Running your own Mastodon instance, verified end to end
Running your own corner of the fediverse means running Mastodon itself — the actual upstream project, not a simplified clone that approximates it. The real Mastodon has real deployment requirements most “one-click Mastodon” offerings quietly simplify away. This one doesn’t.
What actually gets built
The template builds directly from github.com/mastodon/mastodon.git’s own main branch, using Mastodon’s own Dockerfile — not a Railyard-maintained reimplementation that has to be kept in sync by hand every time upstream changes something. Postgres and Redis are provisioned as addons and wired in automatically, matching what Mastodon’s own setup documentation expects.
Verified, not assumed — this template is marked verified against a real deploy, not just written up from Mastodon’s README and hoped to work.
The secrets Mastodon actually needs, generated correctly
This is where a from-scratch Mastodon deploy usually goes wrong, and where getting it right matters more than almost anywhere else in the template catalog: Mastodon depends on Active Record Encryption for data at rest, which needs three separate, correctly-generated keys — ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY, _DETERMINISTIC_KEY, and _KEY_DERIVATION_SALT — alongside its own SECRET_KEY_BASE and OTP_SECRET for two-factor auth. Get any of these wrong, mismatched, or missing, and encrypted columns become unreadable — not a visible error at boot, a landmine that goes off later. The template generates all five correctly the first time, not as an afterthought bolted onto a generic “add some env vars” setup flow.
What you still own
LOCAL_DOMAIN is set to the app’s own hostname automatically, and RAILS_SERVE_STATIC_FILES is on so Mastodon serves its own assets without a separate CDN layer required to get started. Federation, moderation settings, and the actual day-to-day of running an instance — who can sign up, what gets federated with, how moderation works — are Mastodon’s own concerns once it’s running, not something a deploy template should be making decisions about on your behalf.
Why “verified” is the point, not a badge
A Rails app with this many moving parts (Postgres, Redis, a Dockerfile build, five interdependent secrets) has a lot of surface area for “works on the happy path, breaks on the first real account.” The difference between a template that’s been actually launched and checked versus one that’s just a plausible-looking config is exactly the kind of thing that only shows up once someone tries to create their first encrypted column.
Browse the full catalog: Templates.