Setup Retool in your own VPC.

Retool can be setup on premise in around 15 minutes. You should use either Docker, Kubernetes, or Heroku. If you're not sure what to use, use Docker.

First steps

  1. Spin up a new EC2 instance of Ubuntu 16.04, of at least t2.medium
  2. Open up port 443 and 80 in the network security group, so you can connect to your VPS
  3. Whitelist your VPS's IP address in your database, so you can connect to it
  4. SSH in
  5. git clone
  6. cd retool-onpremise
  7. Follow the instructions below for Docker or Kubernetes

A license key is required for on-premise deployments.

You'll need a license key before you can start creating pages in Retool. Contact us if you'd like to move to on-premise, and we'll get a license key for you.


  1. Run ./ to install Docker and Docker Compose
  2. Run sudo docker-compose up to start the Retool server
  3. Navigate to your server's IP address in a web browser to get started.


  1. Install git
sudo yum install git
  1. Clone the Retool repository
git clone
  1. Install Docker and Docker Compose
cd retool-onpremise
  1. Make docker-compose available to the root user
sudo ln -s /usr/local/bin/docker-compose  /usr/bin/docker-compose
  1. Enable and start the docker service:
sudo systemctl enable docker.service
sudo systemctl start docker.service
  1. Start Retool up!
sudo docker-compose up -d

Ubuntu / CentOS shared

Obtaining a LetsEncrypt SSL Certificate when using Docker

  1. First set up a DNS so that points to the Retool server
  2. Then edit the docker.env file and change the following line:
# Before
DOMAINS=XX.XXX.XXX.XXX -> http://api:3000

# After -> http://api:3000
  1. Edit the docker-compose.yml file and make the following changes:
# Before
      STAGE: 'local' # <- Change 'local' to 'production' to use a LetsEncrypt signed SSL cert
      - frontend-network

# After
      STAGE: 'production'
      - frontend-network

Using a Custom Certificate for SSL

  1. In docker-compose.yml, change image to nginx:latest & add two volumes.

Here's how it should look:

    image: nginx:latest
      - '80:80'
      - '443:443'
      - api
    restart: always
    env_file: ./docker.env
      STAGE: 'production' 
      - frontend-network
    command: [nginx-debug, '-g', 'daemon off;'] # better error logging in container
      - ./nginx:/etc/nginx/conf.d
      - ./certs:/etc/nginx/certs
  1. Now, create directories for these new volumes. Create /certs directory inside of the retool-onpremise directory and move your certificate and key files into that directory. Create an /nginx directory and create a file called certs.conf in that directory (it can be anything that ends with .conf).
  1. Inside of certs.conf add the following, with your subdomain, certificate, and key filenames substituted.
server {
    listen 80;

    location / {
        return 301 https://$host$request_uri;

server {
    listen 443 ssl;
    ssl_certificate     /etc/nginx/certs/YOUR_CERT_FILE_NAME.crt;
    ssl_certificate_key /etc/nginx/certs/YOUR_KEY_FILE_NAME.key;

    location / {
        proxy_pass http://api:3000;
  1. Run sudo docker-compose up -d


  1. Navigate into the kubernetes directory
  2. Copy the retool-secrets.template.yaml file to retool-secrets.yaml and inside the {{ ... }} sections, replace with a suitable base64 encoded string.
    1. If you do not wish to add google authentication, replace the templates with an empty string.
    2. You will need a license key in order to proceed.
  3. Run kubectl apply -f ./retool-secrets.yaml
  4. Run kubectl apply -f ./retool-postgres.yaml
  5. Run kubectl apply -f ./retool-container.yaml

For ease of use, this will create a postgres container with a persistent volume for the storage of Retool data. We recommend that you use a managed database service like RDS as a long-term solution. The application will be exposed on a public ip address on port 3000 - we leave it to the user to handle DNS and SSL.

Please note that by default Retool is configured to use Secure Cookies - that means that you will be unable to login unless https has been correctly setup.

To force Retool to send the auth cookies over HTTP, please set the COOKIE_INSECURE environment variable to 'true' in ./retool-container.yaml. Do this by adding the following two lines to the env section.

  value: 'true'

Then, to update the running deployment, run $ kubectl apply -f ./retool-container.yaml



To quickly get going, visit our Github repo and click "Deploy to Heroku"

You'll need at least 1GB of RAM for Retool to start successfully.

Updating a Heroku deployment

To update a Heroku deployment that was created with the button above, you may first set up a git repo to push to Heroku

$ heroku login
$ git clone
$ cd retool-onpremise
$ heroku git:remote -a YOUR_HEROKU_APP_NAME

To update Retool (this will automatically fetch the latest version of Retool)

$ git commit --allow-empty -m 'Redeploying'
$ git push heroku master

Manually setting up Retool on Heroku

You may alternatively use the following following steps to deploy to Heroku

  1. Install the Heroku CLI, and login. Documentation for this can be found here:
  2. Clone this repo git clone
  3. Change the working directory to the newly cloned repository cd ./retool-onpremise
  4. Create a new Heroku app with the stack set to container with heroku create your-app-name --stack=container
  5. Add a free database: heroku addons:create heroku-postgresql:hobby-dev
  6. In the Settings page of your Heroku app, add the following environment variables:

    • NODE_ENV - set to production
    • HEROKU_HOSTED set to true
    • JWT_SECRET - set to a long secure random string used to sign JSON Web Tokens
    • ENCRYPTION_KEY - a long secure random string used to encrypt database credentials
  7. Push the code: git push heroku master

To lockdown the version of Retool used, just edit the first line under ./heroku/Dockerfile to:

FROM tryretool/backend:X.XX.X

Updated 13 days ago


Setup Retool in your own VPC.

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.