Deploy and Host lockform-relay on Railway

Lockform Relay is a self-hosted forwarding service for Lockform, an end-to-end encrypted form platform. Because Lockform can't decrypt your submissions, this relay holds your private key, decrypts incoming submissions, and fans them out to integrations like Slack, Discord, email, Zapier, and n8n — keeping your key and integration secrets entirely off Lockform's servers.

About Hosting lockform-relay

Hosting Lockform Relay means running a small Node.js (Hono) web service that exposes a webhook endpoint for Lockform and a password-protected config API for managing integrations. It stores integration settings in a local SQLite database, so it needs a persistent volume to survive redeploys. Deployment centers on setting three required secrets — your derived base64 private key(s), a shared webhook secret, and an admin password — as environment variables. Railway builds the image (or pulls the published GHCR image), injects PORT automatically, and gives you a public URL you paste back into Lockform to connect the relay. No config files to edit.

Common Use Cases

Route encrypted form submissions to team chat — decrypt and post new Lockform submissions to a Slack channel or Discord webhook in real time.
Trigger automation workflows — forward decrypted submissions to Zapier or n8n to drive downstream automations without exposing plaintext to a third party.
Email notifications for form responses — deliver submission contents to a mailbox via SMTP while retaining end-to-end encryption up to your own infrastructure.

Dependencies for lockform-relay Hosting

Node.js 20+ runtime (handled automatically by Railway's build or the prebuilt Docker image).
A persistent volume for the SQLite database (DB_PATH, e.g. /data/relay.sqlite) so integration config survives redeploys.

Deployment Dependencies

Lockform app: https://app.lockform.io
Published Docker image: ghcr.io/jordan-dalby/lockformrelay:latest
Key derivation CLI: npx lockform-derive-key (from the lockform npm package)
Railway deploy template: https://railway.com/deploy/AEjS77

Implementation Details

Derive your base64 private key once, locally — never paste your 15-word passphrase into the relay (runtime derivation is slow and will time out):

npm install -g lockform
npx lockform-derive-key

Required environment variables:

Variable	Required	Notes
`LOCKFORM_PRIVATE_KEYS`	✅	Base64 private key(s), comma-separated for rotated keys.
`WEBHOOK_SECRET`	✅	Random string; paste the same value into Lockform.
`ADMIN_PASSWORD`	✅	Protects the config API; min 12 chars. Also encrypts integration secrets at rest.
`ALLOWED_ORIGINS`	–	Defaults to `https://app.lockform.io`.
`DB_PATH`	–	Point at a Railway Volume, e.g. `/data/relay.sqlite`.
`PORT`	–	Set automatically by Railway.

After deploy, copy the service's public URL, then in Lockform open a form → Integrations → Connect a relay, and paste the URL, the webhook secret, and the admin password.

Why Deploy lockform-relay on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying lockform-relay on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.