Deploy and Host PostgreSQL with TLS on Railway

Run PostgreSQL on Railway using a multi-platform image based on the official PostgreSQL image, with managed TLS certificates, safe persistent-volume handling, and automatic certificate renewal.

About Hosting PostgreSQL with TLS

This template provides a persistent PostgreSQL database with TLS support for both Railway's private network and public TCP Proxy. On first startup, the image creates a private Certificate Authority (CA) and a CA-signed server certificate. The certificate includes Railway's private and public database hostnames, allowing clients to use strict hostname verification. On subsequent deployments, the image validates the certificate chain, keys, expiration, and required hostnames, renewing certificates safely while preserving the CA whenever possible.

The image also validates the Railway volume location, prevents two PostgreSQL processes from using the same volume during overlapping deployments, and refuses to start when the volume contains data from a different PostgreSQL major version.

Common Use Cases

Application databases: Store relational and transactional data for web applications, APIs, and background workers.
Private service communication: Connect from other Railway services through the private network with TLS and hostname verification.
Public database access: Encrypt connections through Railway's TCP Proxy for administration, migrations, and external integrations.
Strict TLS deployments: Reject plaintext TCP connections and distribute the service-specific CA to trusted clients.

Dependencies for PostgreSQL Hosting

A Railway persistent volume mounted at /var/lib/postgresql for PostgreSQL 18 or /var/lib/postgresql/data for PostgreSQL 17 and older.
PostgreSQL client or application driver with TLS support.

Deployment Dependencies

Implementation Details

TLS connections

TLS is available immediately after database initialization. Use sslmode=require to encrypt a connection without validating the service identity. For strict CA and hostname validation, export the public CA certificate from the deployed service and use sslmode=verify-full:

railway ssh \
  --project your-project-id \
  --service your-service-id \
  --environment your-environment-id \
  -- export-ssl-ca > postgres-root.crt

The certificate is saved by your local shell. It is public and may be distributed to database clients; never copy root.key or server.key from the service.

TLS support does not reject plaintext connections by default, preserving compatibility with existing clients. Set SSL_REQUIRE=true to require TLS for all TCP database and replication connections. Local Unix-socket access remains available for initialization and administration.

Certificate lifecycle

Server certificates are valid for 820 days by default, while the private CA is valid for 3650 days. Every startup validates the certificate material and renews it when it is invalid, missing a required Railway hostname, or within 30 days of expiration. A healthy CA is retained during server-certificate renewal so clients do not need to trust a new CA after every deployment.

Image-specific environment variables

SSL_REQUIRE: Set to true to reject plaintext TCP connections; defaults to false.
SSL_CERT_DAYS: Server-certificate validity in days; defaults to 820.
SSL_CA_CERT_DAYS: CA-certificate validity in days; defaults to 3650.
RUNTIME_LOCK_WAIT_SECONDS: How long startup waits for a previous deployment to release the volume; defaults to 300.
LOG_TO_STDOUT: Set to true to merge standard error into standard output.
POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB: Standard variables inherited from the official PostgreSQL image.

Changing the image to another PostgreSQL major version does not upgrade the existing database files. Perform a PostgreSQL major-version migration before changing major-version tags on a service with existing data.

Why Deploy PostgreSQL on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying PostgreSQL on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.