rocketchat: add Rocket.Chat with a single-node Mongo replica set

Rocket.Chat tails the Mongo oplog for realtime delivery, and a standalone
mongod has no oplog — so the database has to be a replica set even with one
member.

Uses the official mongo image rather than bitnami/mongodb (which upstream's own
compose uses) because Bitnami moved its catalog behind a paid registry and the
free tags are no longer dependable for a long-lived install. The cost is that
rs.initiate() is not automatic, so the post-start hook runs it once — guarded by
rs.status() so a reinstall over restored data doesn't re-initiate a live set,
and followed by a wait for the member to report itself primary.

Mongo runs without auth: enabling it on a replica set also requires a shared
keyfile for member-to-member auth, which is a lot of moving parts for a database
that is never published outside the docker network.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

containers/rocketchat/docker-compose.yml

@@ -0,0 +1,93 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+    rocketchat-service: #LIBREPORTAL|SERVICE_TAG_1|rocketchat-service
+        container_name: rocketchat-service
+        image: rocketchat/rocket.chat:8.7.0 #LIBREPORTAL|ROCKETCHAT_VERSION_TAG|8.7.0
+        # The image runs as uid 65533 and writes uploads into /app/uploads, so
+        # it hits the same rootless bind-mount ownership problem as vikunja and
+        # mattermost. USER_TAG resolves to whoever actually owns the mounts.
+        user: "USER_DATA" #LIBREPORTAL|USER_TAG|USER_DATA
+        # Rocket.Chat exits — rather than waits — when Mongo has no elected
+        # primary, and on a fresh install the replica set is only initiated by
+        # the post-start hook. `unless-stopped` is what carries it through those
+        # first few seconds of crash-looping.
+        restart: unless-stopped
+        # GLUETUN_OFF_BEGIN
+        ports:
+            - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+        # GLUETUN_OFF_END
+        volumes:
+            - ./uploads:/app/uploads
+        environment:
+            - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+            - PORT=PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+            # ROOT_URL is what Rocket.Chat puts in invite links, OAuth redirect
+            # URLs and the websocket origin check. Get it wrong and the client
+            # loads but never connects.
+            - ROOT_URL=APP_URL_DATA #LIBREPORTAL|APP_URL_TAG|APP_URL_DATA
+            # ?replicaSet=rs0 is mandatory, not decorative: Rocket.Chat tails
+            # the Mongo oplog for realtime updates, and the oplog only exists on
+            # a replica set. Single-node is fine — it just has to be a set.
+            - MONGO_URL=mongodb://rocketchat-db:27017/rocketchat?replicaSet=rs0
+            - MONGO_OPLOG_URL=mongodb://rocketchat-db:27017/local?replicaSet=rs0
+            - DEPLOY_METHOD=docker
+            - OVERWRITE_SETTING_Show_Setup_Wizard=pending
+        depends_on:
+            - rocketchat-db
+        labels:
+            libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+            libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+            libreportal.backup.db: "mongo:rocketchat-db:mongo_data:"
+            libreportal.backup.files: "rocketchat-service:/app/uploads:uploads"
+            traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+            # TRAEFIK_PORT_1_BEGIN
+            traefik.http.routers.rocketchat-service.entrypoints: web,websecure
+            traefik.http.routers.rocketchat-service.rule: Host(`DOMAINSUBNAME_DATA_1`) #LIBREPORTAL|DOMAINSUBNAME_TAG_1|DOMAINSUBNAME_DATA_1
+            traefik.http.routers.rocketchat-service.tls: true
+            traefik.http.routers.rocketchat-service.tls.certresolver: production
+            traefik.http.services.rocketchat-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+            traefik.http.routers.rocketchat-service.middlewares: MIDDLEWARE_DATA_1 #LIBREPORTAL|MIDDLEWARE_TAG_1|MIDDLEWARE_DATA_1
+            # TRAEFIK_PORT_1_END
+            traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        healthcheck:
+            disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+        # GLUETUN_OFF_BEGIN
+        networks:
+            DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+                ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+        # GLUETUN_OFF_END
+        # GLUETUN_ON_BEGIN
+        # network_mode: "container:gluetun-service"
+        # GLUETUN_ON_END
+
+    # Official mongo image rather than bitnami/mongodb (which upstream's own
+    # compose uses): Bitnami moved its catalog behind a paid registry in 2025
+    # and the free tags are no longer dependable for a long-lived install. The
+    # cost is that the replica set is not auto-initiated, so
+    # rocketchat_install_post_start runs rs.initiate() once, by hand.
+    #
+    # No authentication: enabling it on a replica set additionally requires a
+    # shared keyfile for member-to-member auth, which is a lot of moving parts
+    # for a database that is never published outside the docker network. The
+    # backup driver's mongo path works either way — it adds credential flags
+    # only when MONGO_INITDB_ROOT_USERNAME is set.
+    #
+    # No `user:` override: the entrypoint starts as root, chowns /data/db and
+    # then drops to the mongodb user. Under rootless Docker container-root is
+    # the install user on the host, which owns the bind mount, so that works.
+    rocketchat-db:
+        image: mongo:8.0 #LIBREPORTAL|ROCKETCHAT_MONGO_VERSION_TAG|8.0
+        container_name: rocketchat-db
+        restart: unless-stopped
+        command: ["mongod", "--replSet", "rs0", "--bind_ip_all"]
+        volumes:
+            - ./mongo_data:/data/db
+            - ./mongo_config:/data/configdb
+        environment:
+            - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+        networks:
+            DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+                ipv4_address: IP_DATA_2 #LIBREPORTAL|IP_TAG_2|IP_DATA_2

containers/rocketchat/rocketchat.config

@@ -0,0 +1,70 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# UPDATE_TYPE = auto: new image builds are applied automatically (a recovery snapshot is taken first), manual: only when you press Update
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
+#
+CFG_ROCKETCHAT_APP_NAME=rocketchat
+CFG_ROCKETCHAT_BACKUP=true
+CFG_ROCKETCHAT_BACKUP_STRATEGY=auto
+# Manual, not auto. Rocket.Chat runs schema migrations on boot and refuses to
+# start if the image is more than one major behind the database — an unattended
+# jump across majors can leave the instance down until someone intervenes.
+CFG_ROCKETCHAT_UPDATE_TYPE=manual
+CFG_ROCKETCHAT_COMPOSE_FILE=default
+CFG_ROCKETCHAT_HEALTHCHECK=true
+# Rocket.Chat's own accounts back its mobile and desktop clients; forward-auth
+# in front of the web port would block those clients from the REST API.
+CFG_ROCKETCHAT_AUTHELIA=false
+CFG_ROCKETCHAT_HEADSCALE=false
+CFG_ROCKETCHAT_MONITORING=false
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_ROCKETCHAT_CATEGORY="communication"
+CFG_ROCKETCHAT_TITLE="Rocket.Chat"
+CFG_ROCKETCHAT_DESCRIPTION="Team Chat & Video"
+CFG_ROCKETCHAT_LONG_DESCRIPTION="Rocket.Chat is a mature self-hosted chat platform with channels, threads, voice and video, and native mobile and desktop clients. It integrates directly with a Jitsi Meet server for calls, so it pairs with the Jitsi Meet app already in this catalog. Note the free Community edition caps the number of active users — check the current limit before rolling it out to a large group"
+CFG_ROCKETCHAT_URL="https://github.com/RocketChat/Rocket.Chat"
+CFG_ROCKETCHAT_ACTIONS="configure|install|restart|shutdown|uninstall"
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
+#
+CFG_ROCKETCHAT_DOMAIN=1
+CFG_ROCKETCHAT_WHITELIST=false
+CFG_ROCKETCHAT_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_ROCKETCHAT_PORT_1="rocketchat-service|webui|random:3000|public|tcp|false|true|true|Web Interface||rocketchat"

containers/rocketchat/rocketchat.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" width="256" height="256" role="img" aria-label="Rocket.Chat"><path fill="#f5455c" d="M128 40c-46 0-84 25.2-95.9 59.1-6.6-6.4-16.6-13.4-30.2-17.2-1.4-.4-2.6 1.1-1.9 2.4 5.1 9.1 13.4 26.5 12.6 43.7.8 17.2-7.5 34.6-12.6 43.7-.7 1.3.5 2.8 1.9 2.4 13.6-3.8 23.6-10.8 30.2-17.2C44 190.8 82 216 128 216c70.7 0 128-39.4 128-88s-57.3-88-128-88" /><circle fill="#fff" cx="84" cy="128" r="13" /><circle fill="#fff" cx="130" cy="128" r="13" /><circle fill="#fff" cx="176" cy="128" r="13" /></svg>

containers/rocketchat/scripts/rocketchat_install_hooks.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+
+# Rocket.Chat install hooks.
+#
+# Rocket.Chat needs its Mongo to be a replica set, because realtime message
+# delivery works by tailing the oplog and a standalone mongod has no oplog. The
+# official mongo image does not initiate a set on its own, so we do it once here
+# after the containers come up.
+
+rocketchat_install_post_start()
+{
+    local app_name="$1"
+
+    ((menu_number++))
+    echo ""
+    echo "---- $menu_number. Initiating the MongoDB replica set for $app_name"
+    echo ""
+
+    # Wait for mongod to answer at all. It has to be listening before
+    # rs.initiate() can be sent, and on a cold volume the first boot spends a
+    # while building journal files.
+    local attempts=0
+    while ((attempts < 45)); do
+        if runFileOp docker exec rocketchat-db mongosh --quiet --eval "db.adminCommand({ping:1}).ok" 2>/dev/null | grep -q 1; then
+            break
+        fi
+        sleep 2
+        ((attempts++))
+    done
+
+    if ((attempts >= 45)); then
+        isError "rocketchat-db never started accepting connections — replica set not initiated."
+        isNotice "Rocket.Chat will keep restarting until it is. Once the database is up, run:"
+        isNotice "  docker exec rocketchat-db mongosh --eval 'rs.initiate({_id:\"rs0\",members:[{_id:0,host:\"rocketchat-db:27017\"}]})'"
+        return 0
+    fi
+
+    # Idempotent: a reinstall over restored data, or a rerun of this hook, finds
+    # the set already configured and must not re-initiate it — rs.initiate() on
+    # a live set errors out and would leave the step looking failed.
+    if runFileOp docker exec rocketchat-db mongosh --quiet --eval "rs.status().ok" 2>/dev/null | grep -q 1; then
+        isSuccessful "MongoDB replica set rs0 already initiated — leaving it alone."
+    else
+        local result
+        result=$(runFileOp docker exec rocketchat-db mongosh --quiet --eval \
+            'rs.initiate({_id:"rs0",members:[{_id:0,host:"rocketchat-db:27017"}]})' 2>&1)
+        checkSuccess "Initiating MongoDB replica set rs0"
+    fi
+
+    # Election of the single member takes a moment. Rocket.Chat exits rather
+    # than retries if it connects before a primary exists, so wait for the node
+    # to report itself primary before handing control back.
+    attempts=0
+    while ((attempts < 30)); do
+        if runFileOp docker exec rocketchat-db mongosh --quiet --eval "db.hello().isWritablePrimary" 2>/dev/null | grep -q true; then
+            break
+        fi
+        sleep 2
+        ((attempts++))
+    done
+
+    # Restart so Rocket.Chat reconnects immediately instead of waiting out its
+    # own backoff after the crash-loop it was in while the set was forming.
+    dockerComposeRestart "$app_name"
+}
+
+rocketchat_install_post()
+{
+    local app_name="$1"
+    echo ""
+    isNotice "Rocket.Chat first run:"
+    echo ""
+    echo "      Open the web interface and complete the setup wizard — the first"
+    echo "      account you create there becomes the workspace administrator."
+    echo ""
+    echo "      For voice and video, point Rocket.Chat at your Jitsi Meet server"
+    echo "      under Admin -> Settings -> Video Conference -> Jitsi."
+    echo ""
+}