Deploy on Coolify

Reloop ships a Coolify template at install/coolify/reloop.yaml. It runs the same stack as the VPS installer, with Coolify generating every secret and its proxy handling HTTPS.

Before you start

Requirement	Value
Coolify	v4, with the default Traefik proxy
Architecture	x86_64 (the dashboard and links images are amd64 only)
RAM	8 GB for Reloop and Coolify together
Disk	50 GB. The container images alone take about 22 GB
Ports	`25`, `465` and `587` free on the server, inbound and outbound
DNS	Three hostnames pointing at the server, see DNS

Many providers block port 25 by default. Reloop delivers to recipient mail servers on outbound 25, and receives mail on inbound 25, so ask your provider to open it.

Deploy

In Coolify, open your project and choose New Resource → Docker Compose (called Docker Compose Empty in older versions).
Paste the contents of reloop.yaml and save.
Before the first deploy, replace the generated domain of these two services:

Service Domain
proxy https://reloop.example.com
links https://link.reloop.example.com

Coolify warns that proxy requires port 80 and links requires port 3005. Choose Use this port anyway: traffic still goes to those ports, and Reloop's URLs stay without one. Keep required port discards the new domain. Leave every other service without a domain.
Click Deploy. The first deploy downloads about 5 GB of images, which unpack to about 22 GB. Coolify stops a deploy after 10 minutes, so on a slow connection the first one can fail before the stack starts. Click Deploy again: the images already downloaded are kept.

Service	Domain
`proxy`	`https://reloop.example.com`
`links`	`https://link.reloop.example.com`

Coolify creates the database, Redis and every Reloop secret for you and stores them under Environment Variables. Change none of the generated values after the first deploy: the database password is fixed once Postgres initialises, changing the tracking or preferences secrets breaks links in mail that was already sent, and changing the webhook key breaks the signature on every existing webhook.

Coolify passes all of these values to every container in the stack, including the public dashboard and links services. Keep RELOOP_VERSION on latest so those services get security fixes.

DNS

reloop.example.com            A    203.0.113.10
link.reloop.example.com       A    203.0.113.10
inbound.reloop.example.com    A    203.0.113.10
reloop.example.com            TXT  "v=spf1 ip4:203.0.113.10 -all"

The apex record serves the dashboard and the API.
link. serves click and open tracking and the unsubscribe pages.
inbound. is the MX target for mail your verified domains receive. The template always uses inbound. plus the proxy domain.
The SPF record authorises the server to send for the host domain, which is what the include: in each sending domain's SPF resolves to.

Also ask your provider for a PTR record on the server IP that resolves to reloop.example.com. Receiving servers check it.

In Coolify, open Environment Variables and copy the value of SERVICE_PASSWORD_64_SETUPKEY.
Open https://reloop.example.com/dashboard/setup and paste it as the setup key.
Choose the first administrator's name, email and password.
Name the first organization. Leave the instance name empty: on Coolify it has no effect, so set APP_NAME under Environment Variables instead.

The key works once. If you think it leaked before setup, change SERVICE_PASSWORD_64_SETUPKEY and restart: the old key stops working.

Setup signs you in with a session that lasts 7 days. To sign in again after that, Reloop emails you a code, so configure system email before it runs out.

System email

Sign-in codes and invitations need a way out. Set these under Environment Variables, then restart the service:

Variable	Value
`RELOOP_SENDER_DOMAIN`	The domain system mail is sent from. Always required
`SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_SECURE`	Any SMTP provider you already use (Postmark, SES, your own). `SMTP_SECURE=true` means implicit TLS, normally with port `465`
`RELOOP_API_KEY`	Instead of SMTP: an API key of the organization that owns `RELOOP_SENDER_DOMAIN`, once that domain is verified in this instance

Configuration

Everything below is optional. Coolify lists each variable under Environment Variables with its default.

Variable	Default	Purpose
`DISABLE_SIGNUP`	`true`	Blocks public registration. Invited addresses can still join. If setup leaves public sign-ups off, it also saves that in `/run/reloop/.env` on the `auth` service's volume, which keeps registration closed even when this is `false`. To open it later, set this to `false`, remove the `DISABLE_SIGNUP` line from that file in the `auth` container, and restart
`DISABLE_ORG_CREATION`	`false`	Stops users creating further organizations
`APP_NAME`	`Reloop`	Instance name in system email, shown as `Self-hosted Reloop × <name>`
`S3_ENDPOINT`, `S3_ACCESS_KEY`, `S3_SECRET_KEY`	empty	S3-compatible storage for template images and attachments. The bucket must serve objects publicly, because Reloop hands out URLs as `{S3_ENDPOINT}/{S3_BUCKET}/{path}`
`S3_BUCKET`	`reloop-uploads`	Bucket name
`S3_REGION`	`us-east-1`	Bucket region
`DNS_RESOLVERS`	`8.8.8.8,8.8.4.4`	Resolvers used to verify SPF, DKIM, DMARC and MX records
`DKIM_SELECTOR`	`reloop`	Selector for the DKIM keys Reloop generates
`RELOOP_VERSION`	`latest`	Image tag for every Reloop service

The queue dashboard at https://reloop.example.com/api/workflow/jobs uses SERVICE_USER_WORKBENCH and SERVICE_PASSWORD_WORKBENCH for basic auth.

Custom tracking domains

A sending domain with click or open tracking gets a link. CNAME pointing at link.reloop.example.com, so tracked links in its mail use the customer's own hostname. Coolify's proxy only issues certificates for domains it knows about, so add each tracking hostname to the links service after the existing one:

https://link.reloop.example.com,https://link.customer.com

Keep https://link.reloop.example.com first. Reloop uses the first domain in the list as the instance's tracking host and as the CNAME target for every new sending domain. Choose Use this port anyway again when Coolify asks, then save and restart. The VPS installer issues these certificates automatically; on Coolify this step is manual.

Mail ports and TLS

Port	Service	Protocol
`25`	`inbound`	SMTP with STARTTLS, for mail your verified domains receive
`587`	`smtp`	Submission with STARTTLS
`465`	`smtp`	The same STARTTLS listener as `587`, not implicit TLS

Both mail services use a self-signed certificate. Submit on 587 with STARTTLS, and tell clients that verify certificates to accept it.

Updates and backups

Pulling the latest images and restarting reruns the migrate service, which pushes the database schema before the Reloop backend services start. Take a backup first: open the postgres service, go to Backups and schedule one, or run a backup on demand before each update.

Updating only changes the images. Coolify keeps the service list and the proxy Caddyfile from your first install. When a Reloop release changes reloop.yaml, paste the new file under Edit Compose File, then replace the Caddyfile under Persistent Storage on the proxy service with the one from the new template, and restart.

Each update leaves the previous images behind, about 4 GB per update. Turn on Coolify's Docker cleanup for the server, or run docker image prune after updating.

Things to avoid

Connecting the stack to Coolify's predefined network. It puts the internal SMTP injection API, NATS and Rspamd on a network every other Coolify resource shares.
arm64 servers. The dashboard and links images are built for amd64 only.
Routing the mail ports through Coolify's proxy. SMTP authentication needs the TLS session to reach the smtp container directly.

Campaign sends, automation email steps, inbox replies and system mail through RELOOP_API_KEY call https://reloop.example.com from inside the stack, so the server must reach its own public address over HTTPS. They fail until Coolify has issued the certificate. To check, open a terminal on the auth container and run wget -qO- https://reloop.example.com/api/auth/v1/get-session: any response other than a connection or TLS error means it works.