---
title: "Deploy Scanopy"
description: "Self-hosted network maps and inventory that update themselves"
category: "Observability"
url: https://railway.com/deploy/deploy-scanopy-network-maps
---

# Deploy Scanopy

Self-hosted network maps and inventory that update themselves

**[Deploy Scanopy on Railway](https://railway.com/template/deploy-scanopy-network-maps)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/deploy-scanopy-network-maps/manifest.json

- **Creator:** onepush
- **Category:** Observability

## Template content

### Postgres https://devicons.railway.app/postgres

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

### scanopy https://api.iconify.design/mdi/lan-connect.svg

- **Image:** ghcr.io/onepush-dev/scanopy-server:v0.20.0
- **Health check:** /api/health
- **Public domain:** Yes

## Documentation

# Deploy and Host self hosted Scanopy (Observability) on Railway

This template deploys Scanopy, a self-hosted server that keeps network maps and inventory current, backed by a bundled Postgres database.

## About Hosting Scanopy open-source software on Railway (self hosted Scanopy template)

This template runs the Scanopy Community Edition server (AGPL-3.0) on Railway as two services: the unmodified upstream server image with a small start wrapper, and a bundled Postgres database that stays private inside your project.

This is independent community packaging of scanopy/scanopy v0.20.0. It is not affiliated with or endorsed by Scanopy. The Commercial Edition is not used.

## Why Deploy Scanopy, the self-hosted network mapping and inventory server on Railway

A static network diagram goes stale soon after it is saved, while a daemon on your network keeps Scanopy current.

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Scanopy on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

### Railway vs Other Hosting Providers and VPS for Scanopy self hosting

| Provider | What You Get with Railway | What You Get with the Other Provider |
|---|---|---|
| DigitalOcean | Both services deploy from one template, with a public HTTPS domain and volumes. | A Droplet with root access, where you install Docker, Postgres and Scanopy. |
| AWS | The server reaches Postgres over private networking, with no VPC to configure first. | Broad control over networking and IAM, but you set up instances and routing yourself. |
| Hetzner | A managed template deploy, with the owner account created on first boot. | A low-cost VPS with root access, if you are comfortable running Docker Compose. |

## Common Use Cases for hosted Scanopy

- **Keeping a live map of your LAN:** Run the discovery daemon on a machine inside your network, and Scanopy keeps a current picture of hosts, subnets and VLANs.
- **Inventory of hosts and services:** Each scan records IP and MAC addresses, open ports and services, so you can search your estate from the web app.
- **L2 and L3 topology review:** Use the physical (L2) and logical (L3) views to see how switches, ports and subnets connect.
- **Multi-site or segmented networks:** Deploy one daemon per segment, each pushing results to the same server.
- **Change tracking for audits:** Compare scans over time to spot new or missing devices, and export snapshots for a change window.

## Dependencies for Scanopy Docker hosted on Railway

This template runs two services on Railway, and both must be up before you can sign in.

### Deployment Dependencies for Managed Scanopy Service

The scanopy service is public on port 8080, mounts a volume at /data, checks /api/health with a 300 second timeout, and uses the Always restart policy. Postgres is private, stores its files under PGDATA on its volume, uses the database name postgres, and restarts On Failure. Keep one replica of each service. The discovery daemon is not a Railway service and must run on your network.

### Implementation Details for Scanopy

The image is ghcr.io/onepush-dev/scanopy-server:v0.20.0, the unmodified upstream ghcr.io/scanopy/scanopy/server:v0.20.0 image plus railway/start.sh. The wrapper starts the server, waits for /api/health, then on first boot creates the owner account. On later boots it logs that the owner is already set up. If SCANOPY_ADMIN_PASSWORD is empty, it warns that the first visitor can register the only organization. Baked values include SCANOPY_SERVER_PORT=8080, SCANOPY_WEB_EXTERNAL_PATH=/app/static, SCANOPY_USE_SECURE_SESSION_COOKIES=true, SCANOPY_ADMIN_EMAIL=admin@scanopy.local, SCANOPY_ORG_NAME=My Network, and SCANOPY_SITE_NAME=Home; override those names before first boot if needed. Postgres is the Railway postgres-ssl:18 image; the database name is the image default postgres.

Three template variables on scanopy are generated or referenced, with no inputs:

- **SCANOPY_ADMIN_PASSWORD** is the prefix Scanopy1- plus a generated secret, meeting the upstream policy of at least 10 characters with upper, lower and a digit. Copy it from the Variables tab, then change email and password in account settings.
- **SCANOPY_DATABASE_URL** points at the bundled Postgres DATABASE_URL. Leave it as is.
- **SCANOPY_PUBLIC_URL** defaults to the Railway HTTPS domain, for invite links, reset emails and daemon setup commands. Change it if you add a custom domain.

SMTP is optional. Set SCANOPY_SMTP_RELAY, SCANOPY_SMTP_PORT, SCANOPY_SMTP_USERNAME, SCANOPY_SMTP_PASSWORD and SCANOPY_SMTP_EMAIL on the scanopy service for invite and reset email.

## How does Scanopy compare against other tools

### Scanopy vs a static network diagram (Static Diagram Alternative)

- **Freshness:** A static diagram is accurate only on the day someone draws it. Scanopy's daemon on your network keeps the map current.
- **Inventory depth:** A diagram shows boxes and lines. Scanopy also records hosts, addresses, open ports and services.
- **Where a diagram wins:** For a small, rarely changing network, a hand-drawn diagram is quicker and needs no server.

### Scanopy vs a local Docker Compose install (Local Compose Alternative)

- **Access from anywhere:** A local Compose install lives on one machine. The Railway template gives the server a public HTTPS URL, while the daemon still runs on your LAN.
- **Less to maintain:** Railway runs the server and bundled Postgres, so you do not manage the host or reverse proxy yourself.
- **Where local Compose wins:** Everything stays on hardware you control.

### Scanopy with Docker vs Railway (Docker and Railway Comparison)

- **Setup effort:** Plain Docker means you handle the server, Postgres, volumes and TLS. The Railway template wires the unmodified upstream image, Postgres and the start wrapper together.
- **First-boot ownership:** The wrapper creates the owner account, so a stranger cannot claim the public URL. Community Edition allows one organization; a recorded test of a later stranger signup returned auth_org_limit_reached.
- **Where plain Docker wins:** You control every setting and the host. On Railway the daemon must still run inside your network, because a cloud service cannot see your LAN.

## How to use Scanopy on Railway?

1. Open the public domain, then sign in as `admin@scanopy.local` with `SCANOPY_ADMIN_PASSWORD` from the scanopy service Variables tab.
2. Change the email and password in your account settings right away.
3. Community Edition allows one organization, and the owner is created on first boot, so nobody else can sign up on your URL. Invite teammates from the app.
4. Install the Scanopy daemon on a machine inside your network and point it at your Railway URL. Do not run the daemon on Railway.
5. If you add a custom domain, update `SCANOPY_PUBLIC_URL`. SMTP is optional, and only needed for invite and password-reset email.
6. Keep one replica of each service. The scanopy health check is `/api/health`; Postgres is private with restart policy On Failure.

## How to self host Scanopy on other VPS Services (Scanopy self hosting guide)

### Clone the Repository

Clone the upstream repository at the v0.20.0 tag.

```bash
git clone --branch v0.20.0 https://github.com/scanopy/scanopy.git
cd scanopy
```

### Install Dependencies

You need Docker with the Compose plugin on a host that can reach the networks you want to map.

### Configure Environment Variables

Copy the example file and set `SCANOPY_PUBLIC_URL` and a strong `POSTGRES_PASSWORD`.

```bash
cp .env.example .env
```

### Start the Scanopy Application

Start the stack with `docker compose up -d`. Open the UI on port 60072, create the first account, and wait for the first discovery to finish. The upstream Compose file also starts a host-network daemon.

## Pricing and License of Scanopy (Scanopy pricing)

Scanopy Community Edition is licensed under AGPL-3.0. The upstream Commercial Edition and Scanopy Cloud are not used or included here.

## Scanopy hosted vs self hosted comparison (Pricing, features, costs, and more)

This template packages the Community Edition (AGPL-3.0).

### Monthly cost of self hosting Scanopy on Railway

Railway bills by usage, so the monthly cost depends on RAM, CPU, volume size, and what else you run.

### System Requirements for Hosting Scanopy on a VPS

A VPS needs memory and disk for the server and a PostgreSQL database.

## Frequently Asked Questions (FAQs)

### How do I sign in?

Sign in as `admin@scanopy.local` with the `SCANOPY_ADMIN_PASSWORD` value from the scanopy service Variables tab, then change the email and password in account settings.

### Where does discovery run?

Install the Scanopy daemon on a machine inside your network (Docker with host networking, or a Linux, macOS or Windows binary) and point it at your Railway URL. Do not run the daemon on Railway.

### Can a stranger claim my URL?

No. The wrapper creates the owner account on first boot, and Community Edition allows one organization. A recorded test of a later stranger signup returned `auth_org_limit_reached`.

### Do I need SMTP?

Only if you want invite and password-reset email. Set the optional SMTP variables on the scanopy service for that.

### What if I add a custom domain?

Update `SCANOPY_PUBLIC_URL` to match the new domain, since it is used in invite links, reset emails and daemon setup commands.

### What should I back up?

Back up the Postgres volume and the scanopy /data volume, and keep `SCANOPY_ADMIN_PASSWORD` until you change it in the app.

### Is this affiliated with Scanopy?

No. This is independent community packaging of scanopy/scanopy v0.20.0 (Community Edition, AGPL-3.0), and it is not affiliated with or endorsed by Scanopy.


## Similar templates

- [Rootprint](https://railway.com/deploy/rootprint-1) — Open-source logs and traces with full-text search on object-storage.
- [Pyroscope profiling](https://railway.com/deploy/pyroscope-profiling) — Protected continuous profiling with durable Pyroscope storage.
- [SigOnly](https://railway.com/deploy/sigonly) — Deploy SigNoz with a working demo app & config in one click

Open this page in a browser: https://railway.com/deploy/deploy-scanopy-network-maps