Skip to main content
Version: 0.5.5

Mattermost on Aruba Cloud

Deploy Mattermost Team Edition — open-source team messaging — on Aruba Cloud using Terraform and cloud-init. Mattermost binary service + Managed MySQL 8.0 + nginx reverse proxy.

Provider version: arubacloud/arubacloud ~> 0.5 | Terraform: ≥ 1.9

Introduction​

Mattermost is a self-hosted, Slack-compatible open-source messaging platform written in Go and React. This example provisions a production-ready Mattermost Team Edition stack with:

  • A CloudServer VM (CSO4A8 — 4 vCPU / 8 GB) running the Mattermost Go binary as a systemd service behind nginx, fully bootstrapped by cloud-init
  • A Managed MySQL 8.0 DBaaS instance with autoscaling storage
  • A dedicated VPC, subnet, and security groups via the shared network module
  • Elastic IPs for the VM and DBaaS
  • Correct nginx WebSocket proxying for real-time messaging
  • Optional Let's Encrypt HTTPS when a custom domain is provided

The first user to register on the instance automatically becomes the System Administrator.

Architecture Overview​

Infrastructure Created​

ResourceName patternDescription
arubacloud_projectmm-prodProject container
arubacloud_vpcmm-prod-vpcVirtual Private Cloud
arubacloud_subnetmm-prod-subnetBasic subnet
arubacloud_securitygroupmm-prod-vm-sgVM security group
arubacloud_securitygroupmm-prod-db-sgDBaaS security group
arubacloud_securityrulemm-prod-vm-sshSSH ingress
arubacloud_securityrulemm-prod-vm-httpHTTP ingress
arubacloud_securityrulemm-prod-vm-httpsHTTPS ingress
arubacloud_securityrulemm-prod-db-mysqlMySQL ingress from VM IP
arubacloud_elasticipmm-prod-vm-eipVM public IP
arubacloud_elasticipmm-prod-db-eipDBaaS public IP
arubacloud_blockstoragemm-prod-boot50 GB boot disk (Performance)
arubacloud_keypairmm-prod-keypairSSH public key
arubacloud_dbaasmm-prod-dbaasManaged MySQL 8.0
arubacloud_databasemattermostMattermost logical database
arubacloud_dbaasusermattermostMySQL application user
arubacloud_databasegrant—liteadmin grant
arubacloud_cloudservermm-prod-vmCloudServer VM

Estimated Monthly Cost​

Approximate prices for ITBG-Bergamo, hourly billing.

ResourceSpecEst. cost/mo
CloudServer VMCSO4A8 — 4 vCPU / 8 GB~€36
Boot disk50 GB Performance~€6
Managed MySQLDBO2A8 — 2 vCPU / 8 GB~€35
DBaaS storage20 GB~€3
Elastic IP × 2—~€5
Total~€85/mo

Requirements​

  • Terraform ≥ 1.9
  • ArubaCloud Terraform Provider ~> 0.5
  • An ArubaCloud account with OAuth2 API credentials
  • An SSH key pair

Variables​

Required​

VariableDescription
arubacloud_client_idArubaCloud OAuth2 client ID
arubacloud_client_secretArubaCloud OAuth2 client secret
ssh_public_keySSH public key content
db_passwordMySQL password for the Mattermost user (min 16 chars, no newlines)

Optional​

VariableDefaultDescription
app_name"mm"Short name used in all resource names
environment"prod"Environment label
location"ITBG-Bergamo"ArubaCloud region
zone"ITBG-1"Availability zone
billing_period"Hour""Hour" or "Month"
vm_flavor"CSO4A8"CloudServer flavor
vm_image"LU22-001"Boot disk image (Ubuntu 22.04 LTS)
vm_disk_size_gb50Boot disk size in GB
ssh_cidr"0.0.0.0/0"CIDR for SSH — restrict to your IP
dbaas_flavor"DBO2A8"DBaaS flavor
db_storage_gb20DBaaS initial storage in GB
mattermost_version"10.4.2"Mattermost Team Edition version
domain""Custom domain for HTTPS

Outputs​

OutputDescription
site_urlMattermost URL
vm_public_ipPublic IP address of the VM
ssh_commandSSH command to connect to the VM
dbaas_hostDBaaS endpoint
db_nameDatabase name
db_userDatabase username

Deployment Instructions​

1. Clone and navigate​

git clone https://github.com/arubacloud/terraform-arubacloud-examples.git
cd terraform-arubacloud-examples/mattermost

2. Configure variables​

cp terraform.tfvars.example terraform.tfvars

Set db_password and your credentials.

3. Deploy​

terraform init
terraform plan
terraform apply

Bootstrap takes approximately 15–20 minutes — cloud-init waits up to 15 minutes for the DBaaS to become reachable before starting Mattermost.

4. Access Mattermost​

terraform output site_url

Open the URL and register the first account — that user becomes System Administrator.

5. Monitor progress​

ssh ubuntu@$(terraform output -raw vm_public_ip)
sudo tail -f /var/log/cloud-init-output.log
sudo journalctl -u mattermost -f

Security Recommendations​

  1. Restrict SSH to your IP. Set ssh_cidr = "your.ip/32".

  2. Use HTTPS. Set domain to enable Let's Encrypt TLS. Without TLS, session tokens and messages are transmitted in cleartext.

  3. Register the admin account first. The first registered user becomes System Administrator. Register immediately after deployment before sharing the URL.

  4. Restrict Team invitations. In System Console → Authentication → Email, configure invite-only registration once your team is set up.

  5. Enable MFA. In System Console → Authentication → MFA, require multi-factor authentication for all users.

Upgrade Considerations​

Mattermost upgrade​

ssh ubuntu@$(terraform output -raw vm_public_ip)

MM_VERSION=X.Y.Z
sudo systemctl stop mattermost
sudo mv /opt/mattermost /opt/mattermost-backup
curl -sSfL \
  "https://releases.mattermost.com/$MM_VERSION/mattermost-team-$MM_VERSION-linux-amd64.tar.gz" \
  | sudo tar -xz -C /opt
# Restore config and data
sudo cp /opt/mattermost-backup/config/config.json /opt/mattermost/config/ 2>/dev/null || true
sudo chown -R mattermost:mattermost /opt/mattermost
sudo systemctl start mattermost

Review the Mattermost changelog before upgrading.

Troubleshooting​

Mattermost not reachable​

sudo systemctl status mattermost
sudo journalctl -u mattermost -n 50
sudo tail -100 /var/log/cloud-init-output.log

WebSocket connection failed​

Verify the nginx config includes the WebSocket location block for /api/v[0-9]+/(users/)?websocket:

sudo nginx -t
sudo cat /etc/nginx/sites-enabled/mattermost.conf

MySQL connection error​

mysql -u mattermost -p -h $(terraform output -raw dbaas_host) mattermost

References​