Deploy and Host Infisical on Railway

Infisical is an open-source platform for secrets, certificates, and privileged access management. Teams keep API keys, database credentials, and certificates in one audited place instead of scattered .env files, then pull them into apps and CI through the Infisical CLI, SDKs, Kubernetes operator, or Terraform provider.

About Hosting Infisical

Hosting Infisical means running the standalone application image next to PostgreSQL and Redis. Postgres holds every encrypted secret, user, project, and audit log. Redis is a hard dependency rather than a cache: it carries the background job queue, distributed locks, and rate limit counters, and the app refuses to start without it. The application image bundles the API, the React dashboard, and the workers in a single Node process on port 8080, and it runs its Knex migrations automatically on every boot, so there is no separate migration step.

This template ships the same three services as the official docker-compose.prod.yml, pinned to infisical/infisical:v0.165.13 rather than latest as upstream recommends. It generates ENCRYPTION_KEY as the required 16-byte hex value and AUTH_SECRET as a high-entropy signing key, sets HOST=0.0.0.0 because Infisical otherwise binds localhost and would fail the healthcheck, pins PORT=8080 so Railway's healthcheck reaches /api/status, and wires SITE_URL to the generated public domain. Redis runs with a generated password, AOF persistence, and maxmemory-policy noeviction, which the upstream hardware requirements call a requirement because evicting queue state silently drops work.

Common Use Cases

Central secret store: one place for API keys and database credentials across dev, staging, and production
Secrets in CI/CD and Kubernetes: inject values at runtime through the CLI, the Kubernetes operator, or the Terraform provider instead of committing them
Machine identities for services: scoped, revocable tokens per app rather than a shared master key
Audit and access control: who read or changed which secret, with per-project roles and approval policies
Secret rotation and dynamic secrets: short-lived database credentials generated on demand

Dependencies for Infisical Hosting

PostgreSQL: required, stores all encrypted state (included)
Redis: required, job queue and coordination state (included)
SMTP: optional, only for invites, password resets, and notifications
Infisical enterprise license: optional, the free self-hosted tier covers projects, secrets, identities, the API, and the CLI

Deployment Dependencies

Implementation Details

The image CMD is ./standalone-entrypoint.sh, which updates CA certificates and then execs the Node server, so no custom start command is needed. Migrations run before the server accepts traffic, which is why the healthcheck timeout is 300 seconds.

PORT=8080
HOST=0.0.0.0
ENCRYPTION_KEY=${{secret(32,"abcdef0123456789")}}
AUTH_SECRET=${{secret(48)}}
DB_CONNECTION_URI=${{Postgres.DATABASE_PRIVATE_URL}}
REDIS_URL=${{Redis.REDIS_URL}}
SITE_URL=https://${{RAILWAY_PUBLIC_DOMAIN}}

First steps after deploy. Open https:///admin/signup as soon as the deploy is green and create the first account. The first person to sign up becomes the instance super admin, so claim it before you share the URL; Infisical disables open signup automatically once that account exists. If you would rather script it, POST /api/v1/admin/bootstrap with {"email","password","organization"} creates the admin, the organization, and an instance admin machine identity, and returns that identity's token for automation. Then create a project, add secrets to the dev, staging, or prod environment, and issue a machine identity for each app that needs to read them.

Back up ENCRYPTION_KEY. It decrypts everything in Postgres. A database backup without that key cannot be restored, and rotating it requires the documented rotation procedure. SMTP is not needed for any of the above; add it later if you want to invite teammates or enable password resets.

Infisical binds 0.0.0.0 so the public domain works, which means it does not answer on *.railway.internal. Other services in the project should call it at its public HTTPS domain. Postgres and Redis stay private, and Postgres gets a TCP proxy for psql and pg_dump.

Why Deploy Infisical on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Infisical on Railway, you get the full three-service stack with generated encryption and signing keys, persistent volumes for Postgres and Redis, health checks, managed SSL, and private networking between the app and its datastores.