Relaticle 3.8.2

Launch from the AWS Marketplace page and choose the Relaticle 3.8.2 on Ubuntu 24.04 version. Alternatively, use the AWS CLI with the AMI ID shown on the listing's launch page:

aws ec2 run-instances --image-id ami-xxxxxxxxxxxxxxxxx --instance-type m5.large \
  --key-name my-key --security-group-ids sg-xxxxxxxx --subnet-id subnet-xxxxxxxx \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=relaticle}]'

First boot takes about a minute once the instance is up. It creates the PostgreSQL cluster and database, generates the keys, runs Relaticle's migrations, and creates the two administrators and the certificate. The web interface stays offline until first boot has finished.

ssh -i my-key.pem ubuntu@<public-ip>

systemctl is-active postgresql@16-main.service nginx.service php8.5-fpm.service relaticle-queue.service relaticle-egress-guard.service
sudo ss -ltnp | awk 'NR==1 || /:(22|80|443|5432) /'
sudo ss -lxp | grep -E 'relaticle-fpm|PGSQL'

active active active active active State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 511 0.0.0.0:443 0.0.0.0:* users:(("nginx",pid=240676,fd=7),("nginx",pid=240675,fd=7),("nginx",pid=232138,fd=7)) LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=817,fd=3),("systemd",pid=1,fd=210)) LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=240676,fd=5),("nginx",pid=240675,fd=5),("nginx",pid=232138,fd=5)) LISTEN 0 511 [::]:443 [::]:* users:(("nginx",pid=240676,fd=8),("nginx",pid=240675,fd=8),("nginx",pid=232138,fd=8)) LISTEN 0 4096 [::]:22 [::]:* users:(("sshd",pid=817,fd=4),("systemd",pid=1,fd=215)) LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=240676,fd=6),("nginx",pid=240675,fd=6),("nginx",pid=232138,fd=6)) u_str LISTEN 0 4096 /run/php/relaticle-fpm.sock 411544 * 0 users:(("php-fpm8.5",pid=236192,fd=10),("php-fpm8.5",pid=235968,fd=10),("php-fpm8.5",pid=235730,fd=10),("php-fpm8.5",pid=235295,fd=10),("php-fpm8.5",pid=232133,fd=8)) u_str LISTEN 0 200 /var/run/postgresql/.s.PGSQL.5432 406009 * 0 users:(("postgres",pid=223692,fd=6))

Only SSH, HTTP and HTTPS listen on the network. PostgreSQL (5432) listens only on its Unix socket, and so does PHP.

First boot writes everything you need to sign in to a file only root can read:

sudo cat /root/relaticle-credentials.txt

# Relaticle 3.8.2 - generated on first boot by relaticle-firstboot.service
# These credentials are unique to this instance; none was baked into the image. Keep this file secret. RELATICLE_URL=https://ec2-44-202-112-14.compute-1.amazonaws.com/app/login RELATICLE_ADMIN_EMAIL=admin@sac.local RELATICLE_ADMIN_PASSWORD=<24 random letters and digits> RELATICLE_SYSADMIN_URL=https://ec2-44-202-112-14.compute-1.amazonaws.com/sysadmin/login RELATICLE_SYSADMIN_EMAIL=sysadmin@sac.local RELATICLE_SYSADMIN_PASSWORD=<24 random letters and digits> RELATICLE_TLS_SHA256=<the certificate SHA-256 fingerprint> ...

• RELATICLE_URL is the CRM's sign-in page.
• RELATICLE_ADMIN_EMAIL / RELATICLE_ADMIN_PASSWORD sign in to the CRM as the administrator of My Workspace.
• RELATICLE_SYSADMIN_URL and RELATICLE_SYSADMIN_EMAIL / RELATICLE_SYSADMIN_PASSWORD sign in to the system administration panel, which manages every user and workspace on the server (Step 7).
• RELATICLE_TLS_SHA256 is the fingerprint of the instance's own certificate. Your browser will warn that the certificate is not trusted; compare the fingerprint it shows with this one before you continue. Replace it with a certificate from a certificate authority for your own name when you can (Step 13).

Run the end-to-end test that ships with the image. Over HTTPS on the instance, it checks that:

• port 80 redirects to HTTPS
• the front controller path, Horizon, the debug bar, the configuration file, the data and the sources are refused
• the health check answers
• the CRM refuses a request without a session
• both administrators sign in through Relaticle's own sign-in forms
• a wrong password and common default passwords are refused

sudo relaticle-cred-roundtrip

RELATICLE_ROUNDTRIP_OK https 301 + no index.php/Horizon/debugbar/env/data/sources + healthz + CRM closed without a session + CRM administrator sign-in (Relaticle's two-step form) + system-administrator sign-in + wrong and default passwords refused

Open RELATICLE_URL in your browser and check the certificate fingerprint. Sign-in takes two steps: enter RELATICLE_ADMIN_EMAIL and choose Continue, then enter RELATICLE_ADMIN_PASSWORD.

The first time you sign in, Relaticle opens a short workspace setup. It asks what you will use Relaticle for and offers to invite teammates. Invitations are sent by e-mail, so they need Step 10 first, and you can skip that part. After the setup you land on the workspace's Home page:

Relaticle keeps you signed in on that browser, because its sign-in always uses "remember me". To change a password, run one of the commands below on the instance. The first generates a new random password. The second reads your own password from the terminal, never from the command line (20 to 72 letters and digits, with upper case, lower case and a digit). Either way, every session of that account is signed out and the new password is written to /root/relaticle-credentials.txt. Add --sysadmin to change the system administrator's password instead:

sudo relaticle-set-password
sudo relaticle-set-password --sysadmin

# Type <new-password> at the prompt; nothing is echoed. read -rs -p 'New Relaticle password: ' P; echo printf '%s\n' "$P" | sudo relaticle-set-password --stdin; unset P

Change the administrator's name and e-mail address from the avatar at the top right. Once you have stored the passwords somewhere safe, you can delete the two _PASSWORD lines from /root/relaticle-credentials.txt.

Sign-up. Relaticle's sign-in page always offers to create an account for an address it does not know. On this image, a new account must verify its e-mail address before it can open the CRM. No mail leaves the instance until you configure SMTP, so a stranger who signs up gets an unverified account that cannot reach any data.

Once mail is configured, anyone who can reach the page could sign up and get an empty workspace of their own, never yours. Restrict port 443 to your users' networks (Step 14) and remove unwanted accounts in the system administration panel.

Companies, People and Opportunities are tables you can search, filter, sort and extend with your own columns. New company (or New person, New opportunity) adds a record, and Import / Export loads or saves CSV files. Tasks and Notes attach to any record. Settings in the workspace menu holds custom fields, members and the workspace's API access tokens.

The system administration panel at RELATICLE_SYSADMIN_URL lists every user and workspace on the server. Sign in with RELATICLE_SYSADMIN_EMAIL and RELATICLE_SYSADMIN_PASSWORD. At the first sign-in, Relaticle requires the system administrator to enrol an authenticator app (a TOTP code) before the panel opens.

The Ask anything box and Ask Rela are Relaticle's AI assistant. It needs an OpenAI or Anthropic API key and a Redis server, and neither is on the image. It does not answer until you add both.

Relaticle runs imports, notifications and other background work through a queue. On this image the queue worker is the relaticle-queue service. The scheduler is relaticle-schedule.timer, which runs Relaticle's scheduled housekeeping every minute. Both run as the unprivileged relaticle user:

systemctl show -p User -p ActiveState -p SubState relaticle-queue.service
sudo relaticle-artisan schedule:list
systemctl show -p UnitFileState relaticle-schedule.timer

User=relaticle ActiveState=active SubState=running 0 * * * * php artisan import:cleanup ....... Next Due: 1 minute from now 0 * * * * php artisan app:purge-pending-uploads Next Due: 1 minute from now 0 0 * * * php artisan queue:prune-batches --hours=24 Next Due: 9 hours from now 0 0 * * * php artisan invitations:cleanup ... Next Due: 9 hours from now 0 0 * * * php artisan activitylog:clean --force Next Due: 9 hours from now 0 0 * * * php artisan model:prune --model='App\Models\Notification' Next Due: 9 hours from now */5 * * * * php artisan chat:expire-pending-actions Next Due: 1 minute from now */10 * * * * php artisan chat:release-orphaned-reservations Next Due: 1 minute from now 0 * * * * php artisan chat:purge-unsent-attachments Next Due: 1 minute from now 0 * * * * php artisan chat:reset-credits ... Next Due: 1 minute from now 0 0 * * 0 php artisan disposable:update ...... Next Due: 6 days from now 0 * * * * php artisan tor:update-exit-nodes Next Due: 1 minute from now 0 2 * * * php artisan subscribers:reconcile --limit=500 Next Due: 11 hours from now 0 0 * * * php artisan app:purge-scheduled-deletions Next Due: 9 hours from now 0 * * * * php artisan notifications:send-task-digest Next Due: 1 minute from now 0 * * * * php artisan notifications:send-setup-nudge Next Due: 1 minute from now UnitFileState=enabled

The scheduler is switched on on a new instance. Two of its tasks fetch public lists that Relaticle uses to protect its sign-up form:

• disposable:update downloads a list of disposable e-mail domains once a week, from cdn.jsdelivr.net.
• tor:update-exit-nodes downloads the list of Tor exit nodes every hour, from check.torproject.org.

Neither task sends any data about your instance. The mailbox and calendar synchronisation tasks and the health checks are not scheduled, because those features are off.

relaticle-artisan runs Relaticle's own artisan commands as the relaticle user, with the same metadata block and egress backstop as the web tier:

sudo relaticle-artisan --version sudo relaticle-artisan about --only=environment

Laravel Framework 13.40.0 Environment ................................................................ Application Name ................................................. Relaticle Laravel Version .................................................... 13.40.0 PHP Version ......................................................... 8.5.12 Composer Version ......................................................... - Environment ..................................................... production Debug Mode ............................................................. OFF URL .............................. ec2-44-202-112-14.compute-1.amazonaws.com Maintenance Mode ....................................................... OFF Timezone ............................................................... UTC Locale .................................................................. en

Out of the box, Relaticle writes outgoing mail (invitations, password resets, e-mail verification and notification digests) to its log instead of sending it. To send through your mail server or a service such as Amazon SES, edit /etc/relaticle/env as root and set the mail values:

MAIL_MAILER=smtp MAIL_HOST=email-smtp.us-east-1.amazonaws.com MAIL_PORT=587 MAIL_SCHEME=smtp MAIL_USERNAME=<your SMTP user name> MAIL_PASSWORD=<your SMTP password> MAIL_FROM_ADDRESS=crm@example.com MAIL_FROM_NAME=Relaticle

Then clear Relaticle's cached configuration and restart PHP and the queue worker:

sudo relaticle-artisan config:clear
sudo systemctl restart php8.5-fpm relaticle-queue

The same file holds the other integrations, all empty or false on a new instance: OPENAI_API_KEY or ANTHROPIC_API_KEY for the AI assistant (which also needs Redis), GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET and MICROSOFT_CLIENT_ID/MICROSOFT_CLIENT_SECRET with RELATICLE_FEATURE_SOCIAL_AUTH=true for Google and Microsoft sign-in, and RELATICLE_FEATURE_EMAIL_INTEGRATION=true for the mailbox and calendar integration (which also needs those OAuth credentials). The file is readable by root and the relaticle group only. If a server you configure has a private address inside your VPC, allow it first (Step 12).

API and MCP. Each user can create personal access tokens for the REST API under Settings > Access tokens. The MCP server at /mcp refuses every request without a token; AI assistants obtain one through OAuth, and Relaticle publishes its OAuth metadata (/.well-known/oauth-authorization-server) and accepts OAuth client registrations (/oauth/register) from anyone, as the MCP specification expects. A registered client still gets no access until a signed-in user approves it.

Each workspace has its own members, records and custom fields. Select Invite teammates at the bottom of the navigation to add people. This needs mail (Step 10). Each invited person signs in with their own address and password.

A user who signs up on their own, once mail is configured and their address is verified, works in a workspace of their own. They never see yours until a member of your workspace invites them.

The egress backstop stops the relaticle user (the web application, the queue worker, the scheduler and relaticle-artisan) from connecting to any address in your VPC's own address ranges, which it reads from the instance metadata at every boot. Public addresses work as usual. You can see the ranges, and that the metadata service is refused to Relaticle while public sites are not:

sudo nft list set inet sac_relaticle_egress vpc4 | grep elements
sudo -u relaticle curl -s -m 5 -o /dev/null -w 'metadata: %{http_code}\n' http://169.254.169.254/latest/meta-data/ || true
sudo -u relaticle curl -s -m 5 -o /dev/null -w 'public HTTPS: %{http_code}\n' https://secureanycloud.com/ || true

elements = { 172.31.0.0/16 } metadata: 000 public HTTPS: 200

If Relaticle must reach a host inside the VPC (an SMTP relay or a VPC interface endpoint on a private address), add its address or CIDR, one per line, to /etc/sac/relaticle-egress-allow.conf and apply it. This restarts PHP and the queue worker with the new rules:

echo '172.31.10.25' | sudo tee -a /etc/sac/relaticle-egress-allow.conf >/dev/null
sudo systemctl restart relaticle-egress-guard
sudo nft list set inet sac_relaticle_egress allow4 | grep elements

elements = { 172.31.10.25 }

Only the addresses you list are opened; the metadata service, link-local, loopback, reserved and multicast ranges and IPv6 stay refused whatever the file says.

Point a DNS name at the instance (an Elastic IP is a good idea), then:

sudo relaticle-set-hostname <your-domain>

This creates a new self-signed certificate for the name, pins nginx to it (other names are dropped), sets Relaticle's APP_URL (used in links in its e-mails and in the OAuth metadata) and the cross-site guard, and updates the URLs and fingerprint in /root/relaticle-credentials.txt. To use a certificate from a certificate authority, replace /etc/nginx/ssl/relaticle.crt and relaticle.key (keep the key 0600 root) and run sudo systemctl reload nginx.

Limit who can reach the web interface in the instance's security group. For example, to allow HTTPS only from your office network:

aws ec2 authorize-security-group-ingress --group-id sg-xxxxxxxx --protocol tcp --port 443 --cidr <your-mgmt-cidr>
aws ec2 revoke-security-group-ingress --group-id sg-xxxxxxxx --protocol tcp --port 443 --cidr 0.0.0.0/0

Relaticle throttles sign-in from a client address after five failed attempts, for the CRM and the system administration panel alike. It locks an e-mail address after ten failed attempts in fifteen minutes. Separately, nginx rate limits requests for the sign-in and password-reset pages per client address.

U=$(sudo sed -n 's/^RELATICLE_URL=//p' /root/relaticle-credentials.txt); U=${U%/app/login} C=/etc/nginx/ssl/relaticle.crt for p in app/login sysadmin/login healthz up; do curl -s --cacert "$C" -o /dev/null -w "GET /$p: %{http_code}\n" "${U}/$p" done for p in index.php index.php/app/login .env horizon telescope _debugbar/open storage/logs/laravel.log composer.json; do curl -s --cacert "$C" -o /dev/null -w "GET /$p: %{http_code}\n" "${U}/$p" done curl -s --cacert "$C" -o /dev/null -w 'GET /impersonate/1 from another site: %{http_code}\n' -H 'Sec-Fetch-Site: cross-site' "${U}/impersonate/1" curl -s -o /dev/null -w 'GET http://: %{http_code}\n' "${U/https:/http:}/app/login" curl -sk -o /dev/null -w 'GET with an unknown Host: %{http_code}\n' -H 'Host: not-this-server.example' https://127.0.0.1/ || true for i in $(seq 1 12); do curl -s --cacert "$C" -o /dev/null -w '%{http_code} ' "${U}/app/login"; done; echo systemctl show -p IPAddressDeny nginx.service php8.5-fpm.service postgresql@16-main.service relaticle-queue.service
sudo -u postgres psql -At -c "SHOW listen_addresses" -c "SHOW ssl" curl -s http://127.0.0.1/healthz; echo

GET /app/login: 200 GET /sysadmin/login: 200 GET /healthz: 200 GET /up: 200 GET /index.php: 404 GET /index.php/app/login: 404 GET /.env: 404 GET /horizon: 404 GET /telescope: 404 GET /_debugbar/open: 404 GET /storage/logs/laravel.log: 404 GET /composer.json: 404 GET /impersonate/1 from another site: 403 GET http://: 301 GET with an unknown Host: 000 200 200 200 200 200 200 200 200 200 429 429 429 IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 off ok

• The front controller path (/index.php/...), the configuration file, Horizon, Telescope, logs, the debug bar and the source files are refused. Relaticle's code, configuration and data live outside the web root. A link from another site cannot start an impersonation or an OAuth redirect (403). Requests for any name other than the configured one are dropped (000: nginx closes the connection).
• The twelve quick requests for the sign-in page show nginx's per-address limit (429).
• IPAddressDeny is the metadata-service block on nginx, PHP, PostgreSQL and the queue worker; the scheduler and the first-boot service have the same one.
• PostgreSQL's listen_addresses is empty (no network listener at all) and it needs no TLS.
• http://127.0.0.1/healthz returns ok for a monitoring agent on the instance.

Your data is the PostgreSQL database plus the uploaded files in /var/lib/relaticle/storage/app and /var/lib/relaticle-public. Back up /etc/relaticle/env too. Its APP_KEY decrypts the values Relaticle stores encrypted, and a backup restored without it cannot read them.

Copy the backups to files only root can read, and keep copies off the instance, for example in an encrypted S3 bucket:

sudo sh -c 'umask 077; sudo -u postgres pg_dump --format=custom relaticle > /var/backups/relaticle-db-$(date +%F).dump'
sudo sh -c 'umask 077; tar -C /var/lib -czf /var/backups/relaticle-files-$(date +%F).tar.gz relaticle/storage/app relaticle-public'
sudo sh -c 'umask 077; cp /etc/relaticle/env /var/backups/relaticle-env-$(date +%F)'
sudo ls /var/backups/ | grep relaticle

relaticle-db-2026-11-08.dump relaticle-env-2026-11-08 relaticle-files-2026-11-08.tar.gz

To restore into a new instance of the same version, stop nginx, PHP-FPM, relaticle-queue and relaticle-schedule.timer, restore the dump into the relaticle database with sudo -u postgres pg_restore --clean --if-exists --no-owner --role=relaticle -d relaticle <dump>, unpack the files archive into /var/lib, put your APP_KEY line into /etc/relaticle/env, and start the services again.

EBS snapshots of the instance are a simple way to keep point-in-time copies of the whole server.

Ubuntu, PHP and PostgreSQL security updates install automatically through unattended upgrades. New Relaticle releases are published as new versions of this listing. To upgrade:

• Launch the new version and stop its services.
• Copy your database, your uploads and the APP_KEY line of /etc/relaticle/env across, keeping the new instance's own database password and APP_URL.
• Run sudo relaticle-artisan migrate --force and start the services again.

ls /usr/share/doc/relaticle/ sed -n '1,8p' /usr/share/doc/relaticle/SOURCE.txt

INTEGRATION-EXCEPTION.md LICENSE SOURCE.txt frontend-packages.txt Relaticle 3.8.2 on Ubuntu 24.04 by sac - source and changes Upstream: the Relaticle 3.8.2 tag archive, https://github.com/Relaticle/relaticle/archive/refs/tags/v3.8.2.tar.gz (sha256 0a09918b650a30ca8c63c81e91a8c328082b4ef984c5841c114f9bf04ee90ce1; GitHub tag v3.8.2, commit ec974bf30a54f0c20935b134e845f1046e1b22be). Licence: GNU Affero General Public License v3 (LICENSE, shipped here and in /var/www/relaticle), with upstream's additional permission in INTEGRATION-EXCEPTION.md. No Relaticle source file is modified. CORRESPONDING SOURCE (AGPL section 13): the unmodified source is the tag above, https://github.com/Relaticle/relaticle/tree/v3.8.2; the build steps below reproduce this tree from it.

Relaticle is licensed under the GNU Affero General Public License v3 by its authors, with an additional integration permission (INTEGRATION-EXCEPTION.md). The AGPL asks that users who interact with the software over a network can get its source: the image runs Relaticle unmodified, and its complete corresponding source is the public Relaticle v3.8.2 tag, which SOURCE.txt names together with the exact build steps. If you modify Relaticle on your instance, the AGPL requires you to offer your modified source to its users.

The upstream repository also contains packages/Cloud, a package under Relaticle's own commercial "Relaticle Cloud License" that runs relaticle.com's hosted service (billing and its marketing site). It is not open source and is not on this image; the open source core never loads it. The image contains no paid or proprietary extension. SOURCE.txt lists everything else that is not shipped (tests, development notes and scripts, sample configuration, agent and lint tooling, the Docker files, the front-end build inputs and Apache files).