Connect Drizzle Kit to a private Railway database with Tailscale

Create a Railway project

Log in to your Railway dashboard and click the New Project button.

Provision a PostgreSQL database

On the project canvas, click the New button in the top right corner and select Database → PostgreSQL. You can also use the command palette ( ⌘K CtrlK ) and search for PostgreSQL.

Keep the database on the private network

Click on the PostgreSQL service, go to the Settings tab, and find the Networking section. Verify that public access is disabled. Under Private Networking you will see the private domain of the service, for example postgres.railway.internal.

Open the template

Press the button below to open the Tailscale for Drizzle template.

Don’t deploy it right away. Set the variables first.

Open the Deploy to dropdown and select the project that holds your database.

Set the variables

Some variables, such as TS_HOSTNAME, are in the collapsed Pre-Configured Environment Variables section of the card. Expand it to see or change them.

Deploy the template

On the service card, click Save Config. Then click Review and deploy. Railway opens your project with the template in a side panel. Click Deploy Template there.

Sign in from the deploy log

Open the Tailscale service, then its Deployments tab, and read the deploy log. The last lines of the log hold a sign-in link:

This service is not on your tailnet yet. Open this link and sign in
with the account that owns your tailnet:
  https://login.tailscale.com/a/xxxxxxxxxxxx

Open the link and sign in. Anyone who opens that link first gets this machine on their tailnet, so do not forward it. The log is visible only to members of your Railway project.

If your tailnet requires device approval, the log says so and the machine waits until you approve it on the Machines page.

Check the forwarding rule

A few seconds after you sign in, the same log prints:

joined tailnet: example.com
5432: ready

Check that the tailnet name is yours. If it is not, someone else opened the sign-in link first, and their tailnet can now reach this service. To take the service back:

1. On the project canvas, click the volume under the Tailscale service, open its Settings tab, and click Wipe volume.
2. Type the confirmation text and click Wipe. Railway deletes the machine’s key and redeploys the service.
3. Open the sign-in link from the new deploy log yourself.
4. Change the database user’s password.

Find the machine name

Open the Machines page. The new machine has the name you set in TS_HOSTNAME. If your tailnet already had a machine with that name, the new name ends in -1, -2 and so on. Use the name that the Machines page shows.

Set the connection string

Open the PostgreSQL service in Railway, go to the Variables tab, and copy DATABASE_URL.

Replace the ***.railway.internal host with the machine name and keep the rest of the string. Put the result in a .env file:

DATABASE_URL=postgresql://postgres:PASSWORD@MACHINE_NAME:5432/railway

Replace the following:

• PASSWORD: the password from the DATABASE_URL that you copied
• MACHINE_NAME: the machine name from the Machines page, for example railway-postgres

Set up the Drizzle config file

Create a drizzle.config.ts file in the root of your project:

import { defineConfig } from "drizzle-kit";

export default defineConfig({
  schema: "./src/schema.ts",
  out: "./migrations",
  dialect: "postgresql",
  dbCredentials: {
    url: process.env.DATABASE_URL!,
  },
});

Apply your schema

Generate migrations and apply them:

npx drizzle-kit generate

npx drizzle-kit migrate

For rapid prototyping you can push the schema directly with drizzle-kit push. For production deployments, prefer the generate and migrate workflow, so you keep a versioned history of schema changes. See the Drizzle migrations fundamentals page for details.

Check the tables in Drizzle Studio

Open the database in Drizzle Studio:

npx drizzle-kit studio

It runs on your device and reads the same DATABASE_URL, so it reaches the database through the Tailscale service. Your new tables are there.