--- title: "Deploy Kong Gateway" description: "Open-source API gateway with Postgres and a password-protected Admin UI" category: "Other" url: https://railway.com/deploy/kong-gateway --- # Deploy Kong Gateway Open-source API gateway with Postgres and a password-protected Admin UI **[Deploy Kong Gateway on Railway](https://railway.com/template/kong-gateway)** Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/kong-gateway/manifest.json - **Creator:** Agaz Self-Host - **Category:** Other - **Total deploys:** 1 ## Template content ### Kong https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/kong.svg - **Image:** kong:3.9.4@sha256:c1f5fbb80cd666b4b29b4e97875ecd64d93b01b23fb3083bc3e424b3bad5fdd5 - **Start command:** `/bin/bash -c 'echo IyEvYmluL2Jhc2gKIyBLb25nIEdhdGV3YXkgb24gUmFpbHdheTogbWlncmF0aW9ucywgcHJvdGVjdGVkIEFkbWluIEFQSSAvIEtvbmcgTWFuYWdlciwgdGhlbiBzdGFydC4Kc2V0IC1lCjogIiR7S09OR19BRE1JTl9QQVNTV09SRDo/S09OR19BRE1JTl9QQVNTV09SRCBtdXN0IGJlIHNldH0iClA9JHtQT1JUOi04MDAwfQpleHBvcnQgS09OR19EQVRBQkFTRT0ke0tPTkdfREFUQUJBU0U6LXBvc3RncmVzfQpleHBvcnQgS09OR19QUk9YWV9MSVNURU49JHtLT05HX1BST1hZX0xJU1RFTjotIjAuMC4wLjA6JFAsIFs6Ol06JFAifQpleHBvcnQgS09OR19BRE1JTl9MSVNURU49JHtLT05HX0FETUlOX0xJU1RFTjotMTI3LjAuMC4xOjgwMDF9CmV4cG9ydCBLT05HX0FETUlOX0dVSV9MSVNURU49JHtLT05HX0FETUlOX0dVSV9MSVNURU46LTEyNy4wLjAuMTo4MDAyfQpleHBvcnQgS09OR19BRE1JTl9HVUlfUEFUSD0ke0tPTkdfQURNSU5fR1VJX1BBVEg6LS9rb25nLW1hbmFnZXJ9CmV4cG9ydCBLT05HX0FETUlOX0dVSV9BUElfVVJMPSR7S09OR19BRE1JTl9HVUlfQVBJX1VSTDotaHR0cHM6Ly8ke1JBSUxXQVlfUFVCTElDX0RPTUFJTjotbG9jYWxob3N0fS9rb25nLW1hbmFnZXIvYXBpfQpleHBvcnQgS09OR19TVEFUVVNfTElTVEVOPSR7S09OR19TVEFUVVNfTElTVEVOOi0xMjcuMC4wLjE6ODAwN30KZXhwb3J0IEtPTkdfVFJVU1RFRF9JUFM9JHtLT05HX1RSVVNURURfSVBTOi0iMC4wLjAuMC8wLDo6LzAifQpleHBvcnQgS09OR19ETlNfT1JERVI9JHtLT05HX0ROU19PUkRFUjotTEFTVCxTUlYsQSxBQUFBLENOQU1FfQpleHBvcnQgS09OR19OR0lOWF9XT1JLRVJfUFJPQ0VTU0VTPSR7S09OR19OR0lOWF9XT1JLRVJfUFJPQ0VTU0VTOi0yfQpleHBvcnQgS09OR19BTk9OWU1PVVNfUkVQT1JUUz0ke0tPTkdfQU5PTllNT1VTX1JFUE9SVFM6LW9mZn0KZXhwb3J0IEtPTkdfUEdfVElNRU9VVD0ke0tPTkdfUEdfVElNRU9VVDotMTUwMDB9CmZvciB2IGluIFBST1hZX0FDQ0VTU19MT0cgQURNSU5fQUNDRVNTX0xPRyBBRE1JTl9HVUlfQUNDRVNTX0xPRzsgZG8gZXZhbCAiZXhwb3J0IEtPTkdfJHY9XCR7S09OR18kdjotL2Rldi9zdGRvdXR9IjsgZG9uZQpmb3IgdiBpbiBQUk9YWV9FUlJPUl9MT0cgQURNSU5fRVJST1JfTE9HIEFETUlOX0dVSV9FUlJPUl9MT0c7IGRvIGV2YWwgImV4cG9ydCBLT05HXyR2PVwke0tPTkdfJHY6LS9kZXYvc3RkZXJyfSI7IGRvbmUKCm49MAp1bnRpbCBrb25nIG1pZ3JhdGlvbnMgYm9vdHN0cmFwOyBkbwogIG49JCgobisxKSk7IFsgJG4gLWdlIDIwIF0gJiYgeyBlY2hvICJrb25nLXJhaWx3YXk6IGRhdGFiYXNlIG5vdCByZWFjaGFibGUiOyBleGl0IDE7IH0KICBlY2hvICJrb25nLXJhaWx3YXk6IHdhaXRpbmcgZm9yIHRoZSBkYXRhYmFzZSAoJG4pIjsgc2xlZXAgNQpkb25lCmtvbmcgbWlncmF0aW9ucyB1cCAteQprb25nIG1pZ3JhdGlvbnMgZmluaXNoIC15CgojIE1hbmFnZWQgZW50aXRpZXMgKGZpeGVkIElEcywgcmUtYXBwbGllZCBvbiBldmVyeSBzdGFydCk6IC9rb25nX2hlYWx0aCwgYW5kIHRoZQojIEFkbWluIEFQSSAoL2tvbmctYWRtaW4pIGFuZCBLb25nIE1hbmFnZXIgKC9rb25nLW1hbmFnZXIpIGJlaGluZCBiYXNpYyBhdXRoLgplc2MoKSB7IHByaW50ZiAnJXMnICIkMSIgfCBzZWQgJ3MvXFwvXFxcXC9nOyBzLyIvXFwiL2cnOyB9ClU9JChlc2MgIiR7S09OR19BRE1JTl9VU0VSOi1hZG1pbn0iKTsgVz0kKGVzYyAiJEtPTkdfQURNSU5fUEFTU1dPUkQiKQpGPS90bXAva29uZy1yYWlsd2F5Lmpzb24KY2F0ID4gJEYgPDxFT0YKeyJfZm9ybWF0X3ZlcnNpb24iOiIzLjAiLAoic2VydmljZXMiOlsKIHsiaWQiOiIxZjBlYjQ3My0wY2NiLTQ5NmYtYmZhMy01YzQzNjRmNjdjMDAiLCJuYW1lIjoia29uZy1hZG1pbi1hcGkiLCJ1cmwiOiJodHRwOi8vMTI3LjAuMC4xOjgwMDEiLCJ0YWdzIjpbImtvbmctcmFpbHdheSJdLAogICJyb3V0ZXMiOlt7ImlkIjoiNjFlMGQ4NDYtNmNhNC00NTkwLWI1YzUtY2YxNTRhMjAzNDI2IiwibmFtZSI6ImtvbmctYWRtaW4tYXBpIiwicGF0aHMiOlsiL2tvbmctYWRtaW4iLCIva29uZy1tYW5hZ2VyL2FwaSJdLCJwcm90b2NvbHMiOlsiaHR0cHMiXSwiaHR0cHNfcmVkaXJlY3Rfc3RhdHVzX2NvZGUiOjMwOCwic3RyaXBfcGF0aCI6dHJ1ZSwidGFncyI6WyJrb25nLXJhaWx3YXkiXX1dfSwKIHsiaWQiOiI5OTEzNjAzZi03N2RmLTRjYjAtOGU5Ny1kYjIxZThlY2VlMjEiLCJuYW1lIjoia29uZy1tYW5hZ2VyIiwidXJsIjoiaHR0cDovLzEyNy4wLjAuMTo4MDAyIiwidGFncyI6WyJrb25nLXJhaWx3YXkiXSwKICAicm91dGVzIjpbeyJpZCI6Ijk5MmFiMDViLTIzMTItNDcwOS1hMWJmLTQ1YmNiOGU0OTQ4YyIsIm5hbWUiOiJrb25nLW1hbmFnZXIiLCJwYXRocyI6WyIva29uZy1tYW5hZ2VyIl0sInByb3RvY29scyI6WyJodHRwcyJdLCJodHRwc19yZWRpcmVjdF9zdGF0dXNfY29kZSI6MzA4LCJzdHJpcF9wYXRoIjpmYWxzZSwidGFncyI6WyJrb25nLXJhaWx3YXkiXX1dfSwKIHsiaWQiOiI4ODIxMzJkMS03NWQzLTRkNGEtYWI1My1jNTI2OWNlZTg0NDUiLCJuYW1lIjoia29uZy1oZWFsdGgiLCJ1cmwiOiJodHRwOi8vMTI3LjAuMC4xOjgwMDciLCJ0YWdzIjpbImtvbmctcmFpbHdheSJdLAogICJyb3V0ZXMiOlt7ImlkIjoiNTRmNTcyOGItOTkyZC00ODY3LWI1NDctNTkwMmExYjc2OWI2IiwibmFtZSI6ImtvbmctaGVhbHRoIiwicGF0aHMiOlsiL2tvbmdfaGVhbHRoIl0sInN0cmlwX3BhdGgiOnRydWUsInRhZ3MiOlsia29uZy1yYWlsd2F5Il19XX1dLAoicGx1Z2lucyI6WwogeyJpZCI6IjhkYjI2NzMxLTQzOGMtNDU1OC05Y2FlLWE3MDZhNTk4MWY1NyIsIm5hbWUiOiJiYXNpYy1hdXRoIiwicm91dGUiOiI2MWUwZDg0Ni02Y2E0LTQ1OTAtYjVjNS1jZjE1NGEyMDM0MjYiLCJjb25maWciOnsiaGlkZV9jcmVkZW50aWFscyI6dHJ1ZSwicmVhbG0iOiJrb25nLWFkbWluIn0sInRhZ3MiOlsia29uZy1yYWlsd2F5Il19LAogeyJpZCI6ImUxMTRkZmU1LTg4ZWYtNDAwNS05NDNjLWM2MjkwNDZmMmVlMiIsIm5hbWUiOiJhY2wiLCJyb3V0ZSI6IjYxZTBkODQ2LTZjYTQtNDU5MC1iNWM1LWNmMTU0YTIwMzQyNiIsImNvbmZpZyI6eyJhbGxvdyI6WyJrb25nLWFkbWluIl0sImhpZGVfZ3JvdXBzX2hlYWRlciI6dHJ1ZX0sInRhZ3MiOlsia29uZy1yYWlsd2F5Il19LAogeyJpZCI6ImIxZmJkMjM4LWMzOTUtNDJlZC05OWM1LTM0YjJhZWQzNGMyYSIsIm5hbWUiOiJiYXNpYy1hdXRoIiwicm91dGUiOiI5OTJhYjA1Yi0yMzEyLTQ3MDktYTFiZi00NWJjYjhlNDk0OGMiLCJjb25maWciOnsiaGlkZV9jcmVkZW50aWFscyI6dHJ1ZSwicmVhbG0iOiJrb25nLWFkbWluIn0sInRhZ3MiOlsia29uZy1yYWlsd2F5Il19LAogeyJpZCI6IjRiOTYxMmViLTQzY2ItNGE4Yy1iZTNlLWE5YzhkMjIzNDQyNSIsIm5hbWUiOiJhY2wiLCJyb3V0ZSI6Ijk5MmFiMDViLTIzMTItNDcwOS1hMWJmLTQ1YmNiOGU0OTQ4YyIsImNvbmZpZyI6eyJhbGxvdyI6WyJrb25nLWFkbWluIl0sImhpZGVfZ3JvdXBzX2hlYWRlciI6dHJ1ZX0sInRhZ3MiOlsia29uZy1yYWlsd2F5Il19LAogeyJpZCI6ImZiZTc2ZmQ1LWM0OGYtNGYzOS1hMWU1LWUwOWVhMTkzOWEyMCIsIm5hbWUiOiJyZXF1ZXN0LXRlcm1pbmF0aW9uIiwicm91dGUiOiI1NGY1NzI4Yi05OTJkLTQ4NjctYjU0Ny01OTAyYTFiNzY5YjYiLCJjb25maWciOnsic3RhdHVzX2NvZGUiOjIwMCwibWVzc2FnZSI6Im9rIn0sInRhZ3MiOlsia29uZy1yYWlsd2F5Il19XSwKImNvbnN1bWVycyI6W3siaWQiOiIwYTdmNGMzZS01ZDFiLTRlNmYtOWEyYy0zYjhkN2UxZjZhNDAiLCJ1c2VybmFtZSI6ImtvbmctYWRtaW4iLCJ0YWdzIjpbImtvbmctcmFpbHdheSJdLAogImJhc2ljYXV0aF9jcmVkZW50aWFscyI6W3siaWQiOiI1YzJlOWI3YS0xZjRkLTRhM2ItOGU2Yy05ZDBmMmExYjNjNGQiLCJ1c2VybmFtZSI6IiRVIiwicGFzc3dvcmQiOiIkVyIsInRhZ3MiOlsia29uZy1yYWlsd2F5Il19XSwKICJhY2xzIjpbeyJpZCI6IjdlM2ExYzliLTJkNGYtNGI2YS04YzBlLTFmNWQ5YTNiN2MyZSIsImdyb3VwIjoia29uZy1hZG1pbiIsInRhZ3MiOlsia29uZy1yYWlsd2F5Il19XX1dfQpFT0YKa29uZyBjb25maWcgZGJfaW1wb3J0ICRGCnJtIC1mICRGCnVuc2V0IEtPTkdfQURNSU5fUEFTU1dPUkQKZXhlYyAvZG9ja2VyLWVudHJ5cG9pbnQuc2gga29uZyBkb2NrZXItc3RhcnQK | base64 -d > /tmp/kong-railway.sh && exec bash /tmp/kong-railway.sh'` - **Health check:** /kong_health - **Public domain:** Yes ### Postgres https://devicons.railway.app/i/postgresql.svg - **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18 ## Documentation # Deploy and Host Kong Gateway on Railway Kong Gateway is an open-source API gateway built on NGINX and OpenResty. It sits in front of your services and routes traffic to them, and it adds authentication, rate limiting, request transformation, caching and logging through plugins. You configure it through its Admin API, the Kong Manager web UI or declarative files with decK. ## About Hosting Kong Gateway Kong needs a Postgres database for its configuration, schema migrations before it starts, and a public port for the proxy. The Admin API can change every route and plugin, so it must never be open to the internet. This template runs the official open-source image (Kong 3.9.4) with Railway Postgres. On every start it runs the migrations and serves the proxy on your Railway domain. The Admin API and Kong Manager listen only inside the container. They are reachable through the proxy at `/kong-admin` and `/kong-manager`, over HTTPS only, behind a login with a password generated at deploy. ## Common Use Cases * Put one gateway in front of several APIs or microservices, with routing by path or host * Add API keys, basic auth, JWT, rate limiting or CORS to an API without changing its code * Centralise request logging, header changes and upstream load balancing ## Dependencies for Kong Gateway Hosting * Railway Postgres (included) for Kong's configuration * Nothing else to bring: the admin password is generated at deploy ### Deployment Dependencies * [Kong Gateway documentation](https://developer.konghq.com/gateway/) * [Install Kong Gateway with Docker](https://developer.konghq.com/gateway/install/docker/) * [Securing the Admin API](https://developer.konghq.com/gateway/secure-the-admin-api/) and the [Admin API reference](https://developer.konghq.com/admin-api/) * [Kong Manager](https://developer.konghq.com/gateway/kong-manager/) and [decK](https://developer.konghq.com/deck/) * [Kong source](https://github.com/Kong/kong) and [release 3.9.4](https://github.com/Kong/kong/releases/tag/3.9.4) * [Official `kong` image on Docker Hub](https://hub.docker.com/_/kong) ### Implementation Details After the deploy, copy `KONG_ADMIN_PASSWORD` from the Kong service's Variables tab. The user name is `admin`. * **Kong Manager:** open `https://YOUR-APP.up.railway.app/kong-manager/` and log in. * **Admin API:** `https://YOUR-APP.up.railway.app/kong-admin/` with HTTP basic auth. Create a service and a route, then call it through the proxy: ```bash KONG=https://YOUR-APP.up.railway.app curl -u "admin:$KONG_ADMIN_PASSWORD" $KONG/kong-admin/services \ -d name=example -d url=https://httpbin.org/anything curl -u "admin:$KONG_ADMIN_PASSWORD" $KONG/kong-admin/services/example/routes \ -d name=example -d 'paths[]=/example' curl $KONG/example/hello ``` With decK: `deck gateway ping --kong-addr $KONG/kong-admin --headers "Authorization: Basic $(printf 'admin:%s' "$KONG_ADMIN_PASSWORD" | base64)"`. The admin routes are Kong entities tagged `kong-railway` (services `kong-admin-api`, `kong-manager` and `kong-health`, and the consumer `kong-admin`). The start command re-applies them on every deploy, so a change to them is undone at the next restart. Only the `kong-admin` consumer can use them: other consumers you create get `403`. To change the password, set a new `KONG_ADMIN_PASSWORD` and redeploy. The paths `/kong-admin`, `/kong-manager` and `/kong_health` are reserved, so don't use them for your own routes. If you add a custom domain, also set `KONG_ADMIN_GUI_API_URL` to `https://your-domain/kong-manager/api` so Kong Manager calls the right host. Kong sees Railway's TLS termination through `X-Forwarded-Proto`, so routes limited to `https` work. ## Why Deploy Kong Gateway on Railway? Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it. By deploying Kong Gateway on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway. ## Similar templates - [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀 - [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform - [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy. Open this page in a browser: https://railway.com/deploy/kong-gateway