Deploy and Host Passbolt on Railway

Passbolt is an open-source, end-to-end encrypted password manager built for teams — a self-hosted alternative to 1Password and LastPass where the server never sees your plaintext passwords. Every secret is encrypted with OpenPGP and decrypted only in the browser extension, true zero-knowledge security on infrastructure you own. This template deploys Passbolt with MariaDB and — most importantly — persists the GPG server keys your entire vault depends on.

What This Template Deploys

Both run on Railway's private network. Persistent volumes hold the GPG server keypair (/etc/passbolt/gpg), the JWT auth keys (/etc/passbolt/jwt), and the MariaDB data — all three are required, and the GPG keys are non-negotiable.

About Hosting

Passbolt's security model is the reason to use it and the reason one specific setup step matters more than anything else.

The GPG server keypair is your vault — persist it or lose everything. Passbolt encrypts every password with OpenPGP, and the server's keypair in /etc/passbolt/gpg is required to decrypt them. If that volume isn't persistent, a redeploy generates a new keypair and every password already in the database becomes permanently undecryptable — the data is there, but nothing can read it. This isn't losing a session, it's losing the vault. This template persists the GPG volume, and you should back it up separately, because without matching keys even a database backup can't be restored.

The JWT volume matters too. /etc/passbolt/jwt holds the authentication token keys — persist it alongside GPG so logins stay valid across redeploys.

APP_FULL_BASE_URL must exactly match your access URL. Set it to your full Railway domain including https://. If it doesn't match, registration and recovery links break — a common and confusing failure. Note Passbolt uses MariaDB, not PostgreSQL (unlike most self-hosted apps); this template includes MariaDB 10.11.

Setup requires the browser extension and a CLI-created admin. Passbolt has no password-in-a-form login — authentication is GPG-key-based through the official browser extension, which you'll need installed. The first admin is created via a one-time CLI command (cake passbolt register_user), which returns a registration link you open in the browser with the extension to finish setup.

Typical cost: ~$10–15/month on Railway for Passbolt and MariaDB. Passbolt CE is 100% free and open source under AGPL-3.0; 1Password and LastPass bill per user per month.

How It Compares

1Password and LastPass are polished but bill per user and hold your vault on their servers. Bitwarden is a strong peer that's also self-hostable. Passbolt's focus is team password management with OpenPGP end-to-end encryption, granular sharing, and complete data sovereignty — the server never sees a plaintext password.

Deploy in Under 5 Minutes

1. Click Deploy on Railway — Passbolt and MariaDB build automatically (GPG key generation runs on first boot)
2. Set APP_FULL_BASE_URL to your exact Railway HTTPS domain
3. Confirm the GPG (/etc/passbolt/gpg) and JWT (/etc/passbolt/jwt) volumes are mounted
4. Create the first admin via the cake passbolt register_user CLI command, which returns a registration link
5. Install the Passbolt browser extension and open the link to complete setup

Configure SMTP after setup so users receive registration and recovery emails.

Common Use Cases

• Team password vault — share credentials across a team with granular, per-resource access control
• 1Password/LastPass replacement — end-to-end encrypted password management with no per-user fee and full ownership
• Zero-knowledge secret storage — a vault where the server literally cannot read your passwords, only the browser extension can
• DevOps secret sharing — securely distribute service credentials and API keys within an engineering team
• Privacy-first organizations — a password manager with no vendor holding your secrets

Configuration

The GPG volume is your vault — back it up separately. /etc/passbolt/gpg holds the server keypair that decrypts every password. If it's lost or regenerated, your entire vault becomes permanently undecryptable — even database backups can't be restored without the matching keys. Persist it and back it up offline.

APP_FULL_BASE_URL must match exactly. Set it to your full HTTPS Railway URL, or registration and recovery links break. Passbolt uses MariaDB, and setup requires the browser extension plus a CLI-created first admin.

Dependencies for Passbolt Hosting

• Railway account — ~$10–15/month for Passbolt and MariaDB
• MariaDB (included in the template)
• The official Passbolt browser extension (required for login and setup)
• SMTP credentials for registration and recovery emails
• A secure, separate backup of the GPG keys

Deployment Dependencies

• Passbolt GitHub Repository
• Passbolt Docker Documentation
• Environment Variables Reference
• Railway Volumes Documentation

Implementation Details

The template runs the official passbolt/passbolt image (PHP with Nginx) on ports 80/443 against a MariaDB 10.11 service over Railway's private network. On first boot, Passbolt generates its OpenPGP server keypair; because that keypair decrypts every stored password, the /etc/passbolt/gpg volume is persistent, and /etc/passbolt/jwt preserves authentication token keys across redeploys.

APP_FULL_BASE_URL is set to the deployment's HTTPS domain, which Passbolt uses to build registration and recovery links — a mismatch is the most common post-deploy issue. Passbolt's architecture is asymmetric: passwords are encrypted client-side in the browser extension and the server never holds plaintext, so the extension is mandatory and the first admin is provisioned through the cake passbolt register_user CLI command rather than a web form. Backups require both the MariaDB data and the GPG keys together — the database alone is useless without the matching keypair.

Frequently Asked Questions

Why are the GPG keys so critical? They're the server keypair that decrypts every password in your vault. If the GPG volume is lost or regenerated on redeploy, all stored passwords become permanently undecryptable — even a database backup can't be restored. This template persists them, and you should back them up separately.

How does end-to-end encryption work here? Passwords are encrypted in your browser extension before reaching the server, and decrypted only there. The server never sees plaintext, so even with database access, no one can read your passwords without the user keys.

Why does it use MariaDB instead of Postgres? Passbolt is built on MariaDB/MySQL, unlike many self-hosted apps. This template includes MariaDB 10.11 wired to the app.

Why do registration links break? Almost always because APP_FULL_BASE_URL doesn't exactly match the URL you're accessing, including https://. Set it to your real Railway domain and regenerate the link.

How do I create the first admin? Via the cake passbolt register_user CLI command, which returns a registration link. Open it in a browser with the Passbolt extension installed to finish setup — there's no web sign-up form.

Do I need the browser extension? Yes. Passbolt authenticates with GPG keys through the official extension, not a password form, so it's required for both setup and daily use.

How do I back up my vault? Back up the MariaDB database with mysqldump and the GPG keys together — both are required to restore. Store the key backup securely offline.

Why Deploy Passbolt on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Passbolt on Railway you get a zero-knowledge team password manager with the critical part handled — the GPG server keys persisted so your vault stays decryptable, MariaDB wired, the base URL set, and automatic HTTPS. End-to-end encrypted team password management, with your secrets on infrastructure you own.