Deploy and Host TriliumNext on Railway

Run TriliumNext v0.105.0 as one authenticated Railway service with a persistent data volume, immutable linux/amd64 image pin, non-root runtime, and secure closed-first readiness.

About Hosting TriliumNext

The template generates the owner password, mounts /home/node/trilium-data, and keeps public traffic closed until the database is initialized, owner authentication works, and first-owner setup is closed. Retrieve the generated password from Railway Variables, log in, create synthetic content, and test one restart before importing important data.

Common Use Cases

Maintain a hierarchical personal knowledge base.
Store notes and attachments with persistent local state.
Use authenticated ETAPI or MCP integrations after explicitly creating and protecting their separate credentials.

Dependencies for TriliumNext Hosting

One public application service.
One volume at /home/node/trilium-data.
Generated TRILIUM_OWNER_PASSWORD.
Fixed PORT=3000, health path /readyz, one replica, Serverless off.
Exact TriliumNext v0.105.0 linux/amd64 image digest.

Why Deploy TriliumNext on Railway?

The package removes the unsafe public first-owner claim window: a loopback-only Trilium process is initialized and authenticated before the public gateway opens. It also provides immutable source provenance, non-root execution, volume persistence, exact readiness, and recovery instructions.

Persistence and recovery

Back up the complete stopped /home/node/trilium-data tree, not only a note export or live database file. Restore the matching archive to a fresh volume with UID/GID 1000 and verify auth, notes, attachments, search, ETAPI/MCP where used, and restart. Rollback restores the matching pre-update archive and image; general in-place downgrade compatibility is not claimed.

Support

Template issues cover package pins, Railway wiring, secure bootstrap, readiness, non-root execution, persistence, and documentation. Upstream app issues belong to TriliumNext; Railway account, billing, domain, and volume incidents belong to Railway. Never post passwords, tokens, cookies, notes, attachments, exports, backups, private URLs, or unredacted logs.