Deploy and Host self-hosted Panel on Railway

SE7O-SNA Panel v3 is a self-hosted subscription management panel for VLESS over WebSocket and TLS, bundled with an integrated Telegram MTProto proxy and Aether tunnel exit support. Built with FastAPI, it ships the backend, REST API, and web dashboard together (entry point main.py, application code under app/), with SQLite or PostgreSQL storage. It handles inbound lifecycle with custom outbound routing, per-user quotas, live traffic analytics, secure secret paths, and Telegram alerts — and runs an mtg proxy in the same container so Telegram stays reachable alongside your VLESS links.

About Hosting self-hosted Panel

Hosting SE7O-SNA Panel means running one Python process that terminates WebSocket connections, serves an authenticated dashboard under a secret path (/secret_path/panel), and supervises the bundled mtg proxy. The container listens on the HTTP port Railway injects, so no reverse proxy or build pipeline is needed. The MTProto proxy runs on a separate internal port (443) and is exposed through a Railway TCP Proxy.

Why Deploy

The main operational concerns are state, secrets, and the Telegram proxy endpoint. The SQLite database must live on a volume mounted at /data, or be replaced by an external PostgreSQL instance through DATABASE_URL, otherwise data is lost on redeploy. You also set an admin username, a strong password, a stable SECRET_KEY, and a secure SECRET_PATH to protect the admin panel. If the key is left unset, a fresh one is generated on every restart and all sessions are invalidated. Background tasks flush traffic counters and disable expired inbounds automatically. The MTProto secret is generated once and persisted; the public tg://proxy link is derived from your Railway TCP Proxy address.

Common Use Cases

Running a private WebSocket tunnel for your own devices with a dashboard instead of hand-edited config files
Managing time-limited or quota-limited access for a small group, with automatic expiry and usage caps
Self-hosting a lab deployment to study VLESS transport, subscription link generation, and real-time traffic accounting
Keeping Telegram reachable from restricted networks through the bundled MTProto proxy on the same host
Routing specific inbounds through Cloudflare WARP / Aether tunnel exits independently

Dependencies for self-hosted Panel Hosting

Python 3.11 runtime, provided by the included Dockerfile which Railway detects and builds automatically
A persistent volume mounted at /data for the SQLite database, or an external PostgreSQL database referenced by DATABASE_URL
(Bundled) the mtg binary for the MTProto proxy and the verified Aether binary — copied into the image by the Dockerfile, no separate install needed

Dependencies for railway

Deployment Dependencies

Source repository (SE7O-SNA/Sevo-panel-fixed)
Railway volumes documentation (https://docs.railway.com/reference/volumes)
Railway environment variables (https://docs.railway.com/guides/variables)
Railway TCP Proxy (https://docs.railway.com/reference/tcp-proxy)
FastAPI (https://fastapi.tiangolo.com/)

Implementation Details

Configure these variables in the Railway service settings:

ADMIN_USERNAME

Required: Recommended
Example: se7oadmin
Description: Panel login username. Defaults to admin.

ADMIN_PASSWORD

Required: Yes
Example: StrongPass!123
Description: Login password. Minimum 8 characters with upper case, lower case, and a digit.

SECRET_KEY

Required: Yes
Example: long random string
Description: Signs JWT session cookies. Must be stable across restarts.

SECRET_PATH

Required: Yes
Example: k7Qp2xVn9aTm
Description: Secret URL prefix of the admin panel: served only at https://<domain>/<SECRET_PATH>/panel (3–64 chars: letters, digits, -, _). Direct access to /panel, /login, or /dashboard returns 404. If unset, a random one is generated once and printed in the startup log.

DOMAIN

Required: Recommended
Example: se7o-sna.up.railway.app
Description: Public domain, used to generate correct subscription links.

DB_PATH

Required: Recommended
Example: /data/panel.db
Description: SQLite location. Pair with a volume mounted at /data.

DATABASE_URL

Required: Optional
Example: postgres://user:***@host/db
Description: External PostgreSQL. Overrides DB_PATH when set.

PORT

Required: Optional
Example: 8080
Description: Railway injects this automatically. The app defaults to 8080.

MTPROXY_ENABLED

Required: Optional
Example: true
Description: Enables the bundled Telegram MTProto proxy. Defaults to true.

MTPROXY_PORT

Required: Optional
Example: 443
Description: Port mtg binds to inside the container.