From 8d54c9f16d974dd02db742187dcaba87c026b37e Mon Sep 17 00:00:00 2001
From: nihil <nihil@nihil.foo>
Date: Mon, 21 Sep 2026 17:27:13 +0200
Subject: [PATCH] Add Mattermost

---
 Mattermost.md | 171 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 171 insertions(+)
 create mode 100644 Mattermost.md

diff --git a/Mattermost.md b/Mattermost.md
new file mode 100644
index 0000000..5ef80a9
--- /dev/null
+++ b/Mattermost.md
@@ -0,0 +1,171 @@
+## postgres
+
+```
+sudo -u postgres psql
+```
+
+```
+CREATE USER mattermost PASSWORD '<PASSWORD>';
+
+CREATE DATABASE mattermost WITH OWNER = mattermost;
+
+GRANT ALL PRIVILEGES ON DATABASE mattermost to mattermost;
+
+\q
+```
+
+## nginx
+
+```
+sudo nano /etc/nginx/sites-available/mattermost
+```
+
+``` conf
+upstream backend {
+   server 127.0.0.1:8065;
+   keepalive 32;
+}
+
+server {
+   listen 443 ssl http2;
+   listen [::]:443 ssl http2;
+   server_name    mattermost.{domain-name};
+
+   ssl_certificate /etc/letsencrypt/live/{domain-name}/fullchain.pem;
+   ssl_certificate_key /etc/letsencrypt/live/{domain-name}/privkey.pem;
+   ssl_session_timeout 1d;
+
+   # Enable TLS versions (TLSv1.3 is required upcoming HTTP/3 QUIC).
+   ssl_protocols TLSv1.2 TLSv1.3;
+
+   # Enable TLSv1.3's 0-RTT. Use $ssl_early_data when reverse proxying to
+   # prevent replay attacks.
+   #
+   # @see: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data
+   ssl_early_data on;
+
+   ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384';
+   ssl_prefer_server_ciphers on;
+   ssl_session_cache shared:SSL:50m;
+   # HSTS (ngx_http_headers_module is required) (15768000 seconds = six months)
+   add_header Strict-Transport-Security max-age=15768000;
+   # OCSP Stapling ---
+   # fetch OCSP records from URL in ssl_certificate and cache them
+   ssl_stapling on;
+   ssl_stapling_verify on;
+
+   add_header X-Early-Data $tls1_3_early_data;
+
+   location ~ /api/v[0-9]+/(users/)?websocket$ {
+       proxy_set_header Upgrade $http_upgrade;
+       proxy_set_header Connection "upgrade";
+       client_max_body_size 50M;
+       proxy_set_header Host $host;
+       proxy_set_header X-Real-IP $remote_addr;
+       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+       proxy_set_header X-Forwarded-Proto $scheme;
+       proxy_set_header X-Frame-Options SAMEORIGIN;
+       proxy_buffers 256 16k;
+       proxy_buffer_size 16k;
+       client_body_timeout 60s;
+       send_timeout 300s;
+       lingering_timeout 5s;
+       proxy_connect_timeout 90s;
+       proxy_send_timeout 300s;
+       proxy_read_timeout 90s;
+       proxy_http_version 1.1;
+       proxy_pass http://backend;
+   }
+
+   location / {
+       client_max_body_size 100M;
+       proxy_set_header Connection "";
+       proxy_set_header Host $host;
+       proxy_set_header X-Real-IP $remote_addr;
+       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+       proxy_set_header X-Forwarded-Proto $scheme;
+       proxy_set_header X-Frame-Options SAMEORIGIN;
+       proxy_buffers 256 16k;
+       proxy_buffer_size 16k;
+       proxy_read_timeout 600s;
+       proxy_http_version 1.1;
+       proxy_pass http://backend;
+   }
+}
+
+# This block is useful for debugging TLS v1.3. Please feel free to remove this
+# and use the `$ssl_early_data` variable exposed by NGINX directly should you
+# wish to do so.
+map $ssl_early_data $tls1_3_early_data {
+  "~." $ssl_early_data;
+default "";
+}
+```
+
+```
+sudo ln /etc/nginx/sites-available/mattermost /etc/nginx/sites-enabled/mattermost
+```
+
+```
+sudo certbot renew
+```
+```
+sudo systemctl reload nginx
+```
+
+## install binaries
+
+
+```
+wget https://releases.mattermost.com/11.11.0/mattermost-11.11.0-linux-amd64.tar.gz
+```
+
+```
+tar -xvzf mattermost*.gz
+sudo mv mattermost /opt
+sudo mkdir /opt/mattermost/data
+sudo useradd --system --user-group mattermost
+sudo chown -R mattermost:mattermost /opt/mattermost
+sudo chmod -R g+w /opt/mattermost
+```
+
+## systemd
+
+```
+sudo nano /etc/systemd/system/mattermost.service
+```
+
+```
+[Unit]
+Description=Mattermost
+After=network.target
+
+[Service]
+Type=notify
+ExecStart=/opt/mattermost/bin/mattermost
+TimeoutStartSec=3600
+KillMode=mixed
+Restart=always
+RestartSec=10
+WorkingDirectory=/opt/mattermost
+User=mattermost
+Group=mattermost
+LimitNOFILE=49152
+
+[Install]
+WantedBy=multi-user.target
+```
+
+## configure
+```
+sudo cp /opt/mattermost/config/config.json /opt/mattermost/config/config.defaults.json
+```
+
+```
+sudo nano /opt/mattermost/config/config.json
+```
+
+```
+sudo systemctl start mattermost
+```
+