Deploy and Host Strapi on Railway

Strapi is the leading open-source headless CMS: model your content types in a browser, then read and write them over an auto-generated REST and GraphQL API with roles, permissions and API tokens. This template deploys Strapi 5 with the super administrator already created and the media library on a volume that Strapi actually writes to, because a stock deploy hands the first stranger who opens the URL a Super Admin account and stores uploads on disposable disk.

About Hosting Strapi

This template runs Strapi 5.52.1 as two services: the app, with its media library on a persistent volume, and PostgreSQL for content, users, permissions and tokens. The admin panel is compiled into the image rather than rebuilt on your build minutes, and the upstream version is pinned, which matters on an app that runs forward-only database migrations at boot. The super administrator is seeded by a separate process that must exit before the server binds a port, so the very first request the public URL ever serves already sees a claimed instance. Every secret Strapi needs — APP_KEYS, ADMIN_JWT_SECRET, API_TOKEN_SALT, TRANSFER_TOKEN_SALT, JWT_SECRET, ENCRYPTION_KEY — is generated once per deployment and published as a template variable, so sessions, API tokens and encrypted fields survive a restart. The volume is ownership-repaired before Strapi starts, because Railway mounts volumes as root while this image runs as an unprivileged user.

Why Deploy Strapi on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Strapi on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Nobody else can claim your admin account — Strapi's /admin/register-admin route stays open until the first administrator exists, and it hands out the Super Admin role. On a deploy that seeds no account, the first visitor to the public URL gets full content-type builder, API token and user management access, and the deployer is locked out with no recovery, because password reset needs SMTP a fresh deploy does not have. Here the account exists before the port opens: the first response ever served reports hasAdmin: true.
Uploads survive a redeploy — the local upload provider writes to the application's own public/uploads directory. This template mounts a volume and links that directory onto it, verified by re-fetching an uploaded file after a redeploy. A volume mounted anywhere else looks correct in the dashboard and stores nothing: Postgres keeps the file rows, so the Media Library still lists assets whose URLs 404.
Password reset by redeploy — Strapi exposes no non-interactive way to change an administrator's password, so the credential is re-applied on every boot from the template variable. Change it, redeploy, sign in.
Pinned and prebuilt — a fixed Strapi version with the admin panel already built, pulled as an image instead of compiled from a Git branch on every deploy.

Common Use Cases

A content API for a frontend — model pages, posts and collections, then consume them from Next.js, Nuxt, Astro, SvelteKit or a mobile app over REST or GraphQL.
An editorial back office — give writers and editors a real admin UI with per-role permissions, drafts, and internationalisation.
A product or media catalogue — content types plus the media library, served through API tokens to whatever needs them.

Dependencies for Strapi Hosting

PostgreSQL (included in this template) for content, users, permissions and tokens.
A volume mounted at /data (included) for the media library.

Deployment Dependencies

Strapi — the upstream project (MIT / Strapi EE licence for enterprise features)
bon5co/strapi-railway — the Railway wrapper image this template deploys

Implementation Details

Sign in at https:///admin with STRAPI_ADMIN_EMAIL and the generated STRAPI_ADMIN_PASSWORD from the service variables. To rotate the password, change STRAPI_ADMIN_PASSWORD and redeploy.

Keep APP_KEYS, ADMIN_JWT_SECRET, JWT_SECRET, API_TOKEN_SALT, TRANSFER_TOKEN_SALT and ENCRYPTION_KEY stable — changing them invalidates existing sessions, API tokens and transfer tokens.