Deploy and operate

Two processes

Build and start the website, then run the background worker as a separate persistent process:

cd web
npm run build
npm start
# In another terminal:
npm run worker:production

Both processes must share the same database and configuration. npm start alone does not execute queued Pods.

On Railway, create two services from the GitHub repository with Root Directory / (or leave it blank) and Node.js 24 or newer. The local checkout is named web, but package.json is at the GitHub repository root. Set the web service Build Command to npm run build and Start Command to npx next start --hostname 0.0.0.0 --port $PORT, then generate its public domain. Set the private worker service Start Command to npm run worker:production and do not give it a public domain. Add the same database and model variables to both services through Railway Variables. The worker's tsx loader is a production dependency. Optional browser-rendered research requires Chromium and Linux browser dependencies in the worker image; ordinary HTTP research can run without the browser.

Required production choices

Set APP_URL to the HTTPS origin and COOKIE_SECURE=true. INITIAL_ADMIN_EMAIL can grant admin access to an additional registered, verified work account. The previous admin/admin login is retired. Configure email with RESEND_API_KEY and RESEND_FROM; signup and recovery require Resend locally and in production. Set DATABASE_URL to the complete unprefixed postgresql:// URL with TLS options. If its TLS configuration names a CA certificate file, that path must exist inside both deployed services; a Windows path from local development will not work there. Use managed secrets, backups, monitoring and provider-side usage controls. Changing the database URL does not migrate existing SQLite data.

Operational limitations

An HTTP-only deployment cannot run background jobs. Document parsing should be isolated appropriately for your environment. Production behavior of external mail, gateways and PostgreSQL must be tested with those services. The application is not presented as security certified.