TS Pro Relay

TS Pro Relay is a small self-hosted outbound email relay for Trusted Servants Pro deployments that live on hosts which block outbound SMTP ports (DigitalOcean droplets and similar). The portal POSTs messages as JSON over HTTPS to the relay, which then delivers them by SMTP from a location with unrestricted egress — keeping mail credentials isolated from the application.

Features

Web admin interface with login, for configuration and monitoring
Transaction log of every send attempt — status, sender, recipients, subject and errors, with counters
Settings for the upstream SMTP server, API-key management, a sender allowlist, and attachment-size limits
Bearer-token API (POST /api/send) for programmatic delivery, plus a test email button
Encrypted at rest — SMTP credentials and API keys encrypted with RELAY_SECRET_KEY
Optional Cloudflare Turnstile bot protection on login, and an unauthenticated /healthz probe

Requirements

Docker (or Docker Compose), network access to an upstream SMTP server, and a TLS reverse proxy for production.

Install with Docker Compose

Create docker-compose.yml:

services:
  relay:
    image: hyprlab/tspro-relay:latest
    ports:
      - "0.0.0.0:8026:8000"
    environment:
      - RELAY_SECRET_KEY=${RELAY_SECRET_KEY:?set RELAY_SECRET_KEY in .env}
      - RELAY_ADMIN_USER=${RELAY_ADMIN_USER:-admin}
      - RELAY_ADMIN_PASSWORD=${RELAY_ADMIN_PASSWORD:-admin}
    volumes:
      - ./data:/data
    restart: unless-stopped

Generate a secret key into .env, then start it and open http://<host>:8026:

python -c "import secrets; print(secrets.token_urlsafe(48))"   # -> RELAY_SECRET_KEY in .env
docker compose up -d

To build from source, swap image: for build: . and run docker compose up -d --build.

Configuration

Variable	Required	Default	Purpose
`RELAY_SECRET_KEY`	Yes	—	Signs sessions and encrypts the stored SMTP password + API key
`RELAY_ADMIN_USER`	No	`admin`	Initial admin username (first boot only)
`RELAY_ADMIN_PASSWORD`	No	`admin`	Initial admin password (change via the UI)
`RELAY_LOG_LEVEL`	No	`INFO`	`DEBUG` / `INFO` / `WARNING` / `ERROR`

The upstream SMTP host, credentials, API key, sender allowlist and attachment limit are all managed from the Settings page rather than env vars.

Connect it to Trusted Servants Pro

Run the relay behind TLS (e.g. Caddy: relay.example.com { reverse_proxy 127.0.0.1:8026 }), then in the TSP portal go to Settings → Domain / Email, set the sending method to API relay (HTTPS), enter the relay URL and API key, and click Send Test — the result appears in the relay's Transaction Log.

License

Free and open source under the GNU AGPL-3.0. Companion to Trusted Servants Pro · Source on GitHub.