Deploy and Host ion-agent on Railway

Ion is a persistent, self-hosted general agent with encrypted memory, provider-neutral AI model access, browser and computer control, document editing, software-development tools, and a web operator interface. This Railway template packages Ion, Ion Computer, Chromium, and ONLYOFFICE into one appliance running as a single Railway service.

About Hosting ion-agent

Railway builds the root Dockerfile into one self-contained appliance that supervises Ion, Ion Computer, Chromium, and ONLYOFFICE. Only Ion’s web interface is publicly exposed through Railway’s generated HTTPS domain; the Computer and document services remain internal. Deployment requires one persistent volume mounted at /data, protected authentication credentials, and a vault encryption key. The appliance automatically uses Railway’s assigned port, exposes /readyz for health checks, and persists agent state, encrypted memory, Computer identity, and documents. Run one replica because the durable databases and Computer state use a single-writer architecture.

Common Use Cases

Run a persistent personal or organizational AI agent with encrypted memory.
Automate browser and graphical desktop workflows through Ion Computer.
Create, open, edit, and manage documents through the integrated Office Studio.
Operate software-development and research workflows from a private web interface.
Connect your preferred supported AI provider without changing the deployment architecture.

Dependencies for ion-agent Hosting

One Railway service with a public HTTPS domain.
One persistent Railway volume mounted at /data.
At least 8 GB RAM, 4 vCPU, and a 40 GB volume are recommended.
ION_AUTH_USERNAME and either ION_AUTH_PASSWORD or ION_AUTH_PASSWORD_HASH.
A protected ION_VAULT_KEK containing a base64-encoded 32-byte encryption key.
An API key and model configuration for your chosen AI provider.

Optional integrations can use variables such as TAVILY_API_KEY and NOVITA_API_KEY.

Deployment Dependencies

Implementation Details

Configure these required Railway service variables:

ION_AUTH_USERNAME=operator
ION_AUTH_PASSWORD=<a>
ION_VAULT_KEK=

Generate the vault encryption key locally:

openssl rand -base64 32

Attach one Railway volume at:

/data

The appliance automatically derives its public origin from RAILWAY_PUBLIC_DOMAIN and listens on Railway’s injected PORT. Its health endpoint is:

/readyz

Ion generates and persists the internal Computer authentication key, Office JWT secret, and Computer host identity automatically. Do not expose additional TCP ports or create separate Computer or ONLYOFFICE services. Keep ION_VAULT_KEK outside the persistent volume and back it up securely alongside the /data volume.

Why Deploy ion-agent on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying ion-agent on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.