Deploy and Host Rauthy on Railway

Rauthy is a lightweight OpenID Connect provider and single sign-on server written in Rust. It manages users, groups, roles and OIDC clients, supports passkeys and TOTP, and offers an admin UI plus a self-service account page. It is a small alternative to Keycloak for adding login to your own apps.

About Hosting Rauthy

This template runs the official ghcr.io/sebadob/rauthy:0.36.2 image as one service with its embedded Hiqlite database on a Railway volume, so no separate database is needed. Configuration comes entirely from variables: the encryption key, cluster secrets and bootstrap admin password are generated for each deployment. Rauthy trusts Railway's proxy range, so rate limiting and login logs see real client IPs. The admin API requires multi-factor authentication, which is Rauthy's secure default: sign in, register a passkey on the account page, then open the admin UI. It uses around 100 MB of memory. Keep the encryption key safe, because stored secrets depend on it.

Common Use Cases

Single sign-on for your own apps through OpenID Connect
Passkey login for a small team or community
Replacing a heavier Keycloak setup with a single small service

Dependencies for Rauthy Hosting

ghcr.io/sebadob/rauthy:0.36.2 (official image)
A Railway volume at /app/data for the Hiqlite database

Deployment Dependencies

Implementation Details

Service	Source	Networking	Storage
rauthy	`ghcr.io/sebadob/rauthy:0.36.2`	public domain on 8080	volume at `/app/data`

Variable	Default	Purpose
`BOOTSTRAP_ADMIN_EMAIL`	`admin@example.com`	Admin created on first boot
`BOOTSTRAP_ADMIN_PASSWORD_PLAIN`	generated	Its password (first boot only)
`ENC_KEYS` / `ENC_KEY_ACTIVE`	generated / `rk1`	Encryption key for stored secrets
`HQL_SECRET_RAFT` / `HQL_SECRET_API`	generated	Hiqlite secrets
`PUB_URL`	`${{RAILWAY_PUBLIC_DOMAIN}}`	Public hostname, used as the issuer
`TRUSTED_PROXIES`	`100.64.0.0/10`	Railway's proxy range

Notes:

Sign in at /auth/v1/account, add a passkey, then use /auth/v1/admin.
Rauthy listens on IPv4 so it sees Railway's proxy address correctly.
Emails (password resets, invitations) need SMTP settings; see the Rauthy docs.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by the Rauthy project.

Why Deploy Rauthy on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Rauthy on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.