---
title: "Deploy Infisical"
description: "Self-hosted Infisical: team secrets manager. Doppler & Vault alternative."
category: "Other"
url: https://railway.com/deploy/infisical-self-hosted
---

# Deploy Infisical

Self-hosted Infisical: team secrets manager. Doppler & Vault alternative.

**[Deploy Infisical on Railway](https://railway.com/template/infisical-self-hosted)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/infisical-self-hosted/manifest.json

- **Creator:** SilverBanana
- **Category:** Other

## Template content

### infisical/infisical:latest-postgres

- **Image:** infisical/infisical:latest-postgres
- **Public domain:** Yes

### Redis https://cdn.sanity.io/images/sy1jschh/production/0ce0bfdcfbdbf69662b1116671f97c2dd788b655-157x157.svg

- **Image:** redis:8.2.1
- **Start command:** `/bin/sh -c "rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH"`

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:17

## Documentation

# Deploy and Host Infisical on Railway

![Infisical secrets management dashboard showing projects and environments](https://raw.githubusercontent.com/Infisical/infisical/main/img/infisical_github_repo4.png)

Infisical is the open-source secrets manager with **29,000+ GitHub stars**: one place to store, sync and inject API keys, database credentials and environment variables across every app and environment. Infisical Cloud Pro costs $20 per identity per month and Doppler Team $21 per user — self-host Infisical on Railway for ~$8–15/month with unlimited users and machine identities, and keep every secret in a database you control.

---

## What This Template Deploys

| Service | Purpose |
|---|---|
| **infisical/infisical:latest-postgres** | Infisical web dashboard, REST API and secret-sync engine (`infisical/infisical:latest-postgres`, port 8080, public HTTPS domain). |
| **Postgres** | PostgreSQL 17 with SSL. Stores organizations, projects, encrypted secrets, versions and audit logs. |
| **Redis** | Redis 8 for caching, rate limiting and background job queues. Infisical won't start without it. |
| **Persistent Volume** | Mounted at `/var/lib/postgresql/data` on Postgres — every secret and project survives redeploys. |
| **Persistent Volume** | Mounted at `/data` on Redis — queued jobs survive restarts. |

Three services wired together through Railway variable references. Infisical connects to Postgres and Redis over the private network.

---

## About Hosting Infisical

Secrets are the one thing you can't afford to leak, which is why many teams want them on infrastructure they own. Running Infisical yourself means PostgreSQL, Redis, TLS, an encryption key that must never change, and a public URL the CLI and SDKs can reach — usually a Docker Compose stack, a reverse proxy and certificates to look after.

On Railway, Infisical gets an HTTPS domain, `SITE_URL` points at it automatically, `ENCRYPTION_KEY` and `AUTH_SECRET` are generated at deploy time, and Postgres and Redis connection strings are injected for you.

**Outgoing email needs the Railway Pro plan.** Infisical sends invites, login alerts and email-based MFA over SMTP, and Railway blocks outbound SMTP on the Hobby plan. Without SMTP, sign-up and login still work, but email MFA, project invites by email and login alerts are off.

Typical cost: **~$8–15/month** on Railway, with no per-user or per-secret fees. Infisical Cloud Pro is $20 per identity per month (billed annually) and AWS Secrets Manager charges $0.40 per secret per month.

---

## Deploy Infisical in Under 5 Minutes

1. Click **Deploy on Railway** — Infisical, Postgres and Redis start together (~3–4 minutes).
2. Leave the generated values as they are — `ENCRYPTION_KEY`, `AUTH_SECRET` and the database and Redis passwords are created for you.
3. Open the Infisical public URL and sign up — the first account becomes the server admin.
4. In the Server Console under **General**, set **Signup mode** to **Disabled** so only invited users can join.
5. Create a project, add secrets per environment, then pull them with `infisical run -- <your command>` or a machine identity.

No Vault cluster to unseal. No reverse proxy. No certificates to renew.

---

## Common Use Cases

- **Self-hosted Doppler alternative** — "open source doppler alternative" without per-user pricing
- **Replace .env files** — one source of truth for dev, staging and production variables
- **CI/CD secrets** — inject secrets into GitHub Actions, GitLab CI and other pipelines with machine identities
- **Secret sync** — push secrets to Railway, Vercel, AWS, Kubernetes and other platforms automatically
- **Kubernetes and Docker** — inject secrets at runtime with the Infisical operator or CLI
- **Pairs with n8n or Chatwoot** — keep API keys for your other self-hosted apps in one vault

---

## Configuration

| Variable | Required | Description |
|---|---|---|
| `ENCRYPTION_KEY` | 🔐 Auto-generated | Encrypts every secret in the database. **Never change it after first deploy** — existing secrets become unreadable. |
| `AUTH_SECRET` | 🔐 Auto-generated | Signs login sessions and tokens. Changing it logs everyone out. |
| `SITE_URL` | ✅ Auto-injected | Public URL of Infisical, used for links, CORS and the CLI. Update it if you add a custom domain. |
| `DB_CONNECTION_URI` | ✅ Auto-injected | PostgreSQL connection string from the Postgres service (private network). |
| `REDIS_URL` | ✅ Auto-injected | Redis connection string from the Redis service. Required to start. |
| `SMTP_HOST`, `SMTP_PORT` | Optional | SMTP server for outgoing email. Requires Railway Pro. |
| `SMTP_USERNAME`, `SMTP_PASSWORD` | Optional | Credentials for the SMTP server. |
| `SMTP_FROM_ADDRESS`, `SMTP_FROM_NAME` | Optional | Sender address and name on Infisical emails. |
| `SMTP_SECURE` | Optional | Use TLS for the SMTP connection. |

**Back up `ENCRYPTION_KEY` outside Railway.** It's the one value that can't be recovered: if the service is recreated with a new key, every stored secret is lost even though the database is intact.

---

## Infisical vs. Alternatives

| | Infisical (Railway) | Doppler | AWS Secrets Manager | HashiCorp Vault |
|---|---|---|---|---|
| **Monthly cost** | ~$8–15 total usage | $21 per user (Team) | $0.40 per secret + API calls | Free to self-host; Enterprise paid |
| **Self-hosted** | ✅ Yes | ❌ No | ❌ No | ✅ Yes |
| **Per-user pricing** | ✅ None | ❌ Per user | ✅ None | ✅ None (self-hosted) |
| **Web dashboard for teams** | ✅ Yes | ✅ Yes | ⚠️ AWS console | ⚠️ Basic UI |
| **Secret sync to platforms** | ✅ Built in | ✅ Built in | ❌ AWS only | ⚠️ Via plugins |
| **Setup effort** | ✅ One click | ✅ SaaS | ✅ Managed | ❌ Unseal, policies, HA |
| **Data stays on your infra** | ✅ Yes | ❌ No | ⚠️ In your AWS account | ✅ Yes |
| **License** | ✅ MIT (core) | ❌ Proprietary | ❌ Proprietary | ⚠️ BSL 1.1 |

---

## Dependencies for Infisical Hosting

- Railway account — Hobby ($5/month) works; Pro ($20/month) is needed for outgoing email. Plan for ~0.6–1 GB RAM across the three services.
- An SMTP provider (Amazon SES, Postmark, Mailgun, SendGrid) for invites, alerts and email MFA.
- The Infisical CLI or SDKs on the machines that read secrets.

### Deployment Dependencies

- [Infisical GitHub](https://github.com/Infisical/infisical) — source and releases
- [Infisical Self-Hosting Docs](https://infisical.com/docs/self-hosting/overview) — setup and environment variables
- [Infisical CLI](https://infisical.com/docs/cli/overview) — inject secrets into local and CI commands
- [Railway Volumes Documentation](https://docs.railway.com/volumes) — persistence

### Implementation Details

The template runs the official `infisical/infisical:latest-postgres` image on port 8080 with `ghcr.io/railwayapp-templates/postgres-ssl:17` and `redis:8.2.1`. Infisical reaches Postgres through `DB_CONNECTION_URI` and Redis through `REDIS_URL`, both over Railway's private network. Postgres data lives on a volume at `/var/lib/postgresql/data` and Redis data at `/data`.

The setting that matters most is `ENCRYPTION_KEY`: it's generated once and encrypts every secret, so copy it somewhere safe and never change it. `SITE_URL` must match the URL people and the CLI use — update it when you add a custom domain.

---

## Frequently Asked Questions

**What is Infisical and why self-host it?**
Infisical is an open-source platform for managing secrets and environment variables across apps, teams and environments. Self-hosting keeps every secret in your own database and removes per-user pricing.

**How much does self-hosting Infisical cost compared to Doppler or Infisical Cloud?**
About $8–15/month in Railway usage, with unlimited users and machine identities. Doppler Team is $21 per user per month and Infisical Cloud Pro is $20 per identity per month (billed annually), so a 10-person team pays around $200/month on those plans.

**Why are Infisical invite or MFA emails not sending?**
Set `SMTP_HOST`, `SMTP_PORT`, `SMTP_USERNAME`, `SMTP_PASSWORD` and `SMTP_FROM_ADDRESS` on the Infisical service, and use Railway Pro — Railway blocks outbound SMTP on the Hobby plan, so emails time out there even with correct settings.

**Do I lose my secrets when I redeploy?**
No. Secrets are stored encrypted in Postgres on a persistent volume and survive redeploys and upgrades. They stay readable only while `ENCRYPTION_KEY` is unchanged, so back that value up.

**Can Infisical sync secrets to Railway, Vercel or GitHub Actions?**
Yes. Infisical has built-in secret syncs and integrations for platforms including Railway, Vercel, AWS, GitHub, GitLab and Kubernetes, plus a CLI and SDKs for injecting secrets at runtime.

**Is self-hosted Infisical free for commercial use?**
Yes. The core is MIT-licensed with unlimited users. Code under the `ee/` directories is licensed separately, and enterprise features such as SAML/OIDC SSO, SCIM, approval workflows and SIEM audit-log streaming need a paid license.

---

## Why Deploy and Host Infisical on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Infisical on Railway, you get a team secrets manager with secret syncs, a CLI and machine identities for a flat usage cost, with every secret encrypted in a database you own.


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/infisical-self-hosted