How to Deploy Mattermost with Docker Compose and SSO

Mattermost is the leading open-source alternative to Slack. It looks the same, works the same, but runs on your server with unlimited message history and zero per-user costs. Here is how to deploy it with Docker Compose and single sign-on.

Step 1: Create the Docker Compose File

services:
  mattermost-db:
    image: postgres:16-alpine
    container_name: mattermost-db
    restart: unless-stopped
    volumes:
      - ./db:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: mmuser
      POSTGRES_PASSWORD: mmuser_password
      POSTGRES_DB: mattermost

  mattermost:
    image: mattermost/mattermost-team-edition:latest
    container_name: mattermost
    restart: unless-stopped
    ports:
      - "127.0.0.1:8065:8065"
    volumes:
      - ./config:/mattermost/config:rw
      - ./data:/mattermost/data:rw
      - ./logs:/mattermost/logs:rw
      - ./plugins:/mattermost/plugins:rw
      - ./client-plugins:/mattermost/client/plugins:rw
    environment:
      MM_SQLSETTINGS_DRIVERNAME: postgres
      MM_SQLSETTINGS_DATASOURCE: postgres://mmuser:mmuser_password@mattermost-db:5432/mattermost?sslmode=disable&connect_timeout=10
      MM_SERVICESETTINGS_SITEURL: https://chat.yourdomain.com

Step 2: Configure the Reverse Proxy

In Nginx Proxy Manager, add a proxy host for chat.yourdomain.com pointing to mattermost:8065. Enable WebSocket support. Request an SSL certificate.

Step 3: Configure Outgoing Email

Mattermost sends email for account verification, password reset, and notification digests. Configure SMTP in the Mattermost System Console under Environment, SMTP:

• SMTP Server: smtp.yourdomain.com
• SMTP Port: 587
• Enable SMTP Authentication
• Connection Security: STARTTLS

Step 4: Integrate with Authelia for SSO

In the Mattermost System Console under Authentication, enable OpenID Connect. Enter your Authelia OIDC discovery endpoint. Mattermost will redirect unauthenticated users to Authelia for login. After authentication, Authelia redirects them back to Mattermost with their identity verified.

With SSO enabled, your team logs into Mattermost with the same credentials they use for everything else. No separate password. No separate login page.

Step 5: Create Your Team and Channels

After SSO is working, create channels that mirror your team's communication structure:

• Public channels: Town Square (company-wide announcements), General (day-to-day discussion), Random (off-topic)
• Team channels: Marketing, Sales, Engineering, Support
• Project channels: One per active project. Archive when complete
• Private channels: Leadership (sensitive strategy discussions), HR (personnel matters)

Maintenance

Mattermost updates are released monthly. To update:

docker compose pull mattermost
docker compose up -d mattermost

The update takes 30 seconds and preserves all data, channels, and messages. Run updates during off-hours. The service is unavailable for less than one minute.

If you would rather spend your time on your business than on chat server updates, VPS1 deploys and maintains Mattermost for you. SSO, backups, and updates included. Your team gets Slack-quality chat. You get zero maintenance overhead.