new-api — Hardened LLM Gateway for Railway

One-click deployment of new-api, the 48k-star open-source LLM gateway and AI asset management platform (Calcium-Ion / QuantumNous, AGPLv3, based on one-api). Expose OpenAI-, Claude-, and Gemini-compatible APIs, manage upstream provider channels, and bill users with token quotas — on your own Railway deployment.

This template is hardened for production from the first minute:

No default credentials, ever. Upstream's classic root/123456 bootstrap account is never created. The database starts empty and you create the admin account through the built-in /setup wizard on first visit.
Every secret auto-generated at deploy time by Railway's ${{secret()}} functions: MySQL root password, Redis password, session-signing secret, crypto secret. Nothing secret lives in the repo or the template.
Persistent state: MySQL on a volume (/var/lib/mysql), gateway data directory on a volume (/data). Channels, tokens, and users survive redeploys and restarts.
Pinned + auto-bumped: the gateway image is pinned (calciumion/new-api:v1.0.0-rc.37 at time of writing) and a weekly GitHub Action re-pins to the newest upstream release, so fresh deploys stay current without breaking reproducibility.
Boot-order safe: an entrypoint wrapper waits for MySQL and Redis to accept connections before starting the gateway — a cold parallel deploy never races its own database.
Healthchecked: Railway probes /api/status with a 300s timeout and restarts on failure.

Deploy form inputs: just the MySQL database name (type new-api, or any name you like — the connection string is wired to it automatically).

After deploying

Open your new deployment URL (Railway gives it a *.up.railway.app domain automatically).
Complete the /setup wizard immediately: choose your admin username and a strong password. Do this right away — until you do, the first visitor to the URL can claim the admin account (standard behavior of every fresh new-api instance).
Log in, open Channels, and add your upstream provider (OpenAI, Anthropic, Google, DeepSeek, OpenRouter, ...): paste its API key, pick the models, save. Use the channel's Test button to verify.
Open Tokens and create an API key for yourself.
Call the OpenAI-compatible endpoint:

curl https://YOUR-DOMAIN.up.railway.app/v1/chat/completions \
  -H "Authorization: Bearer sk-YOUR-TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"hello"}]}'

Compatible endpoints include /v1/chat/completions, /v1/completions, /v1/embeddings, /v1/models, /v1/responses, and Claude- and Gemini-native routes — see the upstream docs.

Cost estimate

Three small services (gateway + MySQL + Redis): roughly $5-15/month at light personal use on Railway trial/hobby plans, scaling with relayed traffic. The gateway is a single ~80 MB Go container; MySQL and Redis idle cheaply.

Security notes

Session cookies are signed with a 64-character per-deploy SESSION_SECRET; cache keys use a separate CRYPTO_SECRET.
MySQL and Redis are reachable only over Railway's private network (no public database ports).
Want strict cookie hardening? Set SESSION_COOKIE_SECURE=true and SESSION_COOKIE_TRUSTED_URL=https://your-domain on the gateway service.
The image is pinned; upgrades land through reviewed weekly bumps, not silent :latest drift.

Troubleshooting

Gateway restarts a few times on first deploy — MySQL initialization takes 1-2 minutes on a cold volume. The wrapper waits up to 5 minutes per dependency; check the MySQL service logs if restarts continue.
No database selected / SQL errors — set the MYSQL_DATABASE variable on the MySQL service (template default suggestion: new-api) and redeploy.
401 on /v1/* — create a token on the Tokens page and pass it as Authorization: Bearer sk-....
Channel test fails — that's your upstream provider credential, not the gateway. Check base URL, key, and model mapping on the channel.
Forgot the admin password — re-run /setup? No: setup runs once. Reset from the login page's "forgot password" flow (needs SMTP configured) or recreate the deployment.

Deploy and Host

About Hosting

This template provisions three services on Railway: the new-api gateway (built from the pinned upstream image via this repo's Dockerfile, with a persistent /data volume and a public HTTPS domain), MySQL 8.4 as the primary datastore (volume-mounted at /var/lib/mysql), and Redis 7.4 as cache and session backing. All cross-service wiring is pre-configured with Railway variable references: SQL_DSN, REDIS_CONN_STRING, SESSION_SECRET, CRYPTO_SECRET, and the boot-wait host variables. Railway probes /api/status as the healthcheck; restart policy is on-failure with 10 retries.

Why Deploy

Manual new-api hosting means juggling a Go binary or Docker compose file, a database, a cache, TLS, and upstream's insecure defaults (root/123456, empty secrets). This template gives you the production topology in one click: MySQL + Redis over Railway's private network, auto-generated secrets, persistent volumes, healthchecks, a pinned image with weekly automated bumps, and a first-run wizard that forces you to create the admin account instead of shipping a known default password.

Common Use Cases

Self-hosted OpenAI-compatible gateway in front of multiple providers (OpenAI, Anthropic, Gemini, DeepSeek, OpenRouter, local vLLM/LiteLLM backends)
Team or community LLM access with per-user tokens, quotas, and usage billing
Failover and load balancing across several upstream channels with priority/weight routing
A single stable API surface for apps while swapping upstream providers behind it
Serving Claude- and Gemini-native API formats from one deployment

Dependencies for

Deployment Dependencies

A Railway account (hobby or team plan; trial works for a first look)
One upstream provider API key (OpenAI, Anthropic, Google, etc.) to configure as a channel after deployment — the gateway itself ships with no provider credentials
No other external services: MySQL and Redis are provisioned by the template and communicated with over Railway's private network