Platforms
Envlet on Railway
One variable in the Railway service, then envlet run in the start command.
ENVLET_TOKENset with railway
Set up
Three steps. The host keeps one secret and everything else arrives at boot.
- 01
Create a token
Add Railway under Access and create a token for the environment it deploys.
ci/railwayciIts own token, separate from your login.- token
- envlet_•••••••• shown once
- opens
- one project, one environment
- expires
- always
- 02
Set one secret
Add ENVLET_TOKEN in the service's Variables tab or with the Railway CLI, one token per Railway environment.
Set the tokenrailway variables --set ENVLET_TOKEN=envlet_... - 03
Start through Envlet
Set the service start command to envlet run followed by your usual command.
Start commandnpx -y @envlet/cli run -- npm start
What the host keeps
One secret in Railway. Rotate everything else in Envlet without touching the host.
Railway / production / environment variables
| ENVLET_TOKEN | envlet_•••••••• | the only secret the host keeps |
| DATABASE_URL | •••••••• | moved to Envlet |
| STRIPE_KEY | •••••••• | moved to Envlet |
| SENTRY_DSN | •••••••• | moved to Envlet |
Questions
Will my app start if Envlet is down?
No. It retries for a few seconds, then fails so you notice. It never starts with half an environment.
Do I still need Railway's own secret store?
Only for ENVLET_TOKEN. Everything else lives in Envlet, so you rotate in one place.