Deploy and Host a Valhalla Private-Room Host on Railway

A participant-controlled Valhalla private-room mailbox: a Rust source build of vhalla private-host from hraness/valhalla listening on loopback behind a small TCP bridge, with host state persisted on a /data volume.

In development. Do not host sensitive data yet.

About Hosting a Valhalla Private-Room Host

The host is a mailbox for a Valhalla private room: it stores opaque ciphertext under per-credential quotas and serves it to room members over pinned TLS 1.3. The participants control the host; Railway is only the infrastructure provider they chose. The application listener stays on loopback inside the container and only a small socat bridge on port 19473 is exposed through Railway's TCP proxy. Host state (CA, member tokens, mailbox) lives on the attached /data volume and survives redeploys.

The template configures everything the service needs:

vhalla built from the repository with the experimental-private feature set
A persistent /data volume holding the host home
A public TCP proxy onto the service's application port (19473)

Why Deploy a Valhalla Private-Room Host on Railway?

The private-room host is designed to run anywhere the participants control: a laptop, a LAN box, a VPS or a small hosted container. Railway is the near-zero-operations route: the template wires the build, volume and public endpoint, and the measured footprint is small (about 13 MB resident for the host plus about 4 MB for the bridge at idle).

Railway meters usage. A lightly used host measured about $0.40/month, inside the Free plan's included usage credit. See Railway pricing for current terms.

Common Use Cases

A private-room mailbox for a small group, run on participant-selected infrastructure rather than a provider-hosted service
An always-on relay for members on laptops that sleep and roam
A test deployment of the private-room transport against real public endpoints

Dependencies for a Valhalla Private-Room Host

Deployment Dependencies

A Railway account. The Free plan's included usage credit covers a lightly used host (measured about $0.40/month).
The public hraness/valhalla repository, built by the template's Dockerfile at deploy/railway/Dockerfile via the root railway.toml. No secrets are baked in; the host generates its own CA and member tokens on first boot.

After deploy

The TCP proxy endpoint is under the service's Networking tab: *.proxy.rlwy.net:PORT. Members use it as the host endpoint.
Read the member credentials out of the host volume: config.json carries the namespace, TLS name and member token, and ca.der is the pinned CA. Hand them to members over a confidential channel; they are the access credentials and the trust anchor.
Members connect with vhalla private ... --addr :.

APP_PORT and HOME_DIR are optional overrides; leave them empty to keep the defaults (19473 and /data/host).

Notes

The host is a mailbox, not a backup. Host loss starts a new mailbox generation; member stores are the durable record.
Full operator guide, including credential extraction commands: deploy/railway/README.md