Deploy and Host Instatic CMS on Railway

Instatic is a self-hosted CMS and website builder: a visual page editor, media library, plugin system, contact forms and AI-assisted authoring, publishing clean framework-free static HTML from a single Bun server.

This template deploys it already claimed. Instatic's first-run wizard is served to anybody who reaches the URL, and Railway makes that URL public the moment the deploy goes green — so on a stock deploy the owner account belongs to whoever gets there first. Here the owner is written into the database before the port is ever bound, from a password Railway generates for this deployment.

About Hosting Instatic CMS

One container and one volume. Instatic serves its own admin UI and the published site, stores content in SQLite, and keeps uploads, published artefacts, fonts, plugins and the runtime dependency cache on the same disk. There is no separate database server, worker or cache to run alongside it.

Four things this template fixes relative to a stock deploy:

The setup wizard is closed before the first request. POST /admin/api/cms/setup is dispatched ahead of every authentication check and creates an owner account for any anonymous caller while the instance is unclaimed. Here that route answers 409 from the first request the public port ever serves.
Per-visitor rate limits actually work. Instatic only trusts X-Forwarded-For from a configured proxy range, and on Railway every request arrives from the edge — so without that setting the whole internet shares one contact-form and one login bucket. Railway's edge range is configured here.
The runtime dependency cache lives on the volume. It defaults to /tmp, so published pages that import an npm dependency lose their JavaScript on every redeploy until the site is republished.
The image is pinned. Instatic runs forward-only database migrations on boot and has shipped fourteen releases in fifty-one days; an unpinned redeploy is an unrequested upgrade with no way back.

Why Deploy Instatic CMS on Railway?

Railway supplies exactly what this app needs: a container, a persistent disk, a public domain and a certificate, with no reverse proxy to configure and no database server to provision. Volume backups are scheduled daily and weekly.

Common Use Cases

Personal sites, portfolios, blogs and small-business sites you fully own.
A visual CMS for a client site that publishes plain static HTML with no framework.
Self-hosting an AI-assisted website builder where the provider API keys stay on your own instance, encrypted at rest.
Contact forms and media hosting without a third-party form service.

Dependencies for Instatic CMS Hosting

A container runtime and one persistent disk. SQLite is built in.
Outbound internet access for AI provider calls and npm dependency resolution when publishing.

Deployment Dependencies

Railway volume mounted at /app/storage (database, uploads, published artefacts, plugins, fonts, runtime cache).
INSTATIC_ADMIN_PASSWORD — generated per deployment; seeds the owner account before the server binds. Log in as admin@example.com with it.
INSTATIC_SECRET_KEY — generated per deployment; encrypts AI provider credentials and MFA secrets at rest. It cannot be rotated without losing what it encrypted.
PUBLIC_ORIGIN — the Railway public domain.
Public HTTP networking on the injected port, health check at /health.