tjtoml/mattermost-ansible

Ansible playbook to provide a turnkey solution for the Team Edition of Mattermost

Maintainer Wanted

If someone would like to take over the maintenance of this repo, please submit an issue or PR. I originally wrote this as a way to learn ansible when I was in college, and no longer have the time/inclination to maintain it now that I have a real job - mostly working with ansible.

mattermost-ansible

This is an Ansible Playbook that installs a standalone version of Mattermost, which is an open-source Slack alternative. This playbook installs Mattermost version 4.3.2 (Team Edition) by default.

It downloads the binary from mattermost.org. If you need to install the Enterprise edition, consult the Mattermost documentation. This playbook installs

• postgresql - Database Server
• nginx - Web Server (acts as a reverse proxy)
• SSL certificates are automatically generated from the letsencrypt project. A cron job is created that automatically renews the SSL certificates once a month.

---

This playbook currently works with

• Ubuntu 14.04.5 LTS, Trusty Tahr (DigitalOcean)
• Ubuntu 16.04.2 LTS, Xenial Xerus (DigitalOcean)
• CentOS 6.9 (DigitalOcean)
• CentOS 7.3 (DigitalOcean)
• Red Hat Enterprise Linux 6.9 (Santiago) (Installed from RedHat DVD on a Vultr VPS)
• Red Hat Enterprise Linux 7.3 (Maipo) (Installed from RedHat DVD on a Vultr VPS)
• Debian 7.11 Wheezy
• Debian 8.8 Jessie (thanks fgbreel!)

---

I have no reason to think that versions of these operating systems installed locally or by other providers will not work, but I have not tested them. If you are going to run into an issue, it will probably be with the firewall, as DigitalOcean has very permissive firewall rules by default. If you are having an issue, try opening port 80 and 443.

Distro Specific Instructions/Info

RHEL 6.8

The playbook completely disables the iptables firewall. This is not strictly necessary, but I hate iptables with my whole body and I was tired of fighting with it. If you want or need it, you should re-enable it, but none of the required ports will be open. Even better, submit a PR that fixes this issue (so I don't have to do it).

---

Usage

• Install ansible with your package manager of choice. Ansible can also be installed via pip. This playbook was tested with Ansible 2.3.1 If you can, I would recommend running the most recent version of ansible.

• Clone this repository.

• Make sure that the server you are installing Mattermost is properly configured with a FQDN. You should also have root access via ssh. Reverse DNS should also be properly configured for letsencrypt to work. If you are using a cloud hosting provider, this should be trivial.

• Edit play.yml and change the vars to reflect any changes you may want to make for your system. This playbook does not do a complete installation with full configuration of all of the Mattermost options, but rather installs it to the point where you can edit the relevant settings from within the web browser.

• You should always edit the email address and db_password fields.

• Create a hosts file in the project directory. It only needs to contain one line, which is the IP address of the server you wish to install Mattermost on.

• Run ansible-playbook play.yml -i hosts from the top of level of the project directory.

• Navigate to the FQDN of your server in a web browser. Consult the Mattermost documentation for further configuration options.

---

Post-Install

If you are planning to use MatterMost for any length of time, you should probably change the location of the data directory. A large volume of attached block storage would not be a bad idea. A working email server should also be configured for email notifications and invites. You can do most of this from within the browser without manually editing configuration files.

---

Contributing

Please submit pull requests! They make my day.

Moving Forward

I am currently working on porting this standalone playbook into a more defined Ansible role with a complete implementation of all the options in the Mattermost config file. You can check on the status of this project here.

mattermost-ansible's Issues

[APPRECIATION POST] Great work!

Hey Tyler,

Here at Openbook we just set up a Mattermost server in less than an hour thanks to your work.

We thought would be nice to show some appreciation!

Thanks for making this available for everyone, you rock!

Fedora 24 support

Add Fedora 24 support

Sweet!!

Hey Tyler,

Really nice work!

Would you be up for sharing some info on your project so we can promote it?

Also, would love to have you hang out with the Mattermost community on our server, if you're not there already. We have an installers and images where we can intro you to other folks doing great work like yours!

Ian

Debian 8 Support

SSL certificates : letsencrypt doesn't like private clouds

@tjtoml : I could not make letsencrypt work from a private cloud because of letsencrypt limitations to public DNS names and IP networks.
I managed to write a role that uses ansible's crypto modules and creates a self-signed certificate.
See https://docs.ansible.com/ansible/2.4/list_of_crypto_modules.html
It installs python crypto requirements.
You can switch between both options with selfsigned_ssl_cert: true as a variable in the playbook. This enables my new role, disables letsencrypt and cron roles, and adapts nginx config from template.
Now it works for me. Are you interested in a pull request ?

Fedora 23 Support

Debian 7 Support

Letsencrypt task fails complaining that "Name does not end in a public suffix".

This might be a problem with my config, but I can verify with dig -x that reverse DNS is set up for our FQDN.

Steps to reproduce:

*Create hosts file with IP (not url) of server
*Modify db password in play.yml and cert_email_address
*Run targeting Amazon EC2 Ubuntu host

Error: Error creating new authz :: Name does not end in a public suffix

Upcoming breaking change when using Mattermost with a reverse proxy

My name is Jason Blais and I'm a product manager for the Mattermost open source project.

Mattermost is moving to new APIv4 endpoints, which will allow for more powerful integrations and server interaction.

As part of this move, we will be moving the WebSocket endpoint to APIv4 in Q3 of 2017 (tentatively scheduled for July 16, 2017 release). This will result in a breaking change for deployments using a reverse proxy.

For those configuring NGINX proxy, just a single one-line change is required, replacing the location /api/v3/users/websocket { line with location ~ /api/v[0-9]+/(users/)?websocket$ { in the /etc/nginx/sites-available/mattermost NGINX configuration file. We've noted this in our documentation.

I'm opening an issue so we can discuss if any changes are needed for the Ansible package, as we weren't sure what kind of configuration is recommended on your end.

Interested in becoming a maintainer

Hey there I'm new to Devops and what not , but I've been playing around with docker, ubuntu, etc I would like to become a maintainer for this project. Might need to learn the ins & outs first, but open to learn.How can I start ?

Thanks

nginx template includes SSLv3

Hi,

I notice the nginx includes SSLv3 in the list of allowed protocols. This should be removed.

https://security.googleblog.com/2014/10/this-poodle-bites-exploiting-ssl-30.html

Thanks.

Create iptables task so that it doesn't have to be disabled

Currently iptables is completely disabled for RHEL 6 because I don't like dealing with iptables. If someone could fix that, it would be just great.

Upgrade to 3.5.0 of mattermost

3.5.0 is the latest release. https://about.mattermost.com/download/

Maintener Wanted

Hi there,

I've got some spare time so I can manage your repository as you requested. You've got somes pretty awesome PR like #26 and I'ld be gratefull to include them in Master.

Best Regards,
Luclis.