Deploy and Host Networking Toolbox on Railway

Built for an LLM agent to deploy and use. The deploy form has no fields to fill: the whole app sits behind a generated password, Railway's port is bound, and nothing needs a volume. Networking Toolbox is an open-source collection of subnet, CIDR, IP address and DNS tools with a JSON API and server-side diagnostics (DNS lookups, TLS, HTTP, RDAP, BGP, mail checks), so an agent can calculate a subnet plan or resolve a record with one request.

About Hosting Networking Toolbox

This template runs one service, networking-toolbox (the web app and its JSON API on one public domain). It is stateless: every calculation is computed per request and nothing is written to disk, so there is no volume and a redeploy loses nothing.

Locked down from boot. Upstream ships with no authentication at all, and its diagnostics endpoints make outbound DNS, HTTP and TLS requests for whoever asks, so a public deploy would be an open probing proxy running from your Railway project. This template puts an nginx gateway in front of the app: every path except /health requires HTTP Basic auth with user admin and the password in TOOLBOX_PASSWORD, a 32-character value generated per deploy. The wrapper refuses to start without a password of at least 16 alphanumeric characters. The app itself listens on loopback only, and nginx binds Railway's injected PORT. Upstream is Networking Toolbox v1.6.0.

Using it. Open https://YOUR_DOMAIN, sign in as admin with TOOLBOX_PASSWORD (a browser prompts for it), and use the tools. Hand the password only to people who should have access.

Agent contract

Public URL: https://RAILWAY_PUBLIC_DOMAIN (the generated domain of the networking-toolbox service; the JSON API is under /api)
Private URL: http://networking-toolbox.railway.internal:8080
Credentials: the variable TOOLBOX_PASSWORD on the networking-toolbox service; the user name is always admin
Auth: HTTP Basic, curl -u "admin:$TOOLBOX_PASSWORD". Without credentials, or with a wrong password, every path except /health answers 401. GET /api lists the endpoints; calculators are POST /api/CATEGORY/TOOL with a JSON body, and diagnostics are POST /api/internal/diagnostics/NAME.
Health: GET /health returns 200 (no credentials needed)

#!/bin/sh
# needs: RAILWAY_PUBLIC_DOMAIN, TOOLBOX_PASSWORD (variables of the networking-toolbox service); also curl. Stateless: writes nothing.
B="https://$RAILWAY_PUBLIC_DOMAIN"
A="admin:$TOOLBOX_PASSWORD"
J="Content-Type: application/json"
curl -s -o /dev/null -w "health: %{http_code}\n" "$B/health"
curl -s -o /dev/null -w "read without key: %{http_code}\n" "$B/api"
curl -s -o /dev/null -w "read with key: %{http_code}\n" -u "$A" "$B/api"
SUBNET=$(curl -s -u "$A" -X POST -H "$J" -d '{"cidr":"198.51.100.0/26"}' "$B/api/subnetting/ipv4-subnet-calculator")
if echo "$SUBNET" | grep -q '"success":true'; then echo "subnet calc: ok"; else echo "subnet calc: FAILED"; fi
DNS=$(curl -s -u "$A" -X POST -H "$J" -d '{"action":"lookup","name":"example.com","type":"A"}' "$B/api/internal/diagnostics/dns")
if echo "$DNS" | grep -q '"Answer"'; then echo "dns lookup: ok"; else echo "dns lookup: FAILED"; fi
curl -s -o /dev/null -w "write without key: %{http_code}\n" -X POST -H "$J" -d '{"cidr":"198.51.100.0/26"}' "$B/api/subnetting/ipv4-subnet-calculator"
curl -s -o /dev/null -w "write with wrong key: %{http_code}\n" -u "admin:wrong" -X POST -H "$J" -d '{"cidr":"198.51.100.0/26"}' "$B/api/subnetting/ipv4-subnet-calculator"
curl -s -o /dev/null -w "dns without key: %{http_code}\n" -X POST -H "$J" -d '{"action":"lookup","name":"example.com","type":"A"}' "$B/api/internal/diagnostics/dns"

A fresh deploy prints health: 200, read without key: 401, read with key: 200, subnet calc: ok, dns lookup: ok, write without key: 401, write with wrong key: 401 and dns without key: 401.

Why Deploy Networking Toolbox on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Networking Toolbox on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Agent-ready - no deployer fields, a contract block and one script that proves a subnet calculation, a live DNS lookup and the refusal of requests with no or a wrong password.
Not an open proxy - upstream has no login; the gateway adds one before anything is reachable.
Stateless - nothing to back up and nothing lost on redeploy.
Pinned - the upstream image is pinned by digest and the wrapper by tag and digest.
Outbound checks from Railway's network - DNS, TLS and HTTP diagnostics run from your deploy, not from your laptop.

Common Use Cases

Subnet and CIDR planning - IPv4 and IPv6 subnet calculator, VLSM, supernetting, CIDR split and aggregation, wildcard masks.
DNS troubleshooting - lookups, SPF, DMARC, CAA, SOA serial, DNSSEC and propagation checks from a fixed vantage point.
Agent-driven network tooling - give an agent one authenticated JSON API for address math and diagnostics instead of shelling out to a dozen utilities.
Team network reference - one private instance for a network team, behind a shared password.

Dependencies for Networking Toolbox Hosting

The networking-toolbox service created by the template. A custom domain is optional.

Deploy Networking Toolbox | (Just Updated) Subnet, CIDR and DNS Lookup API, Locked With a Generated Password