Deploy Rundeck

Deploy and Host Rundeck on Railway

Rundeck is an open-source operations platform that turns the scripts your team runs by hand into named jobs anyone can be trusted with. An engineer defines a job once — a shell command, a script, an Ansible playbook, an HTTP call — decides which nodes it targets, and hands the run button to support, QA or on-call under a policy saying who may run what, where. Self-host Rundeck when the shell access needed to restart a stuck consumer is the thing you want to stop giving out.

Deploy Rundeck on Railway and you get the production shape rather than the laptop one: Rundeck Community backed by a managed PostgreSQL database holding every project, job definition, execution record and encrypted key; a Railway object storage bucket receiving each execution's log files, so history is not tied to one container's disk; and a Mailpit service catching the notification emails Rundeck sends, so alerting works the moment the deploy finishes.

Getting Started with Rundeck on Railway

Set RUNDECK_ADMIN_PASSWORD before you click Deploy. It is the only value you must supply, and the container refuses to start without it rather than falling back to the admin/admin account baked into the upstream image. Open the public URL once the deploy is green and sign in as admin.

The first screen is an empty project list. Click Create New Project, name it something like platform-ops, and save. Rundeck adds a Local node source automatically, so the container itself is a target — useful for proving the install before wiring up SSH keys. Open Jobs → New Job, add a Command or Script step, save and run it, then check Activity for the execution and its captured output.

That round trip exercises the whole stack: the definition went into PostgreSQL, the run happened, and the log file reached the bucket — confirm the last part under the gear menu at Log Storage. To add real targets, store an SSH private key under Project Settings → Key Storage and point a node source at your inventory. For notifications, add an email notification to a job and open the Mailpit inbox at its own URL, using the credentials in MP_UI_AUTH.

About Hosting Rundeck

Rundeck sits between the people who need an operational task done and the machines it happens on. Instead of an engineer SSHing in at 2am, the task is a job with a defined workflow, a node filter, an audit trail and a permission policy. PagerDuty maintains it.

• Jobs and workflows — ordered command, script, playbook or HTTP steps, with error handlers
• Node targeting — filter by name, tag, OS or attribute and run across matching hosts
• Scheduling — cron-style schedules on any job, on-demand and nightly from one definition
• ACL policies — YAML rules granting run, read or kill on specific projects, jobs and nodes
• Key storage — SSH keys and passwords encrypted at rest and referenced by path
• REST API, webhooks and a large plugin catalogue

The Railway architecture is three cooperating services. Rundeck is the web UI, scheduler and executor. PostgreSQL replaces the file-based H2 database the image defaults to: job definitions, execution history and the encrypted key store all live there. The bucket receives the raw .rdlog output, its state JSON and its execution XML per run, so a redeployed container still serves full history. Mailpit accepts SMTP on the private network; swap it for a real relay when you want mail to leave the project.

Why Deploy Rundeck on Railway

Railway removes the parts of a Rundeck install that have nothing to do with automation:

• Managed PostgreSQL provisioned and wired up, no JDBC string to assemble
• Object storage for execution logs attached and configured
• A persistent volume for the users file and the local log cache
• HTTPS, a public domain and proxy headers already correct
• One password to supply, and no default credentials left enabled

Common Use Cases

• Self-service operations — give support a button to clear a cache or replay a failed message, without handing out shell access
• Scheduled maintenance — nightly vacuums, log rotation and certificate checks, each with an owner and an email alert on failure
• Incident runbooks — the diagnostics you always run first, saved so the responder need not remember them
• Ansible without the Ansible UI — run existing playbooks from a permissioned interface that also handles shell scripts and API calls

Dependencies for Rundeck

• Rundeck Community 6.1.0 — rundeck/rundeck plus a small layer that seeds the administrator account and configures object storage. Source: github.com/rundeck/rundeck
• PostgreSQL 18 — Railway-managed. Projects, jobs, executions and key storage
• Object storage bucket — Railway-managed. Execution logs, via the S3 log storage plugin
• Mailpit — axllent/mailpit. Captures notification email

Environment Variables Reference

Deployment Dependencies

• Docker image: hub.docker.com/r/rundeck/rundeck
• Documentation and configuration reference: docs.rundeck.com

Hardware Requirements for Self-Hosting Rundeck

Rundeck is a JVM application and sizes its heap from the container limit, so memory is the number that matters. The defaults suit a few hundred jobs.

Self-Hosting Rundeck

The published image runs with no database configured, writing to an embedded H2 file — fine for a first look, unsuitable for anything you keep:

docker run -d --name rundeck -p 4440:4440 \
  -e RUNDECK_GRAILS_URL=http://localhost:4440 \
  rundeck/rundeck:6.1.0

For a real install, point it at PostgreSQL and let it migrate its own schema on start:

docker run -d --name rundeck -p 4440:4440 \
  -e RUNDECK_GRAILS_URL=https://rundeck.example.com \
  -e RUNDECK_DATABASE_DRIVER=org.postgresql.Driver \
  -e RUNDECK_DATABASE_URL=jdbc:postgresql://db:5432/rundeck \
  -e RUNDECK_DATABASE_USERNAME=rundeck \
  -e RUNDECK_DATABASE_PASSWORD=changeme \
  rundeck/rundeck:6.1.0

Doing it yourself leaves three jobs this template handles: replacing the admin/admin account baked into server/config/realm.properties, installing and configuring the S3 log storage plugin, and giving the non-root rundeck user ownership of the volume.

Is Rundeck Free?

Rundeck Community is free and open source under the Apache License 2.0, with no seat limits, feature keys or trial period, and it is the edition in this template. PagerDuty sells commercial versions adding clustering with automatic job takeover, cluster remote execution, enterprise SSO and support. On Railway you pay only for the compute, storage and bandwidth the services use.

FAQ

What is Rundeck? Rundeck is an open-source operations platform for defining routine and incident-response tasks as jobs, running them on demand or on a schedule against your own servers, and delegating who may run each one.

What does this Railway template deploy? Rundeck Community 6.1.0, a managed PostgreSQL 18 database, a Railway object storage bucket for execution logs, and a Mailpit service that captures notification email. Everything is wired together before the first boot.

Why does it need an object storage bucket? Execution logs grow without bound. Object storage keeps them off the volume and makes history independent of any one container.

How do I run jobs on my own servers instead of the container? Add an SSH private key under Project Settings → Key Storage, then define a node source — a resource file, a script, or a URL — listing your hosts and naming that key. The default node executor uses SSH, so no agent is needed on the target.

Can I run Rundeck with more than one instance for high availability? Not with the Community edition. Automatic job takeover, cluster remote execution and replication belong to PagerDuty's commercial products, so run one instance and rely on Railway's restart policy.

How do I send notification email through my own SMTP provider? Point RUNDECK_MAIL_SMTP_HOST, RUNDECK_MAIL_SMTP_PORT, RUNDECK_MAIL_SMTP_USERNAME and RUNDECK_MAIL_SMTP_PASSWORD at your relay, then remove Mailpit.