---
title: "Deploy Kuzzle | (Just Updated) Backend API with Elasticsearch, Admin Password Generated, Data Survives Redeploys"
description: "Kuzzle backend API with Elasticsearch and Redis, secrets generated"
category: "Other"
url: https://railway.com/deploy/kuzzle-or-just-updated-backend-api-with-
---

# Deploy Kuzzle | (Just Updated) Backend API with Elasticsearch, Admin Password Generated, Data Survives Redeploys

Kuzzle backend API with Elasticsearch and Redis, secrets generated

**[Deploy Kuzzle | (Just Updated) Backend API with Elasticsearch, Admin Password Generated, Data Survives Redeploys on Railway](https://railway.com/template/kuzzle-or-just-updated-backend-api-with-)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/kuzzle-or-just-updated-backend-api-with-/manifest.json

- **Creator:** SuperSlowSloth
- **Category:** Other

## Template content

### elasticsearch

- **Image:** elasticsearch:8.19.5@sha256:767258226c972b46c0c22817c16a9d7f40a90f67ec71fdc33f3c831c8eecdd6e
- **Start command:** `/bin/sh -c 'export ES_JAVA_OPTS="-Xms512m -Xmx512m" JAVA_TOOL_OPTIONS=-XX:ActiveProcessorCount=2; mkdir -p /usr/share/elasticsearch/data/es && chown -R 1000:0 /usr/share/elasticsearch/data && exec setpriv --reuid=1000 --regid=0 --clear-groups /usr/local/bin/docker-entrypoint.sh eswrapper -Ediscovery.type=single-node -Expack.security.enabled=false -Epath.data=/usr/share/elasticsearch/data/es -Enetwork.host=\"::\"'`

### redis

- **Image:** redis:8@sha256:2c2dff791878316e3b083188be0d578423b24813cdda5de0e80ea4f7b3e6bfd6
- **Start command:** `/bin/sh -c 'chown -R redis:redis /data && exec docker-entrypoint.sh redis-server --requirepass "$REDIS_PASSWORD" --appendonly yes --dir /data'`

### kuzzle

- **Image:** kuzzleio/kuzzle@sha256:e35ef299f221ce3ef0f90cf7b656ea55ad22df947fe1b177cd342c76d1766603
- **Start command:** `/bin/sh -c 'export kuzzle_server__port=$PORT kuzzle_cluster__enabled=false kuzzle_services__storageEngine__majorVersion=8; B=http://localhost:$PORT; (until [ "$(curl -s -o /dev/null -w %{http_code} $B/_healthCheck)" != 000 ]; do sleep 2; done; curl -s -X POST "$B/_createFirstAdmin/admin?reset=true" -H "Content-Type: application/json" -d "{\"content\":{},\"credentials\":{\"local\":{\"username\":\"admin\",\"password\":\"$KUZZLE_ADMIN_PASSWORD\"}}}" >/dev/null; J=$(curl -s -X POST $B/_login/local -H "Content-Type: application/json" -d "{\"username\":\"admin\",\"password\":\"$KUZZLE_ADMIN_PASSWORD\"}" | sed -n "s/.*\"jwt\":\"\([^\"]*\)\".*/\1/p"); curl -s -X PUT $B/roles/anonymous -H "Authorization: Bearer $J" -H "Content-Type: application/json" -d "{\"controllers\":{\"auth\":{\"actions\":{\"login\":true,\"checkToken\":true,\"getCurrentUser\":true,\"getMyRights\":true,\"logout\":true}},\"server\":{\"actions\":{\"healthCheck\":true,\"now\":true}}}}" >/dev/null; echo kuzzle bootstrap done) & exec docker-entrypoint.sh node ./bin/start-kuzzle-server'`
- **Health check:** /_healthCheck
- **Public domain:** Yes

## Documentation

# Deploy and Host Kuzzle on Railway

Kuzzle is an open-source backend: a document store API over Elasticsearch with realtime subscriptions, users, roles and permissions built in. This template deploys Kuzzle with its own Elasticsearch and Redis, with the admin password and token secret generated for you.

## About Hosting Kuzzle

The template starts three services: `kuzzle` (public HTTPS API), `elasticsearch` (private, persistent volume) and `redis` (private, password protected, persistent volume). On first boot Kuzzle creates an `admin` user with the generated `KUZZLE_ADMIN_PASSWORD` and restricts the `anonymous` role, so nothing is writable without logging in.

Machine-readable contract:

```
public_url:     https://${RAILWAY_PUBLIC_DOMAIN of service kuzzle}
internal_url:   http://kuzzle.railway.internal:8080
health:         GET /_healthCheck  (200 when ready)
login:          POST /_login/local
admin_user:     admin
credentials:    KUZZLE_ADMIN_PASSWORD (service kuzzle), REDIS_PASSWORD (service redis)
storage:        elasticsearch.railway.internal:9200 (private, no auth)
anonymous:      restricted (401 on user and admin routes)
port:           8080 (HTTP)
```

Working check, run after the deploy turns green:

```
curl -s https:///_healthCheck
# {"status":200,...}

JWT=$(curl -s -X POST https:///_login/local \
  -H 'content-type: application/json' \
  -d '{"username":"admin","password":""}' | jq -r .result.jwt)

curl -s -X POST https:///myindex/_create -H "Authorization: Bearer $JWT"
curl -s -X PUT  https:///myindex/mycoll -H "Authorization: Bearer $JWT" \
  -H 'content-type: application/json' -d '{}'
curl -s -X POST https:///myindex/mycoll/_create?refresh=wait_for \
  -H "Authorization: Bearer $JWT" -H 'content-type: application/json' -d '{"note":"hello"}'
```

Elasticsearch and Redis data live on volumes, so documents survive redeploys.

## Why Deploy Kuzzle on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Kuzzle on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

- Kuzzle, Elasticsearch and Redis wired together in one click
- Admin password, token secret and Redis password generated automatically
- Anonymous access locked down on first boot
- Data kept on persistent volumes
- Images pinned by digest, so redeploys do not change versions

## Common Use Cases

- Backend for web and mobile apps with realtime subscriptions
- IoT and sensor data ingestion with search
- Document store with a ready-made HTTP API for AI agents
- Prototype and production backends without writing server code

## Dependencies for Kuzzle Hosting

### Deployment Dependencies

- [Kuzzle on GitHub](https://github.com/kuzzleio/kuzzle)
- [Kuzzle documentation](https://docs.kuzzle.io/)
- [Kuzzle Docker image](https://hub.docker.com/r/kuzzleio/kuzzle)
- [Elasticsearch](https://www.elastic.co/elasticsearch)
- [Redis](https://redis.io/)

### Implementation Details

All three services run their official images, pinned by digest, with start commands that set the Railway-specific bindings (port, private hosts, passwords, volume ownership). Rotate the admin password by editing `KUZZLE_ADMIN_PASSWORD` on the `kuzzle` service and redeploying; the bootstrap resets the admin user on each boot.


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/kuzzle-or-just-updated-backend-api-with-