Connect Drizzle Kit to a private Railway database with Tailscale

Create a Railway project

Log in to your Railway dashboard and click the New Project button.

Provision a PostgreSQL database

On the project canvas, click the New button in the top right corner and select Database → PostgreSQL. You can also use the command palette (Cmd/Ctrl + K) and search for PostgreSQL.

Keep the database on the private network

Click on the PostgreSQL service, go to the Settings tab, and find the Networking section. Verify that public access is disabled. Under Private Networking you will see the private domain of the service, for example postgres.railway.internal. The forwarder will use that domain.

Check MagicDNS and HTTPS certificates

Open the DNS page in the Tailscale admin console. Both MagicDNS and HTTPS Certificates must be enabled. Each section offers the opposite action, so a button that reads Disable MagicDNS... means MagicDNS is already on.

MagicDNS gives the forwarder a stable machine name, which the database connection needs. HTTPS certificates are not needed for the database connection, but they are needed to open a browser UI over the forwarder, and both settings live on this page.

Create a reusable auth key

Go to the Keys page in the settings menu and click Generate auth key. Add a description and turn on Reusable. Leave the other settings as they are. A reusable key lets the forwarder register itself again when it starts without existing state.

Click Generate key. Copy the key now, because the admin console shows it only once.

Deploy the Tailscale Forwarder

The Tailscale Forwarder is a small TCP proxy. It joins your tailnet as a machine and forwards ports on that machine to services on the Railway private network. Railway publishes the template, and it runs the brody192/tailscale-forwarder image.

Open the Deploy to dropdown and select the project that holds your database. Both services must be in the same project, otherwise the forwarder won’t be able to reach the database over the private network, since it will be placed on a different private network.

Paste your auth key into TS_AUTHKEY. Then set CONNECTION_MAPPING_01 to the database mapping. The format is [https:]<source port>:<target host>:<target port>.

5432:${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:${{Postgres.PGPORT}}

This forwards port 5432 on the forwarder to your database.

Deploy and check the logs

Click Deploy. The template attaches a volume and sets TS_EPHEMERAL=false, so the machine keeps the same identity across redeploys instead of registering a duplicate.

Open the Deployments tab and read the deploy logs. Three lines tell you the forwarder started correctly:

• tsnet starting with hostname "..." gives the machine name on your tailnet. You need it in a later step.
• Starting tailscale_fwdr lists what it parsed, including ts-ephemeral: false and the source port, target address and target port of each mapping.
• listening for connections confirms the forwarder accepts traffic on that source port.

Copy the forwarder domain

TS_HOSTNAME defaults to your project name, environment name and service name joined by dashes, for example my-project-production-tailscale-forwarder. The deploy log prints it on the tsnet starting with hostname line.

Open the Machines page in the Tailscale admin console. The forwarder appears there on its own once it starts with a valid auth key.

Click the machine to open its page. Under Machine Details, copy the Full domain value. That is the host you connect to from your machine.

Set the connection string

Open the PostgreSQL service in Railway, go to the Variables tab, and copy DATABASE_URL.

Replace the ***.railway.internal host with the Tailscale forwarder’s domain and keep the rest of the string. railway.internal cannot be resolved on a machine outside Railway, so you need to connect through the Tailscale forwarder. Put the result in a .env file.

DATABASE_URL=postgresql://postgres:password@<full-domain>:5432/railway

Set up the Drizzle config file

Create a drizzle.config.ts file in the root of your project:

import { defineConfig } from "drizzle-kit";

export default defineConfig({
  schema: "./src/schema.ts",
  out: "./migrations",
  dialect: "postgresql",
  dbCredentials: {
    url: process.env.DATABASE_URL!,
  },
});

Apply your schema

Generate migrations and apply them:

npx drizzle-kit generate

npx drizzle-kit migrate

For rapid prototyping you can push the schema directly with drizzle-kit push. For production deployments, prefer the generate and migrate workflow, so you keep a versioned history of schema changes. See the Drizzle migrations fundamentals page for details.

Check the result

Open the database in Drizzle Studio:

npx drizzle-kit studio

It runs on your machine and reads the same DATABASE_URL, so it reaches the database through the forwarder. Your new tables are there.