---
title: "Deploy Infisical — Open Source Secrets Manager & Vault"
description: "Self-host Infisical — manage API keys, secrets & certs securely"
category: "Authentication"
url: https://railway.com/deploy/infisical-secrets-vault
---

# Deploy Infisical — Open Source Secrets Manager & Vault

Self-host Infisical — manage API keys, secrets & certs securely

**[Deploy Infisical — Open Source Secrets Manager & Vault on Railway](https://railway.com/template/infisical-secrets-vault)**

- **Creator:** SilverBanana
- **Category:** Authentication
- **Total deploys:** 2

## Template content

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

### Infisical https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/infisical.svg

- **Image:** infisical/infisical:latest

### Redis https://cdn.sanity.io/images/sy1jschh/production/0ce0bfdcfbdbf69662b1116671f97c2dd788b655-157x157.svg

- **Image:** redis:8.2.1
- **Start command:** `/bin/sh -c "rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH"`

## Documentation

# Deploy and Host Infisical on Railway

Infisical is an open-source, end-to-end encrypted secrets platform — a self-hosted alternative to Doppler, HashiCorp Vault, and AWS Secrets Manager. It solves secret sprawl: API keys, credentials, and certificates scattered across `.env` files, Slack, and CI configs, replaced by a single encrypted source of truth with a clean UI, a CLI, and SDKs. It also includes an internal Certificate Authority and native syncs to 50+ tools. This template deploys the full stack — Infisical, PostgreSQL, and Redis — with the master encryption key handled.

---

## What This Template Deploys

| Service | Purpose |
| --- | --- |
| **Infisical** | The secrets platform, web dashboard, and API on port `8080` |
| **PostgreSQL** | Encrypted secrets, projects, users, and audit logs |
| **Redis** | Caching and session storage |

All three run on Railway's private network, so no secrets travel over the public internet. Infisical is a standalone Node.js image; Postgres holds the encrypted data and Redis handles caching.
---

## About Hosting

Infisical stores your most sensitive data, so one setting matters above all others — get it right and back it up.

**`ENCRYPTION_KEY` is the master key to every secret — never lose it or change it.** Infisical encrypts every stored secret with `ENCRYPTION_KEY`. If it's lost or regenerated on a redeploy, **every secret in your vault becomes permanently undecryptable** — you're locked out of your own API keys, credentials, and certificates, with no recovery. Generate it once in the correct format (`openssl rand -hex 16`), pin it, and back it up offline. `AUTH_SECRET` (`openssl rand -base64 32`) signs sessions and should likewise stay stable. This template sets both at deploy so a redeploy never orphans your secrets.

**It's a three-service stack — Postgres and Redis are both required.** PostgreSQL holds all encrypted data (this is what to back up), and Redis handles caching and sessions (no critical long-term data, but Infisical needs it running). Both are wired over the private network.

**`SITE_URL` must be your Railway domain, and the DB variable is `DB_CONNECTION_URI`.** Set `SITE_URL` to your public Railway URL or the dashboard and email links misbehave. Infisical uses `DB_CONNECTION_URI` (not `DATABASE_URL`) and `REDIS_URL` — this template wires them from Railway reference variables.

**More than env vars: PKI and integrations.** Infisical includes an internal Certificate Authority for X.509 certs, native syncs to GitHub Actions, Vercel, AWS, Kubernetes, Terraform, and 50+ more, RBAC with audit logs, and a Kubernetes operator — a full secrets-and-certs platform, not just a `.env` replacement. Pin a specific image tag rather than `latest`; Infisical moves fast and can ship breaking changes.

Typical cost: **~$10–15/month** on Railway across the three services. Infisical is MIT-licensed and free to self-host.

---

## How It Compares

| | Infisical (self-hosted) | HashiCorp Vault | Doppler | AWS Secrets Manager |
| --- | --- | --- | --- | --- |
| Cost model | Flat infra | Infra + complexity | Per user/month | Per secret/month |
| Ease of use | Developer-friendly UI | Powerful but complex | Easy, managed | AWS-tied |
| Certificate authority | Built-in | Yes | No | Via ACM |
| Integrations | 50+ native syncs | Extensive | Many | AWS ecosystem |
| Data ownership | Full — your DB | Full | Vendor | Vendor |
| Self-hostable | Yes | Yes | No | No |

HashiCorp Vault is powerful but notoriously complex to operate. Doppler and AWS Secrets Manager are managed but keep your secrets on their infrastructure and bill per user or per secret. Infisical's edge is a genuinely developer-friendly experience — clean UI, CLI, 50+ integrations, and built-in PKI — fully self-hosted with your secrets in your own database.

---

## Deploy in Under 5 Minutes

1. Click **Deploy on Railway** — Infisical, PostgreSQL, and Redis build automatically (~4 minutes)
2. Confirm `ENCRYPTION_KEY` and `AUTH_SECRET` are set — and save the encryption key somewhere safe
3. Set `SITE_URL` to your Railway public domain
4. Confirm `DB_CONNECTION_URI` and `REDIS_URL` point at the Postgres and Redis services
5. Open your domain, create your organization and first project, and start adding secrets

Then use the Infisical CLI (`infisical run -- npm start`) or an SDK to inject secrets at runtime.

---

## Common Use Cases

- **End secret sprawl** — one encrypted source of truth instead of API keys scattered across `.env` files and Slack
- **CI/CD secret injection** — feed secrets into GitHub Actions, GitLab CI, or Jenkins via the CLI without hardcoding
- **Local development** — run `infisical run -- ` to pull env vars at runtime instead of emailing `.env` files
- **Internal PKI** — issue and manage X.509 certificates with the built-in Certificate Authority
- **Machine identity management** — RBAC and audit logs for both human and machine identities with full history

---

## Configuration

| Variable | Required | Description |
| --- | --- | --- |
| `ENCRYPTION_KEY` | Required | Master key encrypting all secrets — `openssl rand -hex 16`. Never change or lose it |
| `AUTH_SECRET` | Required | Signs authentication sessions — `openssl rand -base64 32`, keep stable |
| `DB_CONNECTION_URI` | Auto-injected | PostgreSQL connection (Infisical's variable name, not `DATABASE_URL`) |
| `REDIS_URL` | Auto-injected | Redis connection via Railway reference variable |
| `SITE_URL` | Required | Your Railway public domain — dashboard and email links build from it |
| `HOST` | Pre-set | `0.0.0.0` so Railway can route to the service |

> **`ENCRYPTION_KEY` is the master key — back it up offline.** It encrypts every secret. If it's lost or regenerated on redeploy, your entire vault becomes permanently undecryptable with no recovery. Generate it once, keep it stable, and store a copy somewhere safe outside Railway.

> **Three services, and `SITE_URL` must match.** Postgres (back this up) and Redis are both required. Set `SITE_URL` to your real Railway domain; note the DB variable is `DB_CONNECTION_URI`, not `DATABASE_URL`.

---

## Dependencies for Infisical Hosting

- Railway account — ~$10–15/month across the three services
- PostgreSQL and Redis (both included)
- A secure, separate backup of `ENCRYPTION_KEY`
- Optional: SMTP credentials for email invitations and notifications

### Deployment Dependencies

- [Infisical GitHub Repository](https://github.com/Infisical/infisical)
- [Infisical Self-Hosting Documentation](https://infisical.com/docs/self-hosting/overview)
- [Standalone Docker Deployment](https://infisical.com/docs/self-hosting/deployment-options/standalone-infisical)
- [Railway Private Networking](https://docs.railway.com/guides/private-networking)

### Implementation Details

The template runs the standalone `infisical/infisical` image on port `8080` against a Railway PostgreSQL service and a Redis service, all on the private network so secrets never traverse the public internet. PostgreSQL stores every encrypted secret, project, identity, and audit record, while Redis provides caching and session storage without holding critical long-term data.

`ENCRYPTION_KEY` is the root of the encryption scheme — every secret is encrypted against it, so it is set once at deploy and must never change, or stored secrets become unrecoverable. `AUTH_SECRET` signs sessions. Connections use Infisical's own variable names, `DB_CONNECTION_URI` and `REDIS_URL`, supplied through Railway reference variables, and `SITE_URL` is set to the public domain for correct dashboard and email link generation.

Beyond secret storage, Infisical provides an internal Certificate Authority, 50+ native integrations, SDKs for Node.js, Python, Go, Ruby, Java, and .NET, and a Kubernetes operator, configured from the dashboard after first login. Pinning a specific image tag is recommended, since upstream releases can introduce breaking changes.
---

## Frequently Asked Questions

**What happens if I lose the `ENCRYPTION_KEY`?** Every stored secret becomes permanently undecryptable — there is no recovery. It's the master key to your vault, so generate it once, keep it stable across redeploys, and back it up somewhere safe outside Railway. This template sets it at deploy for that reason.

**Why does it need both Postgres and Redis?** PostgreSQL stores all encrypted secrets and data (back this up), and Redis handles caching and sessions. Both are required, though Redis holds no critical long-term data.

**How is this different from Vault?** Infisical offers similar core capability with a far gentler learning curve — a clean UI, CLI, 50+ integrations, and built-in PKI — where HashiCorp Vault is powerful but complex to operate.

**How do I inject secrets into my app?** Use the Infisical CLI (`infisical run -- `) or an SDK for your language to fetch secrets at runtime, so nothing is hardcoded or committed to version control.

**Why is the DB variable called `DB_CONNECTION_URI`?** That's Infisical's own variable name for the Postgres connection — not `DATABASE_URL`. This template wires it correctly from Railway's reference variables.

**Should I pin the image version?** Yes. Infisical ships frequently and can introduce breaking changes, so pin a specific tag rather than `latest`.

---

## Why Deploy Infisical on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Infisical on Railway you get a full secrets platform with the critical part handled — the master encryption key set so your vault stays decryptable, Postgres and Redis wired over private networking, and `SITE_URL` configured. End secret sprawl with an encrypted source of truth for API keys, credentials, and certificates, on infrastructure you own.

## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/infisical-secrets-vault