From 85070b9a4c2e0088e6a5b83786b9aa50572f85dc Mon Sep 17 00:00:00 2001
From: Huotsty <penghout78@gmail.com>
Date: Mon, 26 Jan 2026 15:00:24 +0700
Subject: [PATCH 1/9] okkes

---
 Dockerfile                  |   9 ++++
 config/identity.schema.json |  49 +++++++++++++++++
 config/kratos.yml           | 101 ++++++++++++++++++++++++++++++++++++
 3 files changed, 159 insertions(+)
 create mode 100644 Dockerfile
 create mode 100644 config/identity.schema.json
 create mode 100644 config/kratos.yml

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 000000000000..390bb77468ca
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,9 @@
+# Use the official Ory Kratos image pinned to a secure digest
+FROM oryd/kratos@sha256:e8014c6c58b68e9d8bea4160d3e271b0d05b3db221af379afb6798b603e88ee9
+
+# Copy your configuration files into the container
+COPY ./config/kratos.yml /etc/config/kratos/kratos.yml
+COPY ./config/identity.schema.json /etc/config/kratos/identity.schema.json
+
+# Run Kratos with your configuration
+CMD ["serve", "-c", "/etc/config/kratos/kratos.yml"]
diff --git a/config/identity.schema.json b/config/identity.schema.json
new file mode 100644
index 000000000000..1a137875666e
--- /dev/null
+++ b/config/identity.schema.json
@@ -0,0 +1,49 @@
+{
+  "$id": "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Person",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string",
+          "format": "email",
+          "title": "E-Mail",
+          "minLength": 3,
+          "ory.sh/kratos": {
+            "credentials": {
+              "password": {
+                "identifier": true
+              }
+            },
+            "verification": {
+              "via": "email"
+            },
+            "recovery": {
+              "via": "email"
+            }
+          }
+        },
+        "name": {
+          "type": "object",
+          "properties": {
+            "first": {
+              "title": "First Name",
+              "type": "string"
+            },
+            "last": {
+              "title": "Last Name",
+              "type": "string"
+            }
+          }
+        }
+      },
+      "required": [
+        "email"
+      ],
+      "additionalProperties": false
+    }
+  }
+}
diff --git a/config/kratos.yml b/config/kratos.yml
new file mode 100644
index 000000000000..d8aee14eccd6
--- /dev/null
+++ b/config/kratos.yml
@@ -0,0 +1,101 @@
+version: v0.13.0
+
+dsn: ${DATABASE_URL}
+
+serve:
+  public:
+    base_url: https://${RAILWAY_STATIC_URL}
+    port: 4433
+    cors:
+      enabled: true
+  admin:
+    base_url: http://0.0.0.0:4434
+    port: 4434
+
+selfservice:
+  default_browser_return_url: https://${RAILWAY_STATIC_URL}/welcome
+  allowed_return_urls:
+    - https://${RAILWAY_STATIC_URL}
+
+  methods:
+    password:
+      enabled: true
+    totp:
+      config:
+        issuer: Kratos
+      enabled: true
+    lookup_secret:
+      enabled: true
+    link:
+      enabled: true
+    code:
+      enabled: true
+
+  flows:
+    error:
+      ui_url: https://${RAILWAY_STATIC_URL}/error
+
+    settings:
+      ui_url: https://${RAILWAY_STATIC_URL}/settings
+      privileged_session_max_age: 15m
+      required_aal: highest_available
+
+    recovery:
+      enabled: true
+      ui_url: https://${RAILWAY_STATIC_URL}/recovery
+      use: code
+
+    verification:
+      enabled: true
+      ui_url: https://${RAILWAY_STATIC_URL}/verification
+      use: code
+      after:
+        default_browser_return_url: https://${RAILWAY_STATIC_URL}/welcome
+
+    logout:
+      after:
+        default_browser_return_url: https://${RAILWAY_STATIC_URL}/login
+
+    login:
+      ui_url: https://${RAILWAY_STATIC_URL}/login
+      lifespan: 10m
+
+    registration:
+      lifespan: 10m
+      ui_url: https://${RAILWAY_STATIC_URL}/registration
+      after:
+        password:
+          hooks:
+            - hook: session
+            - hook: show_verification_ui
+
+log:
+  level: info
+  format: json
+
+secrets:
+  cookie:
+    - ${COOKIE_SECRET}
+  cipher:
+    - ${CIPHER_SECRET}
+
+ciphers:
+  algorithm: xchacha20-poly1305
+
+hashers:
+  algorithm: bcrypt
+  bcrypt:
+    cost: 12
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: file:///etc/config/kratos/identity.schema.json
+
+courier:
+  smtp:
+    connection_uri: ""
+
+feature_flags:
+  use_continue_with_transitions: true

From b2b986778461217d365fa96cb7673f3251a27be5 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 05:35:25 +0000
Subject: [PATCH 2/9] Initial plan


From fb6dc50a0d92ba467ad65093ab9439fc3565a90b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 05:37:44 +0000
Subject: [PATCH 3/9] Add Railway deployment configuration with auto-migration

Co-authored-by: Huotsty <122008167+Huotsty@users.noreply.github.com>
---
 Dockerfile        |   8 +-
 README.railway.md | 235 ++++++++++++++++++++++++++++++++++++++++++++++
 config/kratos.yml |   2 +-
 entrypoint.sh     |  60 ++++++++++++
 railway.json      |  88 +++++++++++++++++
 5 files changed, 390 insertions(+), 3 deletions(-)
 create mode 100644 README.railway.md
 create mode 100644 entrypoint.sh
 create mode 100644 railway.json

diff --git a/Dockerfile b/Dockerfile
index 390bb77468ca..4674532591a4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,5 +5,9 @@ FROM oryd/kratos@sha256:e8014c6c58b68e9d8bea4160d3e271b0d05b3db221af379afb6798b6
 COPY ./config/kratos.yml /etc/config/kratos/kratos.yml
 COPY ./config/identity.schema.json /etc/config/kratos/identity.schema.json
 
-# Run Kratos with your configuration
-CMD ["serve", "-c", "/etc/config/kratos/kratos.yml"]
+# Copy and setup entrypoint script for Railway deployment
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+# Use entrypoint script that handles migrations and starts Kratos
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/README.railway.md b/README.railway.md
new file mode 100644
index 000000000000..d8e6ed8ae90a
--- /dev/null
+++ b/README.railway.md
@@ -0,0 +1,235 @@
+# Deploy Ory Kratos on Railway
+
+This guide helps you deploy Ory Kratos identity and user management system on Railway with automatic database migrations.
+
+## Quick Deploy
+
+Deploy Ory Kratos to Railway with one click:
+
+[![Deploy on Railway](https://railway.app/button.svg)](https://railway.app/template/kratos)
+
+This will automatically:
+- 🚀 Deploy the Kratos service
+- 🗄️ Provision a PostgreSQL database
+- 🔄 Run database migrations automatically
+- 🔐 Generate secure secrets
+- 🌐 Create a public domain
+
+## Manual Deployment
+
+### Prerequisites
+
+- A [Railway account](https://railway.app/)
+- Railway CLI installed (optional): `npm i -g @railway/cli`
+
+### Step 1: Create a New Project
+
+1. Go to [Railway](https://railway.app/)
+2. Click "New Project"
+3. Choose "Deploy from GitHub repo"
+4. Select this repository
+
+### Step 2: Add PostgreSQL Database
+
+1. In your Railway project, click "New"
+2. Select "Database"
+3. Choose "PostgreSQL"
+4. Railway will automatically provide these environment variables:
+   - `POSTGRES_HOST`
+   - `POSTGRES_PORT`
+   - `POSTGRES_USER`
+   - `POSTGRES_PASSWORD`
+   - `POSTGRES_DATABASE`
+
+### Step 3: Configure Environment Variables
+
+Add the following environment variables to your Kratos service:
+
+#### Required Secrets
+
+Generate secure secrets using OpenSSL:
+
+```bash
+# Generate COOKIE_SECRET (32 bytes hex = 64 characters)
+openssl rand -hex 32
+
+# Generate CIPHER_SECRET (32 bytes hex = 64 characters)
+openssl rand -hex 32
+```
+
+Add these to Railway:
+- `COOKIE_SECRET`: Your generated cookie secret
+- `CIPHER_SECRET`: Your generated cipher secret
+
+#### Automatic Variables
+
+Railway automatically provides:
+- `RAILWAY_STATIC_URL`: Your public domain (e.g., `kratos-production.up.railway.app`)
+
+The entrypoint script automatically constructs the database DSN from the PostgreSQL variables.
+
+### Step 4: Deploy
+
+1. Railway will automatically build and deploy your service
+2. The entrypoint script will:
+   - Wait for PostgreSQL to be ready
+   - Run database migrations automatically
+   - Start the Kratos server
+3. Your Kratos instance will be available at your Railway domain
+
+## Service Endpoints
+
+Once deployed, you'll have access to:
+
+- **Public API**: `https://${RAILWAY_STATIC_URL}:4433` (main API for client applications)
+- **Admin API**: `https://${RAILWAY_STATIC_URL}:4434` (internal admin operations)
+- **Health Check**: `https://${RAILWAY_STATIC_URL}/health/ready`
+
+## Configuration
+
+### Database Connection
+
+The entrypoint script automatically constructs the PostgreSQL DSN from Railway's environment variables:
+
+```bash
+postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DATABASE}?sslmode=disable
+```
+
+If you prefer to use a custom `DATABASE_URL`, the script will use that instead.
+
+### Identity Schema
+
+The default identity schema (`/etc/config/kratos/identity.schema.json`) supports:
+- Email and password authentication
+- Email verification
+- Password recovery
+- User profile with first and last name
+
+You can customize this by modifying `config/identity.schema.json` in your repository.
+
+### Authentication Methods
+
+Enabled by default:
+- ✅ Password authentication
+- ✅ TOTP (Time-based One-Time Password)
+- ✅ Recovery codes (lookup secrets)
+- ✅ Email verification codes
+- ✅ Password recovery codes
+
+### Self-Service Flows
+
+All self-service flows are pre-configured:
+- Registration: `https://${RAILWAY_STATIC_URL}/registration`
+- Login: `https://${RAILWAY_STATIC_URL}/login`
+- Recovery: `https://${RAILWAY_STATIC_URL}/recovery`
+- Verification: `https://${RAILWAY_STATIC_URL}/verification`
+- Settings: `https://${RAILWAY_STATIC_URL}/settings`
+- Error: `https://${RAILWAY_STATIC_URL}/error`
+
+**Note**: These URLs expect a frontend application. You'll need to build UI pages for these flows or use Ory's hosted UI.
+
+## Automatic Migrations
+
+The entrypoint script (`entrypoint.sh`) handles database migrations automatically:
+
+1. **Waits for PostgreSQL**: Retries connection up to 30 times (60 seconds total)
+2. **Shows current status**: Displays migration status before running
+3. **Runs migrations**: Executes `kratos migrate sql up -e --yes`
+4. **Confirms success**: Shows migration status after completion
+5. **Starts server**: Launches Kratos with `serve all` command
+
+### Migration Logs
+
+Check your Railway deployment logs to see migration progress:
+
+```
+🚀 Starting Ory Kratos setup...
+✅ Using Railway PostgreSQL
+📊 Database connection configured
+⏳ Waiting for PostgreSQL to be ready...
+✅ Database is ready!
+📋 Current migration status:
+...
+🔄 Running database migrations...
+...
+🎉 Migrations completed successfully!
+🚀 Starting Kratos server...
+```
+
+## Troubleshooting
+
+### Database Connection Issues
+
+If migrations fail:
+
+1. Check PostgreSQL service is running in Railway
+2. Verify environment variables are set correctly
+3. Check Railway logs for connection errors
+4. Ensure PostgreSQL service is linked to Kratos service
+
+### Secret Generation
+
+Always use strong secrets:
+
+```bash
+# Good: 32 bytes = 64 hex characters
+openssl rand -hex 32
+
+# Bad: Short or predictable secrets
+# Don't use: "mysecret123" or other simple strings
+```
+
+### Health Check Failing
+
+The health check endpoint is `/health/ready`. If it fails:
+
+1. Check Kratos logs in Railway
+2. Verify database migrations completed successfully
+3. Ensure both ports 4433 and 4434 are accessible
+4. Check that `RAILWAY_STATIC_URL` is set correctly
+
+### Viewing Logs
+
+In Railway:
+1. Open your project
+2. Click on the Kratos service
+3. Go to the "Deployments" tab
+4. Click on the latest deployment
+5. View logs in real-time
+
+## Security Considerations
+
+1. **Secrets**: Railway automatically generates secure secrets. Store them safely.
+2. **HTTPS**: Railway provides HTTPS by default for your domain.
+3. **Database**: PostgreSQL runs in a private network, not publicly accessible.
+4. **CORS**: CORS is enabled. Configure `allowed_return_urls` in `config/kratos.yml` for your specific domains.
+5. **Admin API**: The admin API (port 4434) should be restricted to internal services only.
+
+## Updating Configuration
+
+To update Kratos configuration:
+
+1. Modify `config/kratos.yml` in your repository
+2. Commit and push changes
+3. Railway will automatically redeploy
+4. Migrations will run again (safely, they're idempotent)
+
+## Support
+
+- [Ory Kratos Documentation](https://www.ory.sh/docs/kratos)
+- [Railway Documentation](https://docs.railway.app/)
+- [Ory Community](https://github.com/ory/kratos/discussions)
+
+## Next Steps
+
+After deployment:
+
+1. **Build a UI**: Create frontend pages for the self-service flows
+2. **Configure Email**: Set up SMTP for email verification and recovery
+3. **Add OAuth**: Configure social login providers if needed
+4. **Customize Schema**: Modify identity schema for your use case
+5. **Set up Monitoring**: Use Railway's monitoring features
+
+## License
+
+This deployment configuration is part of the Ory Kratos project. See the main repository for license information.
diff --git a/config/kratos.yml b/config/kratos.yml
index d8aee14eccd6..7bbe59a1a236 100644
--- a/config/kratos.yml
+++ b/config/kratos.yml
@@ -1,6 +1,6 @@
 version: v0.13.0
 
-dsn: ${DATABASE_URL}
+dsn: env://DSN
 
 serve:
   public:
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100644
index 000000000000..1ef12af3ac9c
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+set -e
+
+echo "🚀 Starting Ory Kratos setup..."
+
+# Construct DSN from Railway PostgreSQL variables
+if [ -n "$POSTGRES_HOST" ]; then
+    export DSN="postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DATABASE}?sslmode=disable"
+    echo "✅ Using Railway PostgreSQL"
+elif [ -n "$DATABASE_URL" ]; then
+    export DSN="$DATABASE_URL"
+    echo "✅ Using DATABASE_URL"
+else
+    echo "❌ ERROR: No database configuration found"
+    exit 1
+fi
+
+echo "📊 Database connection configured"
+
+# Wait for database to be ready
+echo "⏳ Waiting for PostgreSQL to be ready..."
+MAX_RETRIES=30
+RETRY_COUNT=0
+RETRY_INTERVAL=2
+
+until kratos migrate sql status -e 2>/dev/null || [ $RETRY_COUNT -eq $MAX_RETRIES ]; do
+    RETRY_COUNT=$((RETRY_COUNT + 1))
+    echo "   Attempt $RETRY_COUNT/$MAX_RETRIES - Database not ready yet..."
+    sleep $RETRY_INTERVAL
+done
+
+if [ $RETRY_COUNT -eq $MAX_RETRIES ]; then
+    echo "❌ ERROR: Database did not become ready after $MAX_RETRIES attempts"
+    exit 1
+fi
+
+echo "✅ Database is ready!"
+
+# Show migration status before running migrations
+echo ""
+echo "📋 Current migration status:"
+kratos migrate sql status -e || true
+
+# Run migrations
+echo ""
+echo "🔄 Running database migrations..."
+kratos migrate sql up -e --yes
+
+# Show migration status after running migrations
+echo ""
+echo "📋 Migration status after update:"
+kratos migrate sql status -e
+
+echo ""
+echo "🎉 Migrations completed successfully!"
+echo "🚀 Starting Kratos server..."
+echo ""
+
+# Start Kratos server
+exec kratos serve all -c /etc/config/kratos/kratos.yml
diff --git a/railway.json b/railway.json
new file mode 100644
index 000000000000..d5e4ddb27af8
--- /dev/null
+++ b/railway.json
@@ -0,0 +1,88 @@
+{
+  "$schema": "https://railway.app/railway.schema.json",
+  "build": {
+    "builder": "DOCKERFILE",
+    "dockerfilePath": "Dockerfile"
+  },
+  "deploy": {
+    "numReplicas": 1,
+    "startCommand": "/entrypoint.sh",
+    "healthcheckPath": "/health/ready",
+    "healthcheckTimeout": 100,
+    "restartPolicyType": "ON_FAILURE",
+    "restartPolicyMaxRetries": 10
+  },
+  "services": [
+    {
+      "name": "kratos",
+      "icon": "https://raw.githubusercontent.com/ory/meta/master/static/logos/logo-kratos.png",
+      "domains": [
+        {
+          "name": "kratos",
+          "port": 4433
+        }
+      ],
+      "ports": [
+        {
+          "name": "public",
+          "port": 4433,
+          "protocol": "HTTP"
+        },
+        {
+          "name": "admin",
+          "port": 4434,
+          "protocol": "HTTP"
+        }
+      ],
+      "variables": {
+        "COOKIE_SECRET": {
+          "description": "Secret for encrypting cookies (generate with: openssl rand -hex 32)",
+          "generator": {
+            "type": "secret",
+            "length": 64
+          }
+        },
+        "CIPHER_SECRET": {
+          "description": "Secret for encrypting sensitive data (generate with: openssl rand -hex 32)",
+          "generator": {
+            "type": "secret",
+            "length": 64
+          }
+        },
+        "RAILWAY_STATIC_URL": {
+          "description": "Your Railway public URL (automatically provided by Railway)"
+        }
+      },
+      "serviceReferences": [
+        {
+          "name": "postgres",
+          "type": "database"
+        }
+      ]
+    }
+  ],
+  "databases": [
+    {
+      "name": "postgres",
+      "type": "postgresql",
+      "plan": "starter",
+      "variables": {
+        "POSTGRES_HOST": {
+          "description": "PostgreSQL host (automatically provided)"
+        },
+        "POSTGRES_PORT": {
+          "description": "PostgreSQL port (automatically provided)"
+        },
+        "POSTGRES_USER": {
+          "description": "PostgreSQL user (automatically provided)"
+        },
+        "POSTGRES_PASSWORD": {
+          "description": "PostgreSQL password (automatically provided)"
+        },
+        "POSTGRES_DATABASE": {
+          "description": "PostgreSQL database name (automatically provided)"
+        }
+      }
+    }
+  ]
+}

From e56b7fd237bea07602e518bcc02a83cf313ec713 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 05:38:40 +0000
Subject: [PATCH 4/9] Fix Dockerfile USER permissions for entrypoint.sh

Co-authored-by: Huotsty <122008167+Huotsty@users.noreply.github.com>
---
 Dockerfile    | 6 ++++++
 entrypoint.sh | 0
 2 files changed, 6 insertions(+)
 mode change 100644 => 100755 entrypoint.sh

diff --git a/Dockerfile b/Dockerfile
index 4674532591a4..71609d039f5a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,9 @@
 # Use the official Ory Kratos image pinned to a secure digest
 FROM oryd/kratos@sha256:e8014c6c58b68e9d8bea4160d3e271b0d05b3db221af379afb6798b603e88ee9
 
+# Switch to root to modify file permissions
+USER root
+
 # Copy your configuration files into the container
 COPY ./config/kratos.yml /etc/config/kratos/kratos.yml
 COPY ./config/identity.schema.json /etc/config/kratos/identity.schema.json
@@ -9,5 +12,8 @@ COPY ./config/identity.schema.json /etc/config/kratos/identity.schema.json
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
+# Switch back to ory user for security
+USER ory
+
 # Use entrypoint script that handles migrations and starts Kratos
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/entrypoint.sh b/entrypoint.sh
old mode 100644
new mode 100755

From bfc9e4a4a434f3928bda30a8fe317f9861389603 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 05:39:25 +0000
Subject: [PATCH 5/9] Improve security: use sslmode=require and reduce
 healthcheck timeout

Co-authored-by: Huotsty <122008167+Huotsty@users.noreply.github.com>
---
 entrypoint.sh | 2 +-
 railway.json  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/entrypoint.sh b/entrypoint.sh
index 1ef12af3ac9c..42b85c82d3bd 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -5,7 +5,7 @@ echo "🚀 Starting Ory Kratos setup..."
 
 # Construct DSN from Railway PostgreSQL variables
 if [ -n "$POSTGRES_HOST" ]; then
-    export DSN="postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DATABASE}?sslmode=disable"
+    export DSN="postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DATABASE}?sslmode=require"
     echo "✅ Using Railway PostgreSQL"
 elif [ -n "$DATABASE_URL" ]; then
     export DSN="$DATABASE_URL"
diff --git a/railway.json b/railway.json
index d5e4ddb27af8..9f897ecc4164 100644
--- a/railway.json
+++ b/railway.json
@@ -8,7 +8,7 @@
     "numReplicas": 1,
     "startCommand": "/entrypoint.sh",
     "healthcheckPath": "/health/ready",
-    "healthcheckTimeout": 100,
+    "healthcheckTimeout": 30,
     "restartPolicyType": "ON_FAILURE",
     "restartPolicyMaxRetries": 10
   },

From cf3bd9c3eeb543fa07aebbd00ad5a85e6e7634b1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 05:40:00 +0000
Subject: [PATCH 6/9] Fix documentation to match sslmode=require implementation

Co-authored-by: Huotsty <122008167+Huotsty@users.noreply.github.com>
---
 README.railway.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.railway.md b/README.railway.md
index d8e6ed8ae90a..af404ac304b8 100644
--- a/README.railway.md
+++ b/README.railway.md
@@ -92,7 +92,7 @@ Once deployed, you'll have access to:
 The entrypoint script automatically constructs the PostgreSQL DSN from Railway's environment variables:
 
 ```bash
-postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DATABASE}?sslmode=disable
+postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DATABASE}?sslmode=require
 ```
 
 If you prefer to use a custom `DATABASE_URL`, the script will use that instead.

From e8b45a39b9849ecd43e2c0fc6a4dda485dce6a34 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 05:41:36 +0000
Subject: [PATCH 7/9] Fix railway.json structure and update documentation with
 correct Railway URLs

Co-authored-by: Huotsty <122008167+Huotsty@users.noreply.github.com>
---
 README.railway.md |  8 +++--
 railway.json      | 75 +----------------------------------------------
 2 files changed, 6 insertions(+), 77 deletions(-)

diff --git a/README.railway.md b/README.railway.md
index af404ac304b8..36e610106686 100644
--- a/README.railway.md
+++ b/README.railway.md
@@ -81,10 +81,12 @@ The entrypoint script automatically constructs the database DSN from the Postgre
 
 Once deployed, you'll have access to:
 
-- **Public API**: `https://${RAILWAY_STATIC_URL}:4433` (main API for client applications)
-- **Admin API**: `https://${RAILWAY_STATIC_URL}:4434` (internal admin operations)
+- **Public API**: `https://${RAILWAY_STATIC_URL}` (Railway maps your domain to port 4433 internally)
+- **Admin API**: Internal only, accessible at `http://localhost:4434` or between Railway services
 - **Health Check**: `https://${RAILWAY_STATIC_URL}/health/ready`
 
+Note: Railway automatically handles port mapping. The public API is accessible via your Railway domain, while the admin API is typically kept internal for security.
+
 ## Configuration
 
 ### Database Connection
@@ -132,7 +134,7 @@ All self-service flows are pre-configured:
 
 The entrypoint script (`entrypoint.sh`) handles database migrations automatically:
 
-1. **Waits for PostgreSQL**: Retries connection up to 30 times (60 seconds total)
+1. **Waits for PostgreSQL**: Retries connection up to 30 times (approximately 60+ seconds total with 2-second intervals)
 2. **Shows current status**: Displays migration status before running
 3. **Runs migrations**: Executes `kratos migrate sql up -e --yes`
 4. **Confirms success**: Shows migration status after completion
diff --git a/railway.json b/railway.json
index 9f897ecc4164..22c64f78d7b2 100644
--- a/railway.json
+++ b/railway.json
@@ -11,78 +11,5 @@
     "healthcheckTimeout": 30,
     "restartPolicyType": "ON_FAILURE",
     "restartPolicyMaxRetries": 10
-  },
-  "services": [
-    {
-      "name": "kratos",
-      "icon": "https://raw.githubusercontent.com/ory/meta/master/static/logos/logo-kratos.png",
-      "domains": [
-        {
-          "name": "kratos",
-          "port": 4433
-        }
-      ],
-      "ports": [
-        {
-          "name": "public",
-          "port": 4433,
-          "protocol": "HTTP"
-        },
-        {
-          "name": "admin",
-          "port": 4434,
-          "protocol": "HTTP"
-        }
-      ],
-      "variables": {
-        "COOKIE_SECRET": {
-          "description": "Secret for encrypting cookies (generate with: openssl rand -hex 32)",
-          "generator": {
-            "type": "secret",
-            "length": 64
-          }
-        },
-        "CIPHER_SECRET": {
-          "description": "Secret for encrypting sensitive data (generate with: openssl rand -hex 32)",
-          "generator": {
-            "type": "secret",
-            "length": 64
-          }
-        },
-        "RAILWAY_STATIC_URL": {
-          "description": "Your Railway public URL (automatically provided by Railway)"
-        }
-      },
-      "serviceReferences": [
-        {
-          "name": "postgres",
-          "type": "database"
-        }
-      ]
-    }
-  ],
-  "databases": [
-    {
-      "name": "postgres",
-      "type": "postgresql",
-      "plan": "starter",
-      "variables": {
-        "POSTGRES_HOST": {
-          "description": "PostgreSQL host (automatically provided)"
-        },
-        "POSTGRES_PORT": {
-          "description": "PostgreSQL port (automatically provided)"
-        },
-        "POSTGRES_USER": {
-          "description": "PostgreSQL user (automatically provided)"
-        },
-        "POSTGRES_PASSWORD": {
-          "description": "PostgreSQL password (automatically provided)"
-        },
-        "POSTGRES_DATABASE": {
-          "description": "PostgreSQL database name (automatically provided)"
-        }
-      }
-    }
-  ]
+  }
 }

From efd56245abb014bfdcee2bae3c3168ce43a11f5b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 05:42:54 +0000
Subject: [PATCH 8/9] Remove redundant startCommand and improve error handling

Co-authored-by: Huotsty <122008167+Huotsty@users.noreply.github.com>
---
 entrypoint.sh | 4 +++-
 railway.json  | 1 -
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/entrypoint.sh b/entrypoint.sh
index 42b85c82d3bd..b051d53cb5f3 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -39,7 +39,9 @@ echo "✅ Database is ready!"
 # Show migration status before running migrations
 echo ""
 echo "📋 Current migration status:"
-kratos migrate sql status -e || true
+if ! kratos migrate sql status -e 2>&1; then
+    echo "⚠️  Note: Migration status check failed (this is expected for a new database)"
+fi
 
 # Run migrations
 echo ""
diff --git a/railway.json b/railway.json
index 22c64f78d7b2..c456e69575d0 100644
--- a/railway.json
+++ b/railway.json
@@ -6,7 +6,6 @@
   },
   "deploy": {
     "numReplicas": 1,
-    "startCommand": "/entrypoint.sh",
     "healthcheckPath": "/health/ready",
     "healthcheckTimeout": 30,
     "restartPolicyType": "ON_FAILURE",

From 4b9e3651e4a285551a611a067ba837b47c1de70e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 05:44:06 +0000
Subject: [PATCH 9/9] Use COPY --chmod for better security and update Railway
 template URL note

Co-authored-by: Huotsty <122008167+Huotsty@users.noreply.github.com>
---
 Dockerfile        | 11 ++---------
 README.railway.md |  4 +++-
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 71609d039f5a..a816ae62fb3b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,19 +1,12 @@
 # Use the official Ory Kratos image pinned to a secure digest
 FROM oryd/kratos@sha256:e8014c6c58b68e9d8bea4160d3e271b0d05b3db221af379afb6798b603e88ee9
 
-# Switch to root to modify file permissions
-USER root
-
 # Copy your configuration files into the container
 COPY ./config/kratos.yml /etc/config/kratos/kratos.yml
 COPY ./config/identity.schema.json /etc/config/kratos/identity.schema.json
 
-# Copy and setup entrypoint script for Railway deployment
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
-# Switch back to ory user for security
-USER ory
+# Copy and setup entrypoint script for Railway deployment with execute permissions
+COPY --chmod=755 entrypoint.sh /entrypoint.sh
 
 # Use entrypoint script that handles migrations and starts Kratos
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/README.railway.md b/README.railway.md
index 36e610106686..fc62c487561f 100644
--- a/README.railway.md
+++ b/README.railway.md
@@ -6,7 +6,9 @@ This guide helps you deploy Ory Kratos identity and user management system on Ra
 
 Deploy Ory Kratos to Railway with one click:
 
-[![Deploy on Railway](https://railway.app/button.svg)](https://railway.app/template/kratos)
+[![Deploy on Railway](https://railway.app/button.svg)](https://railway.app/new)
+
+> **Note**: Once you've set up your deployment, you can create a Railway template to enable one-click deployment for others. The template button will link to your published Railway template.
 
 This will automatically:
 - 🚀 Deploy the Kratos service