an hour ago
Hello Railway Support,
I need the officially supported, least-privilege method to create a verified backup of a Production PostgreSQL service without modifying Production.
We tested railway ssh using a temporary Project Token restricted to the relevant project and environment, together with a temporary account SSH key. The Railway identity check succeeded, but the SSH connection did not complete and was cancelled after 45 seconds. No backup was created, no Production data was modified, and both temporary credentials have been revoked.
Please confirm the lowest-scope supported method for a read-only PostgreSQL export suitable for an encrypted backup and an isolated local restore verification. We do not want to use OAuth, broader account tokens, deploy changes, migrations, service changes, replicas, volumes, or plan changes.
If railway ssh requires a different credential or permission model, please specify the minimum exact scope and whether it can be restricted to one project, the Production environment, and the PostgreSQL service. If a safer native backup or export method exists, please provide the documented procedure.
Please do not request secrets in this public thread. If sanitized, non-secret diagnostics are required, please tell us the appropriate authorized private channel.
1 Replies
an hour ago
Project tokens only cover deployment-related actions such as railway up, railway redeploy and railway logs, and they don't work for SSH key management. That fits your attempt not completing with that token. SSH access needs either railway login or a workspace API token, plus an SSH key registered to your account or to the workspace. Workspace keys give SSH access to every service in the workspace. The SSH options don't offer a key or credential limited to one project, environment or service.
With that access in place, nothing in Production has to change. You can run a single non-interactive command in the Postgres service with railway ssh -p <project> -e production -s <postgres-service> -- <command>. When the input is piped, no PTY is allocated, so the output stays clean for scripts. You can also forward a local port into the container with ssh -N -L, which reaches only the container's loopback and your project's private network, and then run your export tool locally through that tunnel. For copying files out, scp and sftp work against ssh.railway.com with the same registered key. See railway ssh.
Native volume backups can only be restored into the same project and environment they came from. A restore also stages a volume swap on the service, so they don't fit an isolated local restore check. For a verified offline copy, use a logical export over SSH as described above.
Status changed to Awaiting User Response Railway • about 1 hour ago