mattermost: add Team Edition as a low-friction chat app
One container against Postgres, with the polished desktop and mobile clients that make it the least demanding of the four chat options. Runs as the bind-mount owner via USER_TAG: the image bakes in USER mattermost (uid 2000) so it never runs as root and cannot chown its own data directory, which under rootless Docker means it dies on first write. CFG_MATTERMOST_AUTHELIA stays false — OIDC/SAML is a paid tier here, so forward-auth would block the native clients from the API without buying single sign-on in exchange. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
librelad
parent
b9e334dc49
commit
c0025d8211
92
containers/mattermost/docker-compose.yml
Normal file
92
containers/mattermost/docker-compose.yml
Normal file
@ -0,0 +1,92 @@
|
||||
networks:
|
||||
DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
|
||||
external: true
|
||||
|
||||
services:
|
||||
# Mattermost Team Edition — one app container against Postgres. The server
|
||||
# and the web client are the same binary, so unlike the Matrix stack there
|
||||
# is no separate frontend service to route.
|
||||
mattermost-service: #LIBREPORTAL|SERVICE_TAG_1|mattermost-service
|
||||
container_name: mattermost-service
|
||||
image: mattermost/mattermost-team-edition:11.9 #LIBREPORTAL|MATTERMOST_VERSION_TAG|11.9
|
||||
# The image bakes in `USER mattermost` (uid 2000), so it never runs as
|
||||
# root and cannot chown its own bind mounts on first boot. Same problem
|
||||
# vikunja has: under rootless Docker uid 2000 maps to a host sub-UID
|
||||
# that owns nothing, and the container dies on its first write to
|
||||
# /mattermost/data. USER_TAG resolves to the identity that actually owns
|
||||
# the mounts — 0:0 under rootless, the real uid:gid under rooted.
|
||||
user: "USER_DATA" #LIBREPORTAL|USER_TAG|USER_DATA
|
||||
restart: unless-stopped
|
||||
# GLUETUN_OFF_BEGIN
|
||||
ports:
|
||||
- "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
|
||||
# GLUETUN_OFF_END
|
||||
volumes:
|
||||
- ./config:/mattermost/config
|
||||
- ./data:/mattermost/data
|
||||
- ./logs:/mattermost/logs
|
||||
- ./plugins:/mattermost/plugins
|
||||
- ./client-plugins:/mattermost/client/plugins
|
||||
- ./bleve-indexes:/mattermost/bleve-indexes
|
||||
environment:
|
||||
- TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
|
||||
- MM_SQLSETTINGS_DRIVERNAME=postgres
|
||||
# Fixed role and database name, random password. The database is
|
||||
# only reachable on the internal docker network, and a generated
|
||||
# username buys nothing while making manual psql recovery painful.
|
||||
- MM_SQLSETTINGS_DATASOURCE=postgres://mattermost:PASSWORD_DATA_1@mattermost-postgres:5432/mattermost?sslmode=disable&connect_timeout=10 #LIBREPORTAL|PASSWORD_TAG_1|PASSWORD_DATA_1
|
||||
# Mattermost builds every absolute link (invites, password resets,
|
||||
# CORS and websocket origin checks) from this. Wrong value and the
|
||||
# web client connects but the websocket is rejected, which shows up
|
||||
# as a chat that loads and then never receives a message.
|
||||
- MM_SERVICESETTINGS_SITEURL=APP_URL_DATA #LIBREPORTAL|APP_URL_TAG|APP_URL_DATA
|
||||
- MM_BLEVESETTINGS_INDEXDIR=/mattermost/bleve-indexes
|
||||
- MM_FILESETTINGS_DIRECTORY=/mattermost/data/
|
||||
- MM_LOGSETTINGS_ENABLEFILE=true
|
||||
- MM_LOGSETTINGS_FILELOCATION=/mattermost/logs
|
||||
depends_on:
|
||||
- mattermost-postgres
|
||||
labels:
|
||||
libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
|
||||
libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
|
||||
libreportal.backup.db: "postgres:mattermost-postgres:postgres:"
|
||||
libreportal.backup.files: "mattermost-service:/mattermost/data:data"
|
||||
traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
|
||||
# TRAEFIK_PORT_1_BEGIN
|
||||
traefik.http.routers.mattermost-service.entrypoints: web,websecure
|
||||
traefik.http.routers.mattermost-service.rule: Host(`DOMAINSUBNAME_DATA_1`) #LIBREPORTAL|DOMAINSUBNAME_TAG_1|DOMAINSUBNAME_DATA_1
|
||||
traefik.http.routers.mattermost-service.tls: true
|
||||
traefik.http.routers.mattermost-service.tls.certresolver: production
|
||||
traefik.http.services.mattermost-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
|
||||
traefik.http.routers.mattermost-service.middlewares: MIDDLEWARE_DATA_1 #LIBREPORTAL|MIDDLEWARE_TAG_1|MIDDLEWARE_DATA_1
|
||||
# TRAEFIK_PORT_1_END
|
||||
traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
|
||||
healthcheck:
|
||||
disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
|
||||
# GLUETUN_OFF_BEGIN
|
||||
networks:
|
||||
DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
|
||||
ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
|
||||
# GLUETUN_OFF_END
|
||||
# GLUETUN_ON_BEGIN
|
||||
# network_mode: "container:gluetun-service"
|
||||
# GLUETUN_ON_END
|
||||
|
||||
# No `user:` override here on purpose: the postgres entrypoint starts as
|
||||
# root, chowns PGDATA to the postgres user and then drops privileges. Under
|
||||
# rootless Docker container-root *is* the install user on the host, so it
|
||||
# owns ./postgres and the chown succeeds. Pinning a uid would break that.
|
||||
mattermost-postgres:
|
||||
image: postgres:15-alpine
|
||||
container_name: mattermost-postgres
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
|
||||
- POSTGRES_USER=mattermost
|
||||
- POSTGRES_PASSWORD=PASSWORD_DATA_1 #LIBREPORTAL|PASSWORD_TAG_1|PASSWORD_DATA_1
|
||||
- POSTGRES_DB=mattermost
|
||||
volumes:
|
||||
- ./postgres:/var/lib/postgresql/data
|
||||
networks:
|
||||
DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
|
||||
ipv4_address: IP_DATA_2 #LIBREPORTAL|IP_TAG_2|IP_DATA_2
|
||||
71
containers/mattermost/mattermost.config
Normal file
71
containers/mattermost/mattermost.config
Normal file
@ -0,0 +1,71 @@
|
||||
#
|
||||
# =============================================================================
|
||||
# GENERAL CONFIGURATION
|
||||
# =============================================================================
|
||||
# APP_NAME = name of application for use in scripts
|
||||
# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
|
||||
# BACKUP = if true, include this application in backup operations
|
||||
# UPDATE_TYPE = auto: new image builds are applied automatically (a recovery snapshot is taken first), manual: only when you press Update
|
||||
# HEALTHCHECK = if true, default docker health checks for that container will be enabled
|
||||
# AUTHELIA = if true, use Authelia authentication, if false turned off.
|
||||
# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
|
||||
# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
|
||||
#
|
||||
CFG_MATTERMOST_APP_NAME=mattermost
|
||||
CFG_MATTERMOST_BACKUP=true
|
||||
CFG_MATTERMOST_BACKUP_STRATEGY=auto
|
||||
CFG_MATTERMOST_UPDATE_TYPE=auto
|
||||
CFG_MATTERMOST_COMPOSE_FILE=default
|
||||
CFG_MATTERMOST_HEALTHCHECK=true
|
||||
# Left false deliberately. Mattermost ships its own account system and its
|
||||
# native desktop/mobile clients authenticate against it directly — putting
|
||||
# Authelia's forward-auth in front of the web port would lock those clients out
|
||||
# of the API without giving single sign-on in return (OIDC/SAML is a paid tier
|
||||
# in the Team Edition shipped here). Turn it on only if you intend to use the
|
||||
# web client exclusively.
|
||||
CFG_MATTERMOST_AUTHELIA=false
|
||||
CFG_MATTERMOST_HEADSCALE=false
|
||||
CFG_MATTERMOST_MONITORING=false
|
||||
#
|
||||
# =============================================================================
|
||||
# METADATA
|
||||
# =============================================================================
|
||||
# CATEGORY = application category for grouping
|
||||
# TITLE = display name for the application
|
||||
# DESCRIPTION = short description of the application
|
||||
# LONG_DESCRIPTION = detailed description of the application
|
||||
# URL = source repository or documentation URL
|
||||
# ACTIONS = available actions for this application
|
||||
#
|
||||
CFG_MATTERMOST_CATEGORY="communication"
|
||||
CFG_MATTERMOST_TITLE="Mattermost"
|
||||
CFG_MATTERMOST_DESCRIPTION="Team Chat"
|
||||
CFG_MATTERMOST_LONG_DESCRIPTION="Mattermost is a self-hosted team chat platform with channels, threads, file sharing and search, plus polished desktop and mobile clients. The Team Edition here is free and unlimited on users, and runs as one container against Postgres — the low-friction option if you want a Discord or Slack replacement that works the moment it starts"
|
||||
CFG_MATTERMOST_URL="https://github.com/mattermost/mattermost"
|
||||
CFG_MATTERMOST_ACTIONS="configure|install|restart|shutdown|uninstall"
|
||||
#
|
||||
# =============================================================================
|
||||
# NETWORK CONFIGURATION
|
||||
# =============================================================================
|
||||
# DOMAIN = number of domain from the general config, useful when using multiple domains
|
||||
# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
|
||||
#
|
||||
CFG_MATTERMOST_DOMAIN=1
|
||||
CFG_MATTERMOST_WHITELIST=false
|
||||
CFG_MATTERMOST_NETWORK=default
|
||||
#
|
||||
# =============================================================================
|
||||
# PORT CONFIGURATION
|
||||
# =============================================================================
|
||||
# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
|
||||
# - app: application name
|
||||
# - name: service identifier (webui, dns, ssh, etc.)
|
||||
# - external:internal: port mapping (external can be 'random' for auto-allocation)
|
||||
# - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
|
||||
# - protocol: 'tcp' or 'udp'
|
||||
# - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
|
||||
# - traefik: if true, Traefik handles this port (reverse proxy)
|
||||
# - webui: if true, this port serves the main web interface
|
||||
# - description: human-readable description of the service
|
||||
#
|
||||
CFG_MATTERMOST_PORT_1="mattermost-service|webui|random:8065|public|tcp|false|true|true|Web Interface||mattermost"
|
||||
1
containers/mattermost/mattermost.svg
Normal file
1
containers/mattermost/mattermost.svg
Normal file
@ -0,0 +1 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" width="256" height="256" role="img" aria-label="Mattermost"><path fill="#1e325c" d="M128 0a128 128 0 1 0 0 256 128 128 0 0 0 0-256" /><path fill="#fff" d="M170.4 47.3a2 2 0 0 0-3.3 1.4l-.9 15.7a58.9 58.9 0 0 1 22.5 42.4c1.9 33.3-22.8 59.9-56.2 61.8s-61.4-21.6-63.3-54.9a58.9 58.9 0 0 1 18.4-45.1l1.7-15.7a2 2 0 0 0-3.1-1.8A81.2 81.2 0 0 0 48.6 118c2.6 45 40.4 78.2 85.5 75.6s76.9-40.3 74.3-85.3a81.2 81.2 0 0 0-38-60.9" /><path fill="#fff" d="m121.6 137.7 25.5-1.5c8.6-.5 13.7-9.9 9.3-17.3l-13-21.9-13.7-23a5.6 5.6 0 0 0-10.4 2.5l-1.4 26.6-1.5 25.5a9.6 9.6 0 0 0 5.2 9.1" /></svg>
|
||||
|
After Width: | Height: | Size: 643 B |
Loading…
x
Reference in New Issue
Block a user