---
title: "Deploy Rundeck"
description: "Run and schedule your ops scripts from one permissioned web UI"
category: "Automation"
url: https://railway.com/deploy/rundeck
---

# Deploy Rundeck

Run and schedule your ops scripts from one permissioned web UI

**[Deploy Rundeck on Railway](https://railway.com/template/rundeck)**

- **Creator:** A3A
- **Category:** Automation

## Template content

### Postgres https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

### mailpit https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/mailpit.svg

- **Image:** axllent/mailpit:latest
- **Public domain:** Yes

### rundeck https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/rundeck.svg

- **Source:** https://github.com/gridalpha/rundeck-railway
- **Health check:** /health
- **Public domain:** Yes

## Buckets

- **rundeck-logs**

## Documentation

# Deploy and Host Rundeck on Railway

Rundeck is an open-source operations platform that turns the scripts your team runs by hand into named jobs anyone can be trusted with. An engineer defines a job once — a shell command, a script, an Ansible playbook, an HTTP call — decides which nodes it targets, and hands the run button to support, QA or on-call under a policy saying who may run what, where. Self-host Rundeck when the shell access needed to restart a stuck consumer is the thing you want to stop giving out.

Deploy Rundeck on Railway and you get the production shape rather than the laptop one: Rundeck Community backed by a managed PostgreSQL database holding every project, job definition, execution record and encrypted key; a Railway object storage bucket receiving each execution's log files, so history is not tied to one container's disk; and a Mailpit service catching the notification emails Rundeck sends, so alerting works the moment the deploy finishes.

![Rundeck, Postgres and Mailpit services connected on Railway](https://res.cloudinary.com/rroe4rtk/image/upload/v1788319387/rundeck-architecture.png)

## Getting Started with Rundeck on Railway

Set `RUNDECK_ADMIN_PASSWORD` before you click Deploy. It is the only value you must supply, and the container refuses to start without it rather than falling back to the `admin`/`admin` account baked into the upstream image. Open the public URL once the deploy is green and sign in as `admin`.

The first screen is an empty project list. Click **Create New Project**, name it something like `platform-ops`, and save. Rundeck adds a Local node source automatically, so the container itself is a target — useful for proving the install before wiring up SSH keys. Open **Jobs → New Job**, add a Command or Script step, save and run it, then check **Activity** for the execution and its captured output.

That round trip exercises the whole stack: the definition went into PostgreSQL, the run happened, and the log file reached the bucket — confirm the last part under the gear menu at **Log Storage**. To add real targets, store an SSH private key under **Project Settings → Key Storage** and point a node source at your inventory. For notifications, add an email notification to a job and open the Mailpit inbox at its own URL, using the credentials in `MP_UI_AUTH`.

![Rundeck job list beside five successful execution records](https://res.cloudinary.com/rroe4rtk/image/upload/v1788319389/rundeck-jobs-and-activity.png)

![Rundeck job page showing its schedule and success rate](https://res.cloudinary.com/rroe4rtk/image/upload/v1788319391/rundeck-scheduled-job.png)

![Rundeck log storage page reporting all uploads succeeded](https://res.cloudinary.com/rroe4rtk/image/upload/v1788319392/rundeck-log-storage.png)

![Mailpit inbox holding two Rundeck job completion emails](https://res.cloudinary.com/rroe4rtk/image/upload/v1788319393/rundeck-job-notifications.png)

## About Hosting Rundeck

Rundeck sits between the people who need an operational task done and the machines it happens on. Instead of an engineer SSHing in at 2am, the task is a job with a defined workflow, a node filter, an audit trail and a permission policy. PagerDuty maintains it.

- **Jobs and workflows** — ordered command, script, playbook or HTTP steps, with error handlers
- **Node targeting** — filter by name, tag, OS or attribute and run across matching hosts
- **Scheduling** — cron-style schedules on any job, on-demand and nightly from one definition
- **ACL policies** — YAML rules granting run, read or kill on specific projects, jobs and nodes
- **Key storage** — SSH keys and passwords encrypted at rest and referenced by path
- **REST API, webhooks and a large plugin catalogue**

The Railway architecture is three cooperating services. Rundeck is the web UI, scheduler and executor. PostgreSQL replaces the file-based H2 database the image defaults to: job definitions, execution history and the encrypted key store all live there. The bucket receives the raw `.rdlog` output, its state JSON and its execution XML per run, so a redeployed container still serves full history. Mailpit accepts SMTP on the private network; swap it for a real relay when you want mail to leave the project.

## Why Deploy Rundeck on Railway

Railway removes the parts of a Rundeck install that have nothing to do with automation:

- Managed PostgreSQL provisioned and wired up, no JDBC string to assemble
- Object storage for execution logs attached and configured
- A persistent volume for the users file and the local log cache
- HTTPS, a public domain and proxy headers already correct
- One password to supply, and no default credentials left enabled

## Common Use Cases

- **Self-service operations** — give support a button to clear a cache or replay a failed message, without handing out shell access
- **Scheduled maintenance** — nightly vacuums, log rotation and certificate checks, each with an owner and an email alert on failure
- **Incident runbooks** — the diagnostics you always run first, saved so the responder need not remember them
- **Ansible without the Ansible UI** — run existing playbooks from a permissioned interface that also handles shell scripts and API calls

## Dependencies for Rundeck

- **Rundeck Community `6.1.0`** — [`rundeck/rundeck`](https://hub.docker.com/r/rundeck/rundeck) plus a small layer that seeds the administrator account and configures object storage. Source: [github.com/rundeck/rundeck](https://github.com/rundeck/rundeck)
- **PostgreSQL 18** — Railway-managed. Projects, jobs, executions and key storage
- **Object storage bucket** — Railway-managed. Execution logs, via the [S3 log storage plugin](https://github.com/rundeck-plugins/rundeck-s3-log-plugin)
- **Mailpit** — [`axllent/mailpit`](https://hub.docker.com/r/axllent/mailpit). Captures notification email

### Environment Variables Reference

| Variable | Purpose |
|---|---|
| `RUNDECK_ADMIN_PASSWORD` | Administrator password. The only value you must supply |
| `RUNDECK_ADMIN_USER` | Login for that account. Defaults to `admin` |
| `RUNDECK_GRAILS_URL` | Public base URL used in links and redirects |
| `RUNDECK_STORAGE_CONVERTER_1_CONFIG_PASSWORD` | Encrypts key storage at rest. Changing it makes stored keys unreadable |
| `RUNDECK_QUARTZ_THREADPOOL_THREADCOUNT` | Concurrent job executions. Defaults to 10 |
| `MP_UI_AUTH` | `user:password` for the Mailpit inbox |

### Deployment Dependencies

- Docker image: [hub.docker.com/r/rundeck/rundeck](https://hub.docker.com/r/rundeck/rundeck)
- Documentation and configuration reference: [docs.rundeck.com](https://docs.rundeck.com)

## Hardware Requirements for Self-Hosting Rundeck

Rundeck is a JVM application and sizes its heap from the container limit, so memory is the number that matters. The defaults suit a few hundred jobs.

| Resource | Minimum | Recommended |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 2 GB | 4 GB |
| Storage | 5 GB volume | 10 GB volume plus object storage |
| Runtime | Java 17 | Java 17 |

## Self-Hosting Rundeck

The published image runs with no database configured, writing to an embedded H2 file — fine for a first look, unsuitable for anything you keep:

```
docker run -d --name rundeck -p 4440:4440 \
  -e RUNDECK_GRAILS_URL=http://localhost:4440 \
  rundeck/rundeck:6.1.0
```

For a real install, point it at PostgreSQL and let it migrate its own schema on start:

```
docker run -d --name rundeck -p 4440:4440 \
  -e RUNDECK_GRAILS_URL=https://rundeck.example.com \
  -e RUNDECK_DATABASE_DRIVER=org.postgresql.Driver \
  -e RUNDECK_DATABASE_URL=jdbc:postgresql://db:5432/rundeck \
  -e RUNDECK_DATABASE_USERNAME=rundeck \
  -e RUNDECK_DATABASE_PASSWORD=changeme \
  rundeck/rundeck:6.1.0
```

Doing it yourself leaves three jobs this template handles: replacing the `admin`/`admin` account baked into `server/config/realm.properties`, installing and configuring the S3 log storage plugin, and giving the non-root `rundeck` user ownership of the volume.

## Is Rundeck Free?

Rundeck Community is free and open source under the Apache License 2.0, with no seat limits, feature keys or trial period, and it is the edition in this template. PagerDuty sells commercial versions adding clustering with automatic job takeover, cluster remote execution, enterprise SSO and support. On Railway you pay only for the compute, storage and bandwidth the services use.

## FAQ

**What is Rundeck?**
Rundeck is an open-source operations platform for defining routine and incident-response tasks as jobs, running them on demand or on a schedule against your own servers, and delegating who may run each one.

**What does this Railway template deploy?**
Rundeck Community 6.1.0, a managed PostgreSQL 18 database, a Railway object storage bucket for execution logs, and a Mailpit service that captures notification email. Everything is wired together before the first boot.

**Why does it need an object storage bucket?**
Execution logs grow without bound. Object storage keeps them off the volume and makes history independent of any one container.

**How do I run jobs on my own servers instead of the container?**
Add an SSH private key under Project Settings → Key Storage, then define a node source — a resource file, a script, or a URL — listing your hosts and naming that key. The default node executor uses SSH, so no agent is needed on the target.

**Can I run Rundeck with more than one instance for high availability?**
Not with the Community edition. Automatic job takeover, cluster remote execution and replication belong to PagerDuty's commercial products, so run one instance and rely on Railway's restart policy.

**How do I send notification email through my own SMTP provider?**
Point `RUNDECK_MAIL_SMTP_HOST`, `RUNDECK_MAIL_SMTP_PORT`, `RUNDECK_MAIL_SMTP_USERNAME` and `RUNDECK_MAIL_SMTP_PASSWORD` at your relay, then remove Mailpit.


## Similar templates

- [N8N Main + Worker](https://railway.com/deploy/n8n-main-worker) — Deploy and Host N8N with Inactive worker.
- [Evolution API with n8n](https://railway.com/deploy/evolution-api-with-n8n) — Automate WhatsApp workflows with Evolution API, n8n, and Postgres.
- [Postgres Backup](https://railway.com/deploy/postgres-s3-backups) — Cron-based PostgreSQL backup to bucket storage

Open this page in a browser: https://railway.com/deploy/rundeck