data "openstack_images_image_v2" "os" {
  name        = var.image_name
  most_recent = true
}

data "openstack_networking_network_v2" "external" {
  name = var.external_network
}

resource "openstack_networking_network_v2" "private" {
  name           = "${var.app_name}-net"
  admin_state_up = true
}

resource "openstack_networking_subnet_v2" "private" {
  name            = "${var.app_name}-subnet"
  network_id      = openstack_networking_network_v2.private.id
  cidr            = var.private_cidr
  ip_version      = 4
  dns_nameservers = ["1.1.1.1", "8.8.8.8"]
}

resource "openstack_networking_router_v2" "main" {
  name                = "${var.app_name}-router"
  external_network_id = data.openstack_networking_network_v2.external.id
}

resource "openstack_networking_router_interface_v2" "private" {
  router_id = openstack_networking_router_v2.main.id
  subnet_id = openstack_networking_subnet_v2.private.id
}

resource "openstack_networking_secgroup_v2" "mattermost" {
  name        = "${var.app_name}-sg"
  description = "SSH and HTTP/HTTPS for a reverse proxy; app port 8065 restricted"
}

resource "openstack_networking_secgroup_rule_v2" "ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.mattermost.id
}

# 80 and 443 carry Mattermost once it is served over a domain with automatic
# TLS through a reverse proxy (Caddy or Nginx). Required for production use:
# invite links, OAuth, and calls all depend on MM_SERVICESETTINGS_SITEURL
# being a real public HTTPS address.
resource "openstack_networking_secgroup_rule_v2" "http" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 80
  port_range_max    = 80
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.mattermost.id
}

resource "openstack_networking_secgroup_rule_v2" "https" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.mattermost.id
}

# Raw app HTTP on 8065 is restricted to app_allowed_cidr (the private network
# by default). Use it for setup over an SSH tunnel or a scoped workstation IP;
# put a reverse proxy on 443 in front for routine access.
resource "openstack_networking_secgroup_rule_v2" "app" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 8065
  port_range_max    = 8065
  remote_ip_prefix  = var.app_allowed_cidr
  security_group_id = openstack_networking_secgroup_v2.mattermost.id
}

resource "openstack_networking_port_v2" "mattermost" {
  name               = "${var.app_name}-port"
  network_id         = openstack_networking_network_v2.private.id
  security_group_ids = [openstack_networking_secgroup_v2.mattermost.id]

  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.private.id
  }

  depends_on = [openstack_networking_router_interface_v2.private]
}

resource "openstack_blockstorage_volume_v3" "data" {
  name = "${var.app_name}-data"
  size = var.volume_size
}

resource "openstack_compute_instance_v2" "mattermost" {
  name        = var.app_name
  flavor_name = var.flavor_name
  key_pair    = var.key_name

  user_data = templatefile("${path.module}/cloud-init/mattermost.yaml.tftpl", {
    app_name = var.app_name
  })

  block_device {
    uuid                  = data.openstack_images_image_v2.os.id
    source_type           = "image"
    destination_type      = "volume"
    volume_size           = 30
    boot_index            = 0
    delete_on_termination = true
  }

  network {
    port = openstack_networking_port_v2.mattermost.id
  }
}

resource "openstack_compute_volume_attach_v2" "data" {
  instance_id = openstack_compute_instance_v2.mattermost.id
  volume_id   = openstack_blockstorage_volume_v3.data.id
}

resource "openstack_networking_floatingip_v2" "mattermost" {
  pool = var.external_network
}

resource "openstack_networking_floatingip_associate_v2" "mattermost" {
  floating_ip = openstack_networking_floatingip_v2.mattermost.address
  port_id     = openstack_networking_port_v2.mattermost.id
}

variable "key_name" {
  description = "SSH keypair name (must already exist in your project)"
  type        = string
}

variable "flavor_name" {
  description = "Instance size. Mattermost plus its bundled PostgreSQL runs on 4 vCPU and 4 GiB RAM (s1a.medium) for a small-to-mid team. Mattermost's own scaling guidance recommends significantly more for large enterprise deployments; size up accordingly."
  type        = string
  default     = "s1a.medium"
}

variable "image_name" {
  description = "Operating system image. Ubuntu 24.04 is the recommended base."
  type        = string
  default     = "Ubuntu-24.04"
}

variable "app_name" {
  description = "Display name prefix for compute and network resources"
  type        = string
  default     = "mattermost"
}

variable "volume_size" {
  description = "Block volume size in GiB, mounted at /var/lib/docker so the PostgreSQL data and Mattermost's config/data/logs/plugins/bleve-indexes directories live on a volume you can grow rather than on the boot disk."
  type        = number
  default     = 20
}

variable "external_network" {
  description = "Shared external network for router gateway and floating IPs; defaults to PublicStatic (persisted FIP / production pattern). Override with PublicEphemeral for ephemeral demos."
  type        = string
  default     = "PublicStatic"
}

variable "private_cidr" {
  description = "CIDR for the private tenant network the instance lives in"
  type        = string
  default     = "10.55.0.0/24"
}

variable "app_allowed_cidr" {
  description = "CIDR allowed to reach Mattermost on port 8065. Defaults to the private network only, so the app is not exposed to the public internet on its raw port. Put a reverse proxy on 443 in front for HTTPS once you point a domain at the instance. To reach port 8065 directly from your workstation during setup, set this to YOUR_IP/32."
  type        = string
  default     = "10.55.0.0/24"
}

#cloud-config
package_update: true
packages:
  - ca-certificates
  - curl
write_files:
  - path: /opt/mattermost/docker-compose.yml
    permissions: "0644"
    content: |
      # Mattermost team chat for ${app_name}. The app listens on port 8065.
      # Mattermost needs a stable public URL (MM_SERVICESETTINGS_SITEURL)
      # before invite links, OAuth, and calls work: set it in
      # /opt/mattermost/.env, then start the app. No credential ships with
      # this template: the PostgreSQL password is generated on first boot.
      # cloud-init starts only PostgreSQL; bring up Mattermost after you
      # finish configuring /opt/mattermost/.env.
      services:
        mattermost:
          image: mattermost/mattermost-team-edition:release-11.9
          restart: unless-stopped
          user: "2000:2000"
          ports:
            - "8065:8065"
          env_file:
            - /opt/mattermost/.env
          volumes:
            - mattermost_config:/mattermost/config
            - mattermost_data:/mattermost/data
            - mattermost_logs:/mattermost/logs
            - mattermost_plugins:/mattermost/plugins
            - mattermost_client_plugins:/mattermost/client/plugins
            - mattermost_bleve:/mattermost/bleve-indexes
          depends_on:
            - postgres
        postgres:
          image: postgres:16-alpine
          restart: unless-stopped
          env_file:
            - /opt/mattermost/.env
          volumes:
            - mattermost_pg:/var/lib/postgresql/data
      volumes:
        mattermost_config:
        mattermost_data:
        mattermost_logs:
        mattermost_plugins:
        mattermost_client_plugins:
        mattermost_bleve:
        mattermost_pg:
runcmd:
  - |
    set -e
    # The data volume attaches as /dev/sdb on this platform (not /dev/vdb).
    # Mount it at /var/lib/docker before Docker is installed so the
    # PostgreSQL data and every Mattermost volume live on the resizable
    # volume rather than the boot disk.
    DEV=/dev/sdb
    for i in $(seq 1 30); do [ -b "$DEV" ] && break; sleep 5; done
    if ! blkid "$DEV" >/dev/null 2>&1; then mkfs.ext4 -F -L mattermostdata "$DEV"; fi
    mkdir -p /var/lib/docker
    mount "$DEV" /var/lib/docker
    grep -q "$DEV" /etc/fstab || echo "$DEV /var/lib/docker ext4 defaults,nofail 0 2" >> /etc/fstab
    # Install Docker Engine plus the compose plugin from Docker's convenience
    # script.
    curl -fsSL https://get.docker.com | sh
    # Generate the bundled database password on first boot. It never leaves
    # this instance.
    PGPASS=$(openssl rand -hex 24)
    umask 077
    {
      echo "MM_SQLSETTINGS_DRIVERNAME=postgres"
      echo "MM_SQLSETTINGS_DATASOURCE=postgres://mattermost:$PGPASS@postgres:5432/mattermost?sslmode=disable&connect_timeout=10"
      echo "MM_BLEVESETTINGS_INDEXDIR=/mattermost/bleve-indexes"
      echo "POSTGRES_USER=mattermost"
      echo "POSTGRES_PASSWORD=$PGPASS"
      echo "POSTGRES_DB=mattermost"
      echo "# Set MM_SERVICESETTINGS_SITEURL to your public HTTPS address"
      echo "# before starting Mattermost:"
      echo "# MM_SERVICESETTINGS_SITEURL=https://chat.example.com"
    } > /opt/mattermost/.env
    chmod 600 /opt/mattermost/.env
    # Bring up PostgreSQL only. Mattermost starts after you set
    # MM_SERVICESETTINGS_SITEURL in /opt/mattermost/.env and run:
    #   cd /opt/mattermost && docker compose up -d
    cd /opt/mattermost
    docker compose up -d postgres

# Mattermost team chat

Single compute instance running [Mattermost](https://mattermost.com) Team Edition, a self-hosted team-chat platform (a self-hosted alternative to Slack) on infrastructure you control. After apply, cloud-init starts the bundled PostgreSQL; you set the public site URL and start the app container yourself.


**Network class:** production — `external_network` defaults to `PublicStatic` for persisted floating IPs and multi-tier stacks; override with `PublicEphemeral` for ephemeral demos.

The instance provisions a private network, a floating IP, and a block volume mounted at `/var/lib/docker` so the database data and Mattermost's config, data, logs, plugins, and search-index directories live on a resizable volume.

## Where this fits

Mattermost centralizes team messaging, channels, and integrations for a team, with a System Console for administration, on infrastructure you own rather than on a third-party SaaS.

## Resource floor: heavier than the lighter ops-tools templates in this library

Mattermost's app server plus its bundled PostgreSQL need more headroom than a single-process tool. This template's `s1a.medium` default (4 vCPU, 4 GiB RAM) suits a small-to-mid team. Mattermost's own scaling guidance recommends significantly more for large enterprise deployments: size up the flavor and split PostgreSQL onto its own instance as your team grows.

## Prerequisites

- OpenTofu >= 1.6.0 or Terraform >= 1.6.0
- Quake AI account with OpenStack credentials
- An existing SSH keypair in your project (the value of `key_name` must match that keypair)

## Usage

1. Clone or copy this template directory
2. Copy `terraform.tfvars.example` to `terraform.tfvars` and fill in your values
3. Source your OpenStack credentials: `source openrc.sh`
4. Initialize: `tofu init`
5. Preview: `tofu plan`
6. Apply: `tofu apply`

After apply, cloud-init installs Docker, generates the PostgreSQL password into `/opt/mattermost/.env`, and starts only `postgres`. No credential ships with this template: the database password is generated on first boot.

## Finish setup after apply

Mattermost needs a real public URL before invite links, OAuth, and calls work, so cloud-init holds the app container until you finish configuration:

1. Point a domain's DNS A record at `floating_ip` and put a reverse proxy (Caddy or Nginx) in front for HTTPS on 443.
2. Edit `/opt/mattermost/.env`: set `MM_SERVICESETTINGS_SITEURL` to your public HTTPS address.
3. Start Mattermost:

```bash
cd /opt/mattermost
sudo docker compose up -d
```

4. Open the site URL and sign up the first admin account, which becomes the System Console admin.

## Access and security

Mattermost listens on port 8065 over plain HTTP. The security group restricts 8065 to `app_allowed_cidr`, which defaults to the private network only. Ports 80 and 443 stay open for a reverse proxy you add for production use; they carry no traffic until you add one.

## Datastores

This template bundles PostgreSQL as a container on the same instance, which suits a single-team deployment. To run it as a separate service, point `MM_SQLSETTINGS_DATASOURCE` in `/opt/mattermost/.env` at a [self-managed PostgreSQL](/resources/iac-templates/self-managed-postgres) instance and remove the bundled service from the compose file.

## Variables

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `key_name` | string | yes | n/a | SSH keypair name (must already exist in your project) |
| `flavor_name` | string | no | `s1a.medium` | Instance size (Mattermost plus PostgreSQL runs on 4 vCPU / 4 GiB) |
| `image_name` | string | no | `Ubuntu-24.04` | Operating system image |
| `app_name` | string | no | `mattermost` | Display name prefix for resources |
| `volume_size` | number | no | `20` | Block volume size in GiB, mounted at `/var/lib/docker` |
| `external_network` | string | no | `PublicStatic` | Persisted FIP / production default; override with `PublicEphemeral` for demos |
| `private_cidr` | string | no | `10.55.0.0/24` | CIDR for the private subnet |
| `app_allowed_cidr` | string | no | `10.55.0.0/24` | CIDR allowed to reach Mattermost on port 8065 |

## Outputs

| Name | Description |
| --- | --- |
| `floating_ip` | Public floating IP assigned to the instance |
| `private_ip` | Private IP address of the instance |
| `app_url` | Mattermost app URL on port 8065 |
| `instance_id` | Compute instance ID |

## Scope

This is a single-VM Mattermost host that you operate, not a managed team-chat cloud. It is CPU-only, runs in one region, and bundles PostgreSQL as a container on the same host, sized for a small-to-mid team. You operate the instance, Docker, Mattermost, the database, and the data volume yourself: back them up, patch them, and size up as your team grows.

## Documentation

See also: [self-managed PostgreSQL](/resources/iac-templates/self-managed-postgres), [Infisical secrets management](/resources/iac-templates/infisical-secrets)