on both.

Common Use Cases

Team-wide secret sharing: Replace scattered .env files and shared password managers with one access-controlled source of truth.
CI/CD pipeline secrets: Inject secrets into build and deploy pipelines via Infisical's CLI instead of hardcoding them into CI config files.
Multi-environment configuration: Keep development, staging, and production secrets cleanly separated with per-environment access control.
Machine identity credentials: Issue scoped, auditable credentials to services and automated jobs instead of sharing one static key everywhere.
Startups and teams outgrowing shared password managers: Move to real access control and audit logging before an ad-hoc secrets process becomes a security incident.

Dependencies for Infisical-Self-Hosted Hosting

A Postgres database to store encrypted secrets and configuration.
Redis for caching and background job processing.
Nothing beyond those two, no separate message queue or coordination service required.

Deployment Dependencies

This template provisions the Infisical app alongside a Postgres database and Redis instance, using Railway's own native database plugins rather than custom Dockerfiles. Reference: Infisical GitHub Repository, Infisical Self-Hosting Docs, Infisical Environment Variables Reference.

Implementation Details

This template runs infisical/infisical:v0.162.15, Infisical's own official image, confirmed via Docker Hub's tags API as matching the current latest tag's digest exactly at authoring time, not a stale or third-party rebuild. Railway's native Postgres and Redis plugins are used instead of custom Dockerfile-based databases, confirmed by reading Infisical's own database connection source code (backend/src/db/instance.ts) that SSL is entirely optional and only activates if a root certificate is explicitly supplied, so there's no functional reason to add the extra complexity a custom SSL-terminated Postgres image would bring. Database migrations run automatically as part of the backend's own startup sequence (main.ts imports and calls runMigrations from auto-start-migrations before the server starts accepting requests), confirmed by reading the real source rather than assumed, no manual migration command needed after deploying.

How Infisical Compares to the Alternatives

Vs. HashiCorp Vault: Vault is powerful but requires significantly more configuration to get a usable UI and policy setup running from scratch. Infisical ships a ready-to-use web dashboard out of the box, useful the moment it's deployed rather than after a policy-authoring session.

Vs. Doppler: Doppler is cloud-only with no self-hosted option at all, every secret passes through their infrastructure. Infisical can run entirely on infrastructure you control, and its self-hosted tier has no per-seat fee the way Doppler's paid plans do.

Vs. AWS Secrets Manager: AWS Secrets Manager charges per secret per month plus API call volume, and locks you into AWS's own IAM model. Infisical works the same regardless of cloud provider, and self-hosted has one flat infrastructure cost regardless of secret count or API call volume.

Getting Started

After deploying, open your Railway-generated domain and create your first account, this initial signup becomes the instance's super admin, so use a real email you control.

Create your first project and add a secret to a specific environment (development, staging, or production), then confirm it appears correctly in the dashboard. That's a more meaningful test than just confirming the app loads, it proves encryption and storage are both actually working, not just that the server started.

If your team will pull secrets into CI or local development, install Infisical's CLI and authenticate against your new instance's URL, then run a real infisical run command against a project with at least one secret set, confirming secrets actually inject into your environment as expected.

One thing worth doing early rather than after you're depending on this instance: back up your ENCRYPTION_KEY somewhere separate from your database backups. It's the master key protecting every secret stored here, and losing it makes all stored secrets permanently unrecoverable even with an otherwise-intact database backup.

If your team needs multi-factor authentication or invite emails to work, configure the SMTP_* variables on the app service, without them, core secret storage still works, but those specific features silently don't.

Why Deploy Infisical-Self-Hosted on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Infisical-self-hosted on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Frequently Asked Questions

Why does this template avoid the `-postgres` image tag some other Infisical templates use?

Because that specific tag hasn't been updated in over a year relative to Infisical's actual current release, confirmed directly via Docker Hub's tags API. This template pins a real current numbered version of the plain, unsuffixed image instead, matching what Infisical's own current docker-compose file uses.

Do I need to run database migrations myself?

No. Infisical's backend runs its migration step automatically at startup, confirmed by reading the real bootstrap source code, before the server begins accepting requests.

Will my secrets survive a redeploy?

Yes, secrets are stored in the Postgres database, which Railway's native Postgres plugin persists via its own managed volume independent of the app service's own redeploys.

Do I need SSL configured on the database connection?

No, confirmed directly in Infisical's own source code, SSL is entirely optional and only activates if a root certificate is explicitly supplied. Railway's native Postgres plugin works correctly without one.

Is Infisical really free to self-host?

Yes, the core secrets management platform is MIT licensed with no identity or secret-count limits. Infisical Cloud is a separate paid option for teams that want a managed instance instead.

Where can I download Infisical?

Source code is at github.com/Infisical/infisical, with Docker images published to Docker Hub under infisical/infisical. This template pulls a specific verified version automatically.

What happens if I lose my ENCRYPTION_KEY?

Every secret stored in this instance becomes permanently unrecoverable, even with a fully intact database backup. This key never leaves your own control on a self-hosted instance, which is exactly the point, but it also means there's no vendor support line to call if you lose it. Store it somewhere durable and separate from your database backups the moment you deploy.

Can I use a custom domain instead of the Railway-generated one?

Yes, add a custom domain under this service's Settings → Networking, then update the SITE_URL variable to match it exactly, Infisical uses this value for building links in emails and OAuth redirects.