---
title: "Deploy Instatic CMS | (Just Updated) AI Website Builder No Stranger Can Claim"
category: "CMS"
url: https://railway.com/deploy/instatic-cms-v0014-or-ai-website-builder
---

# Deploy Instatic CMS | (Just Updated) AI Website Builder No Stranger Can Claim

**[Deploy Instatic CMS | (Just Updated) AI Website Builder No Stranger Can Claim on Railway](https://railway.com/template/instatic-cms-v0014-or-ai-website-builder)**

- **Creator:** SuperSlowSloth
- **Category:** CMS

## Template content

### instatic

- **Image:** ghcr.io/bon5co/instatic-railway:latest
- **Health check:** /health
- **Public domain:** Yes

## Documentation

# Deploy and Host Instatic CMS on Railway

Instatic is a self-hosted CMS and website builder: a visual page editor, media library,
plugin system, contact forms and AI-assisted authoring, publishing clean framework-free
static HTML from a single Bun server.

This template deploys it **already claimed**. Instatic's first-run wizard is served to
anybody who reaches the URL, and Railway makes that URL public the moment the deploy goes
green — so on a stock deploy the owner account belongs to whoever gets there first. Here the
owner is written into the database before the port is ever bound, from a password Railway
generates for this deployment.

## About Hosting Instatic CMS

One container and one volume. Instatic serves its own admin UI and the published site,
stores content in SQLite, and keeps uploads, published artefacts, fonts, plugins and the
runtime dependency cache on the same disk. There is no separate database server, worker or
cache to run alongside it.

Four things this template fixes relative to a stock deploy:

- **The setup wizard is closed before the first request.** `POST /admin/api/cms/setup` is
  dispatched ahead of every authentication check and creates an `owner` account for any
  anonymous caller while the instance is unclaimed. Here that route answers `409` from the
  first request the public port ever serves.
- **Per-visitor rate limits actually work.** Instatic only trusts `X-Forwarded-For` from a
  configured proxy range, and on Railway every request arrives from the edge — so without
  that setting the whole internet shares one contact-form and one login bucket. Railway's
  edge range is configured here.
- **The runtime dependency cache lives on the volume.** It defaults to `/tmp`, so published
  pages that import an npm dependency lose their JavaScript on every redeploy until the site
  is republished.
- **The image is pinned.** Instatic runs forward-only database migrations on boot and has
  shipped fourteen releases in fifty-one days; an unpinned redeploy is an unrequested
  upgrade with no way back.

## Why Deploy Instatic CMS on Railway?

Railway supplies exactly what this app needs: a container, a persistent disk, a public
domain and a certificate, with no reverse proxy to configure and no database server to
provision. Volume backups are scheduled daily and weekly.

## Common Use Cases

- Personal sites, portfolios, blogs and small-business sites you fully own.
- A visual CMS for a client site that publishes plain static HTML with no framework.
- Self-hosting an AI-assisted website builder where the provider API keys stay on your own
  instance, encrypted at rest.
- Contact forms and media hosting without a third-party form service.

## Dependencies for Instatic CMS Hosting

- A container runtime and one persistent disk. SQLite is built in.
- Outbound internet access for AI provider calls and npm dependency resolution when
  publishing.

### Deployment Dependencies

- Railway volume mounted at `/app/storage` (database, uploads, published artefacts, plugins,
  fonts, runtime cache).
- `INSTATIC_ADMIN_PASSWORD` — generated per deployment; seeds the owner account before the
  server binds. Log in as `admin@example.com` with it.
- `INSTATIC_SECRET_KEY` — generated per deployment; encrypts AI provider credentials and
  MFA secrets at rest. It cannot be rotated without losing what it encrypted.
- `PUBLIC_ORIGIN` — the Railway public domain.
- Public HTTP networking on the injected port, health check at `/health`.


## Similar templates

- [Libredesk - Complete Setup](https://railway.com/deploy/libredesk-complete-setup) — [Jul'26] Complete self-hosted omnichannel customer support desk.
- [Paperless-ngx](https://railway.com/deploy/paperless-ngx-3) — Document management with OCR on Railway with PostgreSQL and Redis
- [Instatic CMS - Postgres](https://railway.com/deploy/instatic-cms-postgres) — Design, build and manage powerful static sites from state-of-the-art CMS

Open this page in a browser: https://railway.com/deploy/instatic-cms-v0014-or-ai-website-builder