Self-hosted Mattermost: your team's chat on a server you control

How big a server does your team need?

Less than you might expect. Mattermost sizes a single server by the number of people who have an account:

Two things push those numbers up. The table assumes Mattermost's default 50 MB upload limit, and the docs say heavy file sharing is what drives memory. And the table describes the server Mattermost runs on; on your own machine PostgreSQL and NGINX will share it, so our advice is to give them generous room as well.

You may also see Mattermost's larger reference designs. Those count people online at the same moment, not accounts. Even the smallest, built for up to 200 simultaneous users, spreads the work over separate application, database and proxy machines. The next one, built for up to 2,000 simultaneous users, is marked for Mattermost's Enterprise plans and requires high availability, with two application servers. For a team on one server, stick with the account-based table. Above 2,000 accounts, Mattermost suggests running its load-testing tool against your real usage first.

Room for everybody's files

Chat messages take very little space; the screenshots and documents people drop into channels are what fill a disk. Mattermost's planning pages suggest you start with 600-800 MB, which covers the system and database, then add what each person uploads in a month, times twelve, times your average head count for the year, with up to double on top as a safety margin. Its rough guide per person, per month:

• 1 to 5 MB if your team mostly types and shares links
• 5 to 25 MB if screenshots, PDFs and office files are routine
• 25 to 100 MB if large media files go up all the time

Mattermost also recommends looking at disk use at least once a quarter, which is a calendar reminder worth setting on day one.

The server that fits

Every machine on our dedicated servers page is a whole computer that nobody else uses, so your chat and its database never wait for another customer's work. Pick one with an x86 processor, because that is what Mattermost supports; our ARM machines are not the right choice here.

• Small and cheap: a compact cartridge server is built for one job, and a team chat is one job. Choose a model with NVMe storage and 16 GB of memory or more, and you are well above what a team of a few hundred needs.
• Everyday servers: one processor with headroom, the usual home for an app and its database together. Rack servers and blades also come with a console screen and power button you can reach yourself.
• Serious workloads: two processors, for when the chat shares the machine with other services you run.

Choose Ubuntu 24.04 in the control panel when you install (Linux servers explains the choices): its own PostgreSQL is version 16, above the minimum. Ubuntu 22.04 comes with version 14, which Mattermost v12 will not accept. If your first attempt goes wrong, a reinstall takes about ten minutes and costs nothing. A ready server is handed over within 30 minutes of payment approval, and nothing counts your traffic, so a busy month of file sharing never reaches your invoice.

Why you must be the first to sign up

Mattermost gives the system admin role to the very first account created on a fresh installation. If your server is public when the install finishes, a stranger who finds the sign-up page before you would own your workspace.

The fix is simple: keep Mattermost listening only on the server itself (address 127.0.0.1), open a private SSH tunnel from your own computer, and create your account through it. Only then do you open the web ports to everyone. The steps below do exactly that.

Setting it up, step by step

1. Lock the door first. Allow only SSH with sudo ufw allow OpenSSH and sudo ufw enable. Open /etc/default/ufw and check it says IPV6=yes, so the rules also protect your IPv6 address.
2. Add Mattermost's repositories. Run Mattermost's setup script and then sudo apt update (commands below). The script adds two package sources, Mattermost's own and one for PostgreSQL, and prepares NGINX and certbot too.
3. Create the database. Run sudo apt install postgresql, check that psql --version shows 15 or newer, open sudo -u postgres psql, and follow Mattermost's database page to create a mattermost database owned by a mmuser role. Mattermost's page sets the password inside the CREATE USER statement; we suggest creating the role without one and then running \password mmuser, which asks for it at a prompt rather than saving it in psql's history.
4. Install Mattermost. Install the mattermost package and copy the default config into place with permissions 600 (the commands are below). The config file will hold your database password, so it should stay readable by the service alone.
5. Point it at the database and keep it private. In /opt/mattermost/config/config.json, fill in the database connection, set the Site URL to your future https:// address, and set ServiceSettings.ListenAddress to 127.0.0.1:8065. Then start the service with sudo systemctl start mattermost and switch it on at boot with sudo systemctl enable mattermost.service.
6. Become the admin. Open the tunnel shown below from your laptop, using your own SSH login, then visit http://localhost:8065, and create your account. It becomes the system admin.
7. Open the front door. Install NGINX, use Mattermost's sample configuration with the upstream set to 127.0.0.1:8065, and now that your account exists, run sudo ufw allow 'Nginx Full' and get a certificate with certbot.

curl -o- https://deb.packages.mattermost.com/repo-setup.sh | sudo bash -s mattermost
sudo apt update
sudo apt install postgresql
psql --version
sudo apt install mattermost -y
sudo install -C -m 600 -o mattermost -g mattermost \
  /opt/mattermost/config/config.defaults.json \
  /opt/mattermost/config/config.json

# later, from your own computer:
ssh -N -L 8065:127.0.0.1:8065 you@your-server

That setup script runs as root. Mattermost says it adds a PostgreSQL package source and prepares NGINX and certbot, so read it first if you want to know what it changes.

Getting NGINX right for chat

Mattermost recommends NGINX in front of any real deployment: it handles the HTTPS certificate and redirects plain HTTP. Chat needs one thing a normal website does not, a connection that stays open for live updates, and Mattermost's sample file gives that connection (the path ending in websocket) its own block with Upgrade headers. Keep that block when you adapt the file.

Two more small things: write 127.0.0.1 rather than localhost in the upstream, as the docs advise, and set client_max_body_size to match the largest upload you allow. From outside, people should only reach ports 80 and 443; Mattermost's own ports 8065, 8067 and 8074 stay inside.

Would you rather use Docker?

You can. Mattermost's container guide clones its docker repository, has you copy env.example to .env and set your DOMAIN, and starts two containers, one for PostgreSQL and one for Mattermost, with Docker Compose. Be aware the same guide marks this method as not meant for production, and notes that out of the box it supports neither a cluster nor high availability. Mattermost's requirements page, on the other hand, still recommends its Docker deployment on Linux, so weigh both before you choose.

• Docker walks past your firewall. Ports Docker publishes are opened through its own firewall rules, which ufw never sees, and they answer on your IPv6 address too, not just IPv4. Set APP_PORT=127.0.0.1:8065 in .env before the first start so Mattermost is reachable only from the server, then use the same tunnel and NGINX steps as above.
• Check what is actually open. The compose file also publishes the port used for Calls. List open ports with sudo ss -tulpn, then try connecting from another network to both your IPv4 and your IPv6 address.
• Change the default database password in .env, as Mattermost recommends, and make the file readable only by you with chmod 600 .env.
• Pin a version. Set MATTERMOST_IMAGE_TAG to a specific release instead of a general one, so updates happen when you decide.

Keeping it healthy

Your team's history lives in three places, and a backup needs all three: the PostgreSQL database, the config folder and the data folder with everyone's uploads. Mattermost advises stopping the service while the backup runs, so files and database match, and keeping a copy somewhere other than the server.

To update, stop Mattermost, run sudo apt update and then sudo apt upgrade, and start it again. Keep an eye on the database too: Mattermost raises its minimum PostgreSQL version as older ones reach end of life, which is how version 15 became the floor with Mattermost v12.0.

When something else suits you better

Mattermost is team chat in channels, for people who work together. If you want your server to talk to other servers on an open network, Matrix is built for that. If your goal is a public community with long, searchable discussions, look at running Discourse. And if your chat grows until the database deserves a machine of its own, see a PostgreSQL server.

Questions people ask

Is a small server really enough for a few hundred people?

For Mattermost itself, yes: its documentation puts up to 1,000 people with accounts on one core with 2 GB of memory. Add room for PostgreSQL on the same machine, plus more memory if you raise the upload limit above 50 MB.

Which database do I need?

PostgreSQL, version 15 or newer. Mattermost is phasing out MySQL and does not support MariaDB, so a new installation should start on PostgreSQL.

Who becomes the administrator?

Whoever creates the first account on a new installation. That is why you keep Mattermost private and sign up through an SSH tunnel before you open the site to the internet.

Can I run it on an ARM server?

Mattermost's requirements list 64-bit x86 processors, so choose one of our Intel or AMD machines for it.

Is Docker or the apt package better on one server?

Both are documented by Mattermost. The apt package gives you a normal system service that ufw protects; with Docker you must bind the app's published port to 127.0.0.1 yourself, because Docker's ports bypass ufw.