Deploy and Host OpenSourcePOS on Railway

Built for an LLM agent to deploy and use. The deploy form has no fields. OpenSourcePOS, the open-source web point of sale for retail (sales register, inventory, customers, suppliers, receipts, reports), comes up with a MariaDB database, an administrator account already created from a generated password, and a public HTTPS address. The contract below lists every address, variable name and one script that logs in and creates a customer.

OpenSourcePOS here is the official jekkos/opensourcepos image, version 3.4.3 (CodeIgniter 4, PHP 8.2, Apache), behind a thin wrapper pinned by digest.

About Hosting OpenSourcePOS

This template runs two services: OpenSourcePOS (wrapper image) and MariaDB 11.8. On every boot the wrapper binds Apache to Railway's port, waits for MariaDB, runs the database migrations, generates the application encryption keys once and stores them on the volume, and replaces the factory login admin / pointofsale with the password in ADMIN_PASSWORD while the account still has the factory password. Redeploys keep the keys, the sessions and the data.

Two details matter on Railway. The edge address rotates between requests, so the wrapper turns off the application's IP-bound sessions; without that, every login is thrown back to the login page. And the shop's uploads live on the /data volume.

Agent contract

Public URL: https:// plus the RAILWAY_PUBLIC_DOMAIN value of the opensourcepos service (the web application at /)
Private URL: http://opensourcepos.railway.internal:8080
Credentials: ADMIN_PASSWORD (password of the user admin, generated, 32 characters); MYSQL_PASSWORD and MYSQL_HOST_NAME are internal and need not be handled
Auth: session cookie. POST /login with form fields username=admin and password answers 303 and sets the ospos_session cookie; writes also send the CSRF token (form field csrf_ospos_v4, the 32 hex characters printed in the page script of /customers)
Health: GET /login returns 200 without authentication; with the header X-Requested-With: XMLHttpRequest, POST /customers/save/-1 without a session returns 401 (write without key: 401)

# needs: HOST (RAILWAY_PUBLIC_DOMAIN of the opensourcepos service) and ADMIN_PASSWORD from its variables
BASE="https://$HOST"
J=$(mktemp)
curl -s -o /dev/null -w "health: %{http_code}\n" "$BASE/login"
curl -s -o /dev/null -w "write without key: %{http_code}\n" -X POST -H 'X-Requested-With: XMLHttpRequest' -d 'first_name=x' "$BASE/customers/save/-1"
curl -s -c "$J" -b "$J" -o /dev/null "$BASE/login"
curl -s -c "$J" -b "$J" -o /dev/null -w "login: %{http_code}\n" --data-urlencode username=admin --data-urlencode "password=$ADMIN_PASSWORD" "$BASE/login"
curl -s -c "$J" -b "$J" -o /dev/null -w "read with key: %{http_code}\n" "$BASE/home"
T=$(curl -s -c "$J" -b "$J" "$BASE/customers" | sed -n 's/.*return "\([0-9a-f]\{32\}\)".*/\1/p' | head -1)
curl -s -c "$J" -b "$J" -H 'X-Requested-With: XMLHttpRequest' -w "\ncreate customer: %{http_code}\n" -X POST \
  --data-urlencode "csrf_ospos_v4=$T" --data-urlencode first_name=Agent --data-urlencode last_name=Test \
  --data-urlencode email=agent@example.com --data-urlencode gender=1 --data-urlencode 'date=11/08/2026 12:00:00' \
  --data-urlencode employee_id=1 --data-urlencode phone_number= --data-urlencode address_1= --data-urlencode address_2= \
  --data-urlencode city= --data-urlencode state= --data-urlencode zip= --data-urlencode country= --data-urlencode comments= \
  --data-urlencode tax_id= --data-urlencode discount= --data-urlencode account_number= "$BASE/customers/save/-1"
rm -f "$J"

A fresh deploy prints health: 200, write without key: 401, login: 303, read with key: 200, then a JSON line with "success":true and create customer: 200. Running it again adds another customer with the same result.

Why Deploy OpenSourcePOS on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying OpenSourcePOS on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Agent-ready - no deployer fields, a contract block and one working login-and-create script.
Admin pre-set - the factory admin / pointofsale login is replaced at first boot by a generated password, so a fresh shop is never left on a public default.
Logins that stick - IP-bound sessions are off, so the rotating Railway edge address does not bounce you back to the login page.
Persistent - MariaDB, uploads and the application keys sit on volumes and survive redeploys.

Common Use Cases

Run a small shop's register with barcode sales, receipts, discounts and cash-up.
Track stock across items, suppliers and receivings, with low-stock reports.
Keep a customer list with loyalty discounts and sales history.
Point of sale API for your own code - drive the same web endpoints from a script or an AI agent.

Dependencies for OpenSourcePOS Hosting

MariaDB (included as the mariadb service)

Deployment Dependencies

Implementation Details

Variable	Purpose
`ADMIN_PASSWORD`	Generated password of the user `admin`. Applied only while the account still has the factory password.
`MYSQL_HOST_NAME`	Private address of the `mariadb` service.
`MYSQL_PASSWORD`	Database password, shared with the `mariadb` service as `MARIADB_PASSWORD`.

The service listens on Railway's PORT (8080). The date and time format in the script above is the OpenSourcePOS default (m/d/Y H:i:s); if you change it under Configuration, send the customer date field in the new format.