🟢 Actively maintained — last updated Oct '26.

Deploy and Host Border0 Zero-Trust Tunnel with Railway

This template deploys a Border0 connector that gives your team identity-aware, zero-trust access to private services — databases, admin panels, internal tools — without a VPN, without open ports, and with SSO (Google, GitHub, Microsoft) and policies on every connection.

About Hosting Border0

Border0 replaces traditional VPN access with per-service tunnels governed by identity. The connector runs as a lightweight Railway service, registers with your Border0 organization using a connector token, and maintains encrypted sockets through the Border0 Global Edge. Authorized users reach your private services through those sockets; everyone else sees nothing. All access is authenticated, authorized by policy, and logged.

On Railway, the connector coexists with the services it protects: point a socket at any private-network service in the same project and it becomes reachable — for the right people only — without a public domain.

Why Deploy Border0 on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically scale it.

By deploying Border0 on Railway, you get zero-trust, SSO-gated access to your private Railway services with full audit logs — no bastion hosts, no port forwarding, no shared credentials.

Common Use Cases

Private database access: reach a MongoDB/PostgreSQL/Redis service in a Railway project from your laptop or CI without a TCP proxy exposed to the internet.
Internal tooling protection: put admin dashboards behind Google/GitHub/Microsoft SSO instead of IP allowlists or shared passwords.
Secure developer access: give team members temporary, audited access to staging and development environments.
Compliance-friendly access: every session is authenticated, policy-checked, and logged centrally.

Dependencies for Border0 Hosting

A Border0 account (free tier available) and a connector token created at border0.com — the only credential this template needs.

Deployment Dependencies

Docker image contourkde/border0
BORDER0_TOKEN — connector token from your Border0 organization (required at deploy time; create it under Border0 → Connectors)
Border0 documentation: docs.border0.com — connectors, sockets, and policies