diff --git a/group_vars/all/secrets.yml.contents b/group_vars/all/secrets.yml.contents
index 7188ffa..6aab9ff 100644
--- a/group_vars/all/secrets.yml.contents
+++ b/group_vars/all/secrets.yml.contents
@@ -50,5 +50,8 @@ mastodon_secrets:
   vapid_private_key: xxx
   vapid_public_key: xxx
 
+rallly_secrets:
+  secret_password: xxx
+
 membersystem_secrets:
   secret_key: xxx
diff --git a/roles/docker/files/configs/rallly/env_file b/roles/docker/files/configs/rallly/env_file
new file mode 100644
index 0000000..a3ec36a
--- /dev/null
+++ b/roles/docker/files/configs/rallly/env_file
@@ -0,0 +1,9 @@
+NEXT_PUBLIC_BASE_URL="https://:{{ rallly.domain }}"
+DATABASE_URL="postgres://postgres:{{ postgres_passwords.rallly }}@postgres:5432/rallly_db"
+SECRET_PASSWORD="{{ rallly_secrets.secret_password }}"
+SUPPORT_EMAIL="noreply@{{ rallly.domain }}"
+SMTP_HOST="{{ smtp_host }}"
+SMTP_PORT="{{ smtp_port }}"
+SMTP_SECURE="false"
+SMTP_USER=
+SMTP_PWD=
diff --git a/roles/docker/tasks/services/rallly.yml b/roles/docker/tasks/services/rallly.yml
index ab554e5..a671f5b 100644
--- a/roles/docker/tasks/services/rallly.yml
+++ b/roles/docker/tasks/services/rallly.yml
@@ -1,9 +1,14 @@
-- name: create rallly volume folders
+- name: Create rallly volume folders
   file:
     name: "{{ rallly.volume_folder }}/postgres"
     state: directory
 
-- name: set up rallly
+- name: Copy Rallly environment file
+  template:
+    src: files/configs/rallly/env_file
+    dest: "{{ rallly.volume_folder }}/env_file"
+
+- name: Set up rallly
   docker_compose:
     project_name: "rallly"
     pull: "yes"
@@ -35,13 +40,14 @@
           networks:
             rallly_internal:
             external_services:
+            postfix:
           ports:
             - "3000:3000"
-          environment:
-            DATABASE_URL: "postgres://postgres:{{ postgres_passwords.rallly }}@postgres:5432/rallly_db"
           depends_on:
             rallly_db:
               condition: "service_healthy"
+          env_file:
+            - "{{ rallly.volume_folder }}/env_file"
           labels:
             com.centurylinklabs.watchtower.enable: "true"
 
@@ -50,3 +56,5 @@
           internal: true
         external_services:
           external: true
+        postfix:
+          external: true