Deploy and Host Nhost (Auth, GraphQL, Storage) on Railway

Nhost is an open-source Firebase alternative: Postgres with an instant GraphQL API (Hasura), email/password and OAuth authentication, and file storage on S3-compatible object storage. This template deploys the whole stack behind one public gateway, with every secret generated for you.

About Hosting Nhost

The template starts six services: gateway (public HTTPS entry point), graphql (Hasura engine), auth (Nhost Auth), storage (Nhost Storage), postgres (private, volume at /var/lib/postgresql) and objects (MinIO, private, volume at /data). Only the gateway has a public domain. It routes /auth/v1/* to Auth, /storage/* to Storage and everything else to the GraphQL engine. The admin secret, JWT signing key, database password and object-store keys are generated per deploy, so nothing has to be filled in before you click Deploy. Auth and Storage create their own tables on first boot.

Machine-readable contract:

public_url:     https://${RAILWAY_PUBLIC_DOMAIN of service gateway}
graphql:        POST /v1/graphql   (anonymous role is rejected; send a user JWT or the admin secret)
console:        /console           (enter the admin secret)
auth:           /auth/v1/signup/email-password, /auth/v1/signin/email-password
storage:        POST /storage/v1/files   (multipart field file[])
health:         GET /railway_health  (200 when the gateway is up)
internal_urls:  graphql.railway.internal:8080, auth.railway.internal:4000, storage.railway.internal:8000, objects.railway.internal:9000
credentials:    HASURA_GRAPHQL_ADMIN_SECRET (service graphql), JWT_KEY (service graphql),
                POSTGRES_PASSWORD (service postgres), MINIO_ROOT_USER / MINIO_ROOT_PASSWORD (service objects)

Working check, run it after the deploy turns green:

curl -s -X POST https:///auth/v1/signup/email-password \
  -H 'content-type: application/json' \
  -d '{"email":"agent@example.com","password":"Passw0rd!xyz1"}'
# {"session":{"accessToken":"...","user":{...}}}

curl -s -X POST https:///storage/v1/files \
  -H "x-hasura-admin-secret: $HASURA_GRAPHQL_ADMIN_SECRET" \
  -F 'file[]=@hello.txt'
# {"processedFiles":[{"id":"...","isUploaded":true,...}]}

Email verification is switched off so a signup works immediately; configure SMTP on the auth service and set AUTH_EMAIL_SIGNIN_EMAIL_VERIFIED_REQUIRED=true for production. Permissions for the user role are not preset: define them in the console before exposing tables to end users.

Why Deploy Nhost on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Nhost on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Auth, GraphQL API and file storage behind one domain
All secrets generated automatically
Postgres and object storage kept on persistent volumes
Images pinned by digest, so redeploys do not change versions

Common Use Cases

Backend for web and mobile apps without writing a server
Authenticated GraphQL data API for AI agents
User uploads and media storage with signed access
Self-hosted replacement for Firebase or Supabase

Dependencies for Nhost Hosting

Deployment Dependencies

Implementation Details

The gateway is Caddy with a generated Caddyfile. The MinIO service is named objects because MinIO reserves the bucket name minio, and the bucket takes the service name. Auth and Storage images are distroless and configured only through environment variables. Rotate the admin secret by editing HASURA_GRAPHQL_ADMIN_SECRET on graphql (and the copies referenced by auth and storage follow it).