Deploy on Dokploy

Reloop is available as a Dokploy template. It runs the same stack as the VPS installer, with Dokploy generating every secret and Traefik handling HTTPS.

Before you start

Requirement	Value
Dokploy	A recent release, with the default Traefik proxy
Architecture	x86_64 (the dashboard and links images are amd64 only)
RAM	8 GB for Reloop and Dokploy together
Disk	50 GB. The container images alone take about 22 GB
Ports	`25`, `465` and `587` free on the server, inbound and outbound
DNS	Three hostnames pointing at the server, see DNS

Many providers block port 25 by default. Reloop delivers to recipient mail servers on outbound 25, and receives mail on inbound 25, so ask your provider to open it.

Deploy

In Dokploy, open your project and choose Create Service → Template.
Search for Reloop and create it.
Before the first deploy, open Domains and replace the generated host of both domains, keeping HTTPS on:

Service Host
proxy reloop.example.com
links link.reloop.example.com
Open Environment and set the same hosts in BASE_URL, HOST_DOMAIN, SMTP_HOSTNAME, TRACKING_DOMAIN and TRACKING_BASE_URL. The URL variables start with https://, the others are the bare hostname.
Click Deploy. The first deploy downloads about 5 GB of images, which unpack to about 22 GB.

Service	Host
`proxy`	`reloop.example.com`
`links`	`link.reloop.example.com`

Dokploy generates the database password, the Redis password and every Reloop secret, and stores them under Environment. Change none of the generated values after the first deploy: the database password is fixed once Postgres initialises, changing the tracking or preferences secrets breaks links in mail that was already sent, and changing the webhook key breaks the signature on every existing webhook.

DNS

reloop.example.com            A    203.0.113.10
link.reloop.example.com       A    203.0.113.10
inbound.reloop.example.com    A    203.0.113.10
reloop.example.com            TXT  "v=spf1 ip4:203.0.113.10 -all"

The apex record serves the dashboard and the API.
link. serves click and open tracking and the unsubscribe pages.
inbound. is the MX target for mail your verified domains receive. The template always uses inbound. plus HOST_DOMAIN.
The SPF record authorises the server to send for the host domain, which is what the include: in each sending domain's SPF resolves to.

Also ask your provider for a PTR record on the server IP that resolves to reloop.example.com. Receiving servers check it.

In Dokploy, open Environment and copy the value of ADMIN_SETUP_KEY.
Open https://reloop.example.com/dashboard/setup and paste it as the setup key.
Choose the first administrator's name, email and password.
Name the first organization. Leave the instance name empty: on Dokploy it has no effect, so set APP_NAME under Environment instead.

The key works once. If you think it leaked before setup, change ADMIN_SETUP_KEY and redeploy: the old key stops working.

Setup signs you in with a session that lasts 7 days. To sign in again after that, Reloop emails you a code, so configure system email before it runs out.

System email

Sign-in codes and invitations need a way out. Set these under Environment, then redeploy:

Variable	Value
`RELOOP_SENDER_DOMAIN`	The domain system mail is sent from. Always required
`SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_SECURE`	Any SMTP provider you already use (Postmark, SES, your own). `SMTP_SECURE=true` means implicit TLS, normally with port `465`
`RELOOP_API_KEY`	Instead of SMTP: an API key of the organization that owns `RELOOP_SENDER_DOMAIN`, once that domain is verified in this instance

Configuration

Everything below is optional and listed under Environment with its default.

Variable	Default	Purpose
`DISABLE_SIGNUP`	`true`	Blocks public registration. Invited addresses can still join. If setup leaves public sign-ups off, it also saves that in `/run/reloop/.env` on the `auth` service's volume, which keeps registration closed even when this is `false`. To open it later, set this to `false`, remove the `DISABLE_SIGNUP` line from that file in the `auth` container, and redeploy
`DISABLE_ORG_CREATION`	`false`	Stops users creating further organizations
`APP_NAME`	`Reloop`	Instance name in system email, shown as `Self-hosted Reloop × <name>`
`S3_ENDPOINT`, `S3_ACCESS_KEY`, `S3_SECRET_KEY`	empty	S3-compatible storage for template images and attachments. The bucket must serve objects publicly, because Reloop hands out URLs as `{S3_ENDPOINT}/{S3_BUCKET}/{path}`
`S3_BUCKET`	`reloop-uploads`	Bucket name
`S3_REGION`	`us-east-1`	Bucket region
`RELOOP_VERSION`	`latest`	Image tag for every Reloop service

The queue dashboard at https://reloop.example.com/api/workflow/jobs uses WORKBENCH_USER and WORKBENCH_PASS for basic auth.

Custom tracking domains

A sending domain with click or open tracking gets a link. CNAME pointing at link.reloop.example.com, so tracked links in its mail use the customer's own hostname. Traefik only issues certificates for domains it knows about, so add each tracking hostname as another domain on the links service, port 3005, with HTTPS on. Keep TRACKING_DOMAIN set to link.reloop.example.com: Reloop uses it as the CNAME target for every new sending domain.

Mail ports and TLS

Port	Service	Protocol
`25`	`inbound`	SMTP with STARTTLS, for mail your verified domains receive
`587`	`smtp`	Submission with STARTTLS
`465`	`smtp`	The same STARTTLS listener as `587`, not implicit TLS

The template publishes these ports on the host directly, outside Traefik, so the deploy fails if another mail server already binds them. Both mail services use a self-signed certificate. Submit on 587 with STARTTLS, and tell clients that verify certificates to accept it.

Updates and backups

Dokploy only pulls new images on redeploy when pulling images is enabled in the service's settings. With it on, each redeploy fetches the tag in RELOOP_VERSION and reruns the migrate service, which pushes the database schema before the Reloop backend services start. Take a backup of the postgres-data volume first.

Each update leaves the previous images behind, about 4 GB per update. Run docker image prune on the server after updating.