pawful.dev

Reloop

Open-source email infrastructure you can self-host.

Reloop is an open-source, self-hostable alternative to SES, SendGrid, Resend, and Loops: a Send API, SMTP relay, inbound mail, campaigns, webhooks, and analytics. I work on the backend, with a focus on self-hosting, delivery, and security.

Reloop architecture: The parts of Reloop I work on sit between the operator's machine and the recipient's inbox: the installer and proxy in front, the relay and DNS verification underneath.

What it is

Reloop gives teams the pieces of a hosted email provider as something they can run themselves: a transactional Send API and SMTP relay, inbound email handling, campaigns and sequences, a template editor, delivery webhooks, analytics, and API key management. It ships as a TypeScript monorepo on Bun with Next.js and PostgreSQL, packaged for Docker and Kubernetes, and is also offered as a hosted service with the same API.

Where I work on it

My work sits at the boundary between the application and the machine it runs on. The recurring theme is making a self-hosted install behave like the hosted one.

Self-hosting

  • Wrote the installer for a fresh VPS and served it at /install.sh, so a new host goes from bare Linux to a running Reloop with one command.
  • Added support for running the self-host install behind an existing reverse proxy, for operators who already terminate TLS elsewhere.
  • Allowed a separate internal origin for session validation, so the app can validate sessions against an internal address while public traffic arrives through the proxy.

Delivery

  • Made the verification DNS resolvers configurable. Domain verification depends on the resolver you ask, and self-hosted operators need to choose theirs.
  • Moved system email onto production delivery instead of falling back to Mailpit, and made the system sender name configurable with APP_NAME.
  • Showed the configured SMTP hostname in the dashboard so operators can see exactly what clients should connect to.
  • Fixed the SMTP relay corrupting MIME boundaries that end in =.

Security and access

  • Kept one-time passwords and DKIM private keys out of logs.
  • Closed registration across every sign-up path when an operator turns it off, including the paths that were still open.

Tooling

Reloop also ships reloop-cli, a zero-dependency command line client that talks to a Cloud or self-hosted account, switches between table output in a terminal and JSON in scripts, and supports multiple profiles for different endpoints.

Why it is interesting work

Email is unforgiving infrastructure. DNS, TLS, DKIM, and SMTP all have to agree before a single message lands, and self-hosted operators run on hardware and networks you cannot predict. Most of the engineering is in the seams: the proxy in front, the resolver underneath, the log line that must not contain a secret.