Deploy and Host Umami on Railway

Umami is an open-source, privacy-first analytics platform — a lightweight alternative to Google Analytics that tracks visitors without cookies, without personal data, and without sending anything to a third party. It is GDPR, CCPA, and PECR compliant by default, needs no cookie consent banner, and loads from a tracking script a fraction of the size of Google's.

This template deploys Umami with a managed PostgreSQL database, wired together and ready to use in minutes.

What This Template Deploys

Service	Purpose
Umami	The analytics dashboard and tracking API on port `3000`
PostgreSQL	Persistent store for websites, sessions, page views, and events

Both services run on Railway's private network. DATABASE_URL is injected automatically via a reference variable, and APP_SECRET is generated for you — no manual wiring required.

About Hosting Umami

Self-hosting Umami means your visitor data never leaves infrastructure you control. Google Analytics ships every page view to Google's servers and hands you sampled data in return; Umami keeps the full, unsampled dataset in your own PostgreSQL database, exportable at any time.

Running it yourself normally means a Node.js app, a PostgreSQL instance, connection strings, a session secret, SSL, and automatic migrations to manage. This template collapses all of that into a two-service Railway project. Umami applies its own database migrations on first boot, so there is no schema step — the dashboard is live as soon as the build finishes.

Typical cost: ~$5–10/month on Railway's Hobby plan for both services, flat regardless of traffic volume. There is no per-event billing and no monthly subscription — a sharp contrast to hosted analytics tools that charge per pageview once you outgrow the free tier.

Deploy in Under 5 Minutes

Click Deploy on Railway and wait for both services to build (~3 minutes)
Open the generated Railway domain — you'll land on the Umami login page
Sign in with the default credentials admin / umami
Change the password immediately under Settings → Profile, before adding any sites
Add a website, copy the tracking script, and paste it into your site's ``

Data appears in the dashboard in real time as visitors arrive.

Common Use Cases

Privacy-respecting website analytics — track visitors, page views, bounce rate, and referrers without cookies or GDPR consent banners
Google Analytics replacement — full unsampled data ownership with a ~2 KB script instead of Google's much heavier tag
Analytics for SaaS products — measure product usage where full data ownership is a compliance or trust requirement
Multi-site dashboard — monitor every project, blog, and landing page from a single instance
Custom event and campaign tracking — record button clicks, sign-ups, and marketing-campaign performance with named events
Client reporting at an agency — share a read-only public dashboard link with clients without giving them account access

Configuration

Variable	Required	Description
`DATABASE_URL`	Auto-injected	PostgreSQL connection string via Railway reference variable
`DATABASE_TYPE`	Pre-set	`postgresql`
`APP_SECRET`	Auto-generated	Secures authentication tokens — keep it stable and do not reuse it elsewhere
`PORT`	Pre-set	`3000`
`HOSTNAME`	Pre-set	`0.0.0.0` so Railway can route to the service
`TRACKER_SCRIPT_NAME`	Optional	Rename the tracking script from `script.js` to evade ad-blocker filters, e.g. `stats`
`DISABLE_TELEMETRY`	Optional	Set to `1` to disable Umami's anonymous usage telemetry
`REMOVE_TRAILING_SLASH`	Optional	Normalise URLs by stripping trailing slashes
`CLIENT_IP_HEADER`	Optional	Custom header for real client IP if behind an extra proxy

> Change the default login before you add any sites. Umami ships with admin / umami. Anyone who reaches your domain before you change it can take over the instance. Update the password on first login.

> APP_SECRET must stay stable. Changing it after deploy invalidates every existing session and logs everyone out. Let the generated value persist.

Dependencies for Umami Hosting

Railway account — Hobby plan (~$5–10/month) covers both services
A website where you can add a small script to the ``
Optional: a custom domain for the tracking script to improve ad-blocker resistance

Deployment Dependencies

Implementation Details

The template runs the official ghcr.io/umami-software/umami:postgresql-latest image on port 3000 against a Railway PostgreSQL service. DATABASE_URL is supplied through a Railway reference variable and DATABASE_TYPE is fixed to postgresql — PostgreSQL is the only database engine Umami supports going forward, following its deprecation of MySQL.

Umami runs its database migrations automatically at startup, so the schema is created on first boot with no manual step. APP_SECRET is generated at deploy time to secure session tokens; because it signs authentication state, it must remain constant across restarts.

The entire dataset — websites, sessions, page views, and events — lives in the PostgreSQL service. That database is your analytics history; back it up with pg_dump on a schedule, since losing it means losing your entire record of traffic.

Frequently Asked Questions

Is Umami really GDPR compliant? Yes. Umami collects no personally identifiable information and sets no cookies, so it falls outside the consent-banner requirements of GDPR, CCPA, and PECR. This is the main reason teams move to it from Google Analytics.

Do I need a cookie consent banner? No. Because Umami does not use cookies or track individuals across sites, the consent-banner obligations that apply to Google Analytics do not apply here.

Where is my analytics data stored? In the PostgreSQL service deployed alongside Umami — infrastructure you control. Nothing is sent to Umami's servers or any third party. Back the database up regularly, as it holds your full history.

How light is the tracking script? Around 2 KB, versus roughly 45 KB for Google Analytics with gtag.js. The difference is visible in page-load performance, especially on mobile.

Can ad blockers block Umami? Some block the default script.js filename. Set TRACKER_SCRIPT_NAME to a custom name, and ideally serve it from your own domain, to significantly reduce how often it is blocked.

Can I track more than one website? Yes. A single instance handles unlimited websites, each with its own tracking ID, all visible from one dashboard.

Can I share analytics without giving account access? Yes. Umami supports public, read-only dashboard links per website — useful for client reporting or a public stats page.

Does it support MySQL? No longer. Umami has consolidated on PostgreSQL, which this template uses. Existing MySQL users should follow Umami's migration guide before upgrading.

Why Deploy Umami on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Umami on Railway you get privacy-first website analytics that are yours end to end — Umami and PostgreSQL pre-wired over a private network, automatic HTTPS, a generated session secret, and no per-event billing. Own your visitor data, drop the cookie banner, and keep your analytics running alongside the rest of your stack.