---
title: "Deploy NATS Server with JetStream, WebSockets, and Flexible Authentication"
description: "This NATS Server is configured for production environments."
category: "Queues"
url: https://railway.com/deploy/nats-server-with-jetstream-websockets-an
---

# Deploy NATS Server with JetStream, WebSockets, and Flexible Authentication

This NATS Server is configured for production environments.

**[Deploy NATS Server with JetStream, WebSockets, and Flexible Authentication on Railway](https://railway.com/template/nats-server-with-jetstream-websockets-an)**

- **Creator:** Tyrcode
- **Category:** Queues

## Template content

### nats-seed-ws https://nats.io/img/logos/nats-icon-white.png

- **Source:** Tyrcode/nats-ws
- **Public domain:** Yes

### nats-server-2 https://nats.io/img/logos/nats-icon-white.png

- **Source:** Tyrcode/nats-ws

### nats-server-1 https://nats.io/img/logos/nats-icon-white.png

- **Source:** Tyrcode/nats-ws

## Documentation

# Deploy and Host NATS Server Cluster on Railway

What is NATS Server Cluster with JetStream and Granular Authentication?

NATS is a high-performance, open-source messaging system designed for cloud-native applications. This project is a production-ready Docker image that bundles **Core NATS**, **JetStream** (for durable messaging and streaming), and a segregated **WebSockets endpoint**. It provides a robust, production-ready environment engineered for high-scale, low-latency microservice and client communication, fully configured via environment variables and **enforcing Username/Password authentication** for granular security.

## About Hosting NATS Server Cluster

Hosting this NATS container on Railway simplifies security by utilizing the platform's **TLS/SSL proxy termination**, allowing NATS to run internally without managing certificates. Achieving high availability requires creating a cluster of at least three nodes. **One node uses the `ws/Dockerfile` (WebSockets enabled), and two use the `server/Dockerfile` (WebSockets disabled).** A persistent volume is mandatory for the `/data` directory to ensure JetStream's data durability.

## Common Use Cases

- **Real-Time Data Streaming:** Deploying JetStream for reliable event sourcing, command logs, and durable queues in critical systems like financial trading or IoT sensor aggregation.

- **Decoupled Microservice Communication:** Using Core NATS for asynchronous, high-speed message passing between backend services, significantly enhancing system resilience and scalability.

- **Live User Experience (UX) Updates:** Utilizing the WebSockets endpoint (on the designated WS node) to deliver real-time notifications, chat messages, or live progress indicators directly to browser and mobile clients.

## Dependencies for NATS Server Cluster Hosting

**Persistent Volume**: Mandatory for the `/data` directory to ensure JetStream's stream and message persistence is maintained across service restarts.

### Deployment Dependencies
- Generate Credentials (All four environment variables for `MS_USER`, `MS_PASSWORD`, `WS_USER`, and `WS_PASSWORD` must be defined).

## Why Deploy NATS Server Cluster on Railway?

### Cluster Configuration on Railway

To create a cluster of NATS servers, you must set the `CLUSTER_ROUTES_SEED` environment variable using the internal URLs provided by Railway for the other service replicas. **All nodes (WS and Server) will point to the primary WS node for initial peer discovery.**

If you have three NATS replicas named `nats-ws` (the seed), `nats-srv-1`, and `nats-srv-2`:

| Service Name | CLUSTER\_ROUTES\_SEED Setting |
| :------- | :---------------- |
| **nats-ws** | *nats/localhost:6222* |
| **nats-srv-1** | `nats://nats-ws.railway.internal:6222` |
| **nats-srv-2** | `nats://nats-ws.railway.internal:6222` |

#### 🔑 Configuration Variables (`.env`)

The entrypoint **forces** Username/Password authentication to ensure security and privilege segregation.

#### JetStream and Server Configuration

| Variable | Default | Description |
| :--- | :--- | :--- |
| `SERVER_NAME` | `nats-server` (Code) | Name of the NATS server instance. |
| `JETSTREAM_STORE` | `/data` | Mount directory for JetStream persistence. **Must be a Docker volume**. |

---

#### Authentication Configuration (Mandatory Granular Mode)

The server is configured exclusively for **Username/Password** authentication, forcing privilege segregation between use cases.

| Variable | Description |
| :--- | :--- |
| `MS_USER`, `MS_PASSWORD` | **Required Credentials** for **Microservices** (TCP connection). They have **total privileges** (`>`) for _publish/subscribe_. |
| `WS_USER`, `WS_PASSWORD` | **Required Credentials** for **Web Clients** (Used by the WS node). They have **restricted privileges** (`ws-app.>`). |

---

#### WebSocket Configuration (Only for the WS Node)

These variables are **only** relevant for the node running the `ws/Dockerfile`.

| Variable | Default | Description |
| :--- | :--- | :--- |
| `ALLOWED_ORIGINS` | _Empty_ | Comma-separated list of **WEB** domains (e.g., `https://app.com,https://test.com`). Necessary for CORS in browsers. **Only for web apps**. |

---

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying the NATS Server Cluster on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

## Similar templates

- [smoothmq](https://railway.com/deploy/AJv-64) — A drop-in replacement for AWS SQS
- [Kafka UI](https://railway.com/deploy/kafka-ui) — Kafbat UI — Open-source web UI to monitor and manage Apache Kafka clusters
- [Hatchet Lite](https://railway.com/deploy/hatchet-lite) — Hatchet Lite with postgres

Open this page in a browser: https://railway.com/deploy/nats-server-with-jetstream-websockets-an