mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
Remove unreviewed IA-redesign content, restructure air-gapped docs from legacy source (#37674)
* Remove unreviewed IA-redesign content, restructure air-gapped docs from legacy source The docs-experimental -> monorepo migration (#37330) brought in draft scaffolding from a proposed IA redesign that was never reviewed and has no basis in the legacy Sphinx docs or the actual product. This removes it and, where a real legacy page existed, rebuilds the content from that source instead. Removed (no legacy-docs equivalent, entirely speculative): - administration-guide/upgrade/upgrade-v11.mdx - a per-major-version upgrade guide "stub" with literal placeholder text ("*Per-release, version-specific procedure authored by release-management team.*"); this per-version guide concept never existed in the old docs. - deployment-guide/air-gapped-operations/offline-license-activation.mdx - fabricated procedure and config-setting claims with no legacy source and no verification against the product. - security-guide/compliance-frameworks/fedramp-moderate.mdx - a live "in-process" FedRAMP authorization badge and NIST 800-53 control mapping table that was never reviewed or signed off by compliance/ legal. Restructured from the legacy air-gapped-deployment.rst content (real, previously-published guidance, just reorganized into smaller pages): - air-gapped-operations/index.mdx - high-level overview, dropped the invented "Persona scope" note, "Roadmap (Phase 2)" section, and unverified deployment contexts (DoD SIPRNet/JWICS, sovereign-cloud, tactical-edge/DDIL) that had no basis in the legacy docs. - air-gapped-operations/quick-start-runbook.mdx - replaced the fabricated (and off-by-one) "12 steps" with the legacy RST's actual 6-step deployment overview. - air-gapped-operations/mirror-package-repositories.mdx - replaced invented artifact/registry guidance with the legacy Bill of Materials, Plugins, SSL/TLS, and registry-mirroring setup content. - air-gapped-operations/disable-phone-home-features.mdx - replaced the invented "phone-home inventory" table (unverified config.json key names) with the legacy doc's actual per-feature configuration guidance (push notifications, email, link previews, GIF picker, notices, telemetry). Also fixed every cross-reference broken by the above (persona landing pages under for/, the compliance-frameworks index, DISA STIG and DoD IL4/IL5 pages, and a few deployment-guide pages that linked to the removed/renamed content). The broader for/ persona-landing-page tree and the DISA STIG / DoD IL4-5 compliance pages still reference the same unreviewed IA redesign and need a follow-up pass, but are out of scope for this change. * Soften DISA STIG customer-responsibility wording on DoD IL4/IL5 link "Validated configuration guidance" overstated what the linked DoD IL4/IL5 page actually provides (a documented control mapping, not a third-party-validated one). Matches the "documents the gap honestly" framing already used elsewhere on these compliance pages. --------- Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
Eva Sarafianou
committed by
GitHub
GitHub
co-authored by
Hanzo Dev
Hanzo Dev
parent
d3ed609ab9
commit
e90fa787f5
@@ -1,43 +0,0 @@
|
||||
---
|
||||
title: Upgrade Guide v11
|
||||
sidebar_position: 20
|
||||
description: Operator-facing upgrade procedure for moving a Mattermost cluster to v11.
|
||||
slug: /upgrade-guide/upgrade-v11
|
||||
---
|
||||
|
||||
<EditionAvailability tiers="free,professional,enterprise,enterprise-advanced" />
|
||||
<DeploymentAvailability modes="self-hosted,air-gapped" />
|
||||
|
||||
# Upgrade Guide v11
|
||||
|
||||
Per-major-version upgrade guides give operators a single canonical procedure for moving a Mattermost cluster to that major version. This page focuses on the operator runbook; see the [v11 Changelog](../../product-overview/mattermost-v11-changelog.mdx) for commit-level release notes.
|
||||
|
||||
URL convention: `/upgrade-guide/upgrade-v{X.Y}/` (Grafana pattern). Predictable, deep-linkable, per-version.
|
||||
|
||||
:::note[Status]
|
||||
This page is a stub seeded by the IA redesign Phase 1 (see `docs/_redesign/proposed-ia.md` §6 in the repo). Content authored by the release-management + technical-writing team.
|
||||
:::
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- Confirm the source version is within the supported upgrade matrix. See [Important Upgrade Notes](/administration-guide/upgrade/important-upgrade-notes) for non-sequential upgrade paths.
|
||||
- Read [Prepare to Upgrade Mattermost](./prepare-to-upgrade-mattermost.mdx).
|
||||
- For air-gapped deployments, stage the v11 release artifacts following [Air-Gapped Quick-Start Runbook](../../deployment-guide/air-gapped-operations/quick-start-runbook) steps 1–3.
|
||||
|
||||
## Procedure
|
||||
|
||||
*Per-release, version-specific procedure authored by release-management team.*
|
||||
|
||||
## Validation
|
||||
|
||||
*Post-upgrade verification checklist.*
|
||||
|
||||
## Rollback
|
||||
|
||||
*Documented rollback procedure for this version, if any. See [Downgrading Mattermost Server](./downgrading-mattermost-server.mdx) for cross-version downgrade guidance.*
|
||||
|
||||
## Related
|
||||
|
||||
- [v11 Changelog](../../product-overview/mattermost-v11-changelog.mdx) — commit-level release notes.
|
||||
- [Important Upgrade Notes](/administration-guide/upgrade/important-upgrade-notes) — version-by-version notes for non-sequential upgrades.
|
||||
- [Upgrading Mattermost Server](./upgrading-mattermost-server.mdx) — general upgrade procedure (cross-version).
|
||||
@@ -1,90 +1,36 @@
|
||||
---
|
||||
title: Disable Phone-Home Features
|
||||
sidebar_position: 4
|
||||
description: Complete inventory of outbound network calls Mattermost makes, and the settings to disable each one for air-gapped operation.
|
||||
title: Configure for Air-Gapped Operation
|
||||
sidebar_position: 3
|
||||
description: Server settings that depend on internet access and should be disabled or adjusted for an air-gapped deployment.
|
||||
---
|
||||
|
||||
<EditionAvailability tiers="free,professional,enterprise,enterprise-advanced" />
|
||||
<DeploymentAvailability modes="self-hosted,air-gapped" />
|
||||
|
||||
# Disable Phone-Home Features
|
||||
# Configure for Air-Gapped Operation
|
||||
|
||||
Mattermost makes a small set of outbound network calls during normal operation. In an air-gapped enclave these calls fail silently — they do not affect functionality, but they pollute egress logs and may trigger boundary alerts. Disable each one explicitly so the cluster makes **zero** unexpected outbound connections.
|
||||
After successful deployment, you'll need to configure Mattermost for air-gapped operation. The following sections describe features that rely on internet access and offer recommendations for settings.
|
||||
|
||||
This page is the **single canonical inventory** of phone-home behavior. Every outbound call Mattermost initiates from the server process is listed below with its purpose, target, and the setting that disables it.
|
||||
## Mobile push notifications
|
||||
|
||||
:::important[Use this list as a checklist]
|
||||
Run through every row of the table below as a Day-1 task. After the cluster is up, packet-capture at the enclave boundary should show no outbound connections to any of the targets listed.
|
||||
:::
|
||||
Mattermost can use mobile push notifications to notify users of new messages and activity. These notifications require a server component to be deployed to send the notifications to mobile devices. By default, Mattermost uses the public push notification service, which isn't available in an air-gapped environment. We recommend disabling push notifications in **System Console > Environment > [Push Notification Server](/administration-guide/configure/environment-configuration-settings#push-notification-server)**.
|
||||
|
||||
## Outbound call inventory
|
||||
## Email
|
||||
|
||||
| Feature | Outbound target | Disable in `config.json` |
|
||||
|---|---|---|
|
||||
| Anonymous diagnostics telemetry | `telemetry.mattermost.com` | `LogSettings.EnableDiagnostics = false` |
|
||||
| Security update notifications | `security.mattermost.com` | `ServiceSettings.EnableSecurityFixAlert = false` |
|
||||
| Plugin Marketplace catalog | `api.integrations.mattermost.com` | `PluginSettings.EnableMarketplace = false` |
|
||||
| Automated license utilization reporting | `customers.mattermost.com` | `ServiceSettings.EnableLicenseReporting = false` *(see [Offline License Activation](./offline-license-activation))* |
|
||||
| In-product version check | `releases.mattermost.com` | `ServiceSettings.EnableLatestVersionCheck = false` |
|
||||
| In-product notices feed | `notices.mattermost.com` | `AnnouncementSettings.AdminNoticesEnabled = false` and `AnnouncementSettings.UserNoticesEnabled = false` |
|
||||
| Image proxy for inline images | varies (per-image origin) | `ImageProxySettings.Enable = false` *(in air-gapped mode, inline images from external URLs are blocked at the network layer anyway)* |
|
||||
| Outbound webhooks / slash commands | per-integration URL | Disable individual integrations in **System Console → Integrations** |
|
||||
| Apple Push Notification Service (APNs) | `api.push.apple.com` | Use mediated push proxy — *Push Notifications without Direct APNs / FCM Egress* (Phase 2) |
|
||||
| Google Firebase Cloud Messaging (FCM) | `fcm.googleapis.com` | Use mediated push proxy — Phase 2 |
|
||||
| Bleve search index download (first start) | `releases.mattermost.com` | Pre-stage Bleve index on internal mirror; see [Mirror Package Repositories](./mirror-package-repositories) |
|
||||
| Plugin install from URL | per-plugin URL | Plugins must be installed via `mmctl plugin add` from local file system; do not use URL install |
|
||||
Unless you've set up an internal air-gapped email service, we recommend disabling email invitations and email verification from **System Console > Authentication > Signup**.
|
||||
|
||||
## Recommended `config.json` snippet
|
||||
## Website link previews
|
||||
|
||||
```json
|
||||
{
|
||||
"ServiceSettings": {
|
||||
"EnableSecurityFixAlert": false,
|
||||
"EnableLicenseReporting": false,
|
||||
"EnableLatestVersionCheck": false
|
||||
},
|
||||
"LogSettings": {
|
||||
"EnableDiagnostics": false
|
||||
},
|
||||
"PluginSettings": {
|
||||
"EnableMarketplace": false
|
||||
},
|
||||
"AnnouncementSettings": {
|
||||
"AdminNoticesEnabled": false,
|
||||
"UserNoticesEnabled": false
|
||||
},
|
||||
"ImageProxySettings": {
|
||||
"Enable": false
|
||||
}
|
||||
}
|
||||
```
|
||||
Website link previews require a connection to the internet to fetch the content of the links. We recommend [disabling website link previews](/administration-guide/configure/site-configuration-settings#enable-website-link-previews) in **System Console > Site Configuration > Posts**.
|
||||
|
||||
Apply this snippet via configuration management (Ansible, Salt, etc.) rather than editing `config.json` by hand. The Mattermost Operator (Kubernetes) accepts these settings via the `MattermostInstallation` CR's `mattermostConfig` field.
|
||||
## GIF picker
|
||||
|
||||
## Cross-cutting concerns
|
||||
The GIF picker relies on a third-party service which has a dependency on external internet access. You can disable it in **System Console > Integrations > GIF**.
|
||||
|
||||
### What this does *not* disable
|
||||
## Notices
|
||||
|
||||
These settings disable **Mattermost-initiated** outbound calls. They do **not** disable:
|
||||
[In-product notices](/administration-guide/manage/in-product-notices) require internet access to periodically inform administrators and end users of new product improvements, features, and releases. You can disable notices in **System Console > Site Configuration > Notices**.
|
||||
|
||||
- **OS-level callbacks** (NTP, DNS, distribution-package updaters). Manage these via your OS hardening profile, not Mattermost configuration.
|
||||
- **User-initiated outbound calls** (link unfurling when a user pastes a public URL into a channel). Mattermost respects the enclave's network policy here — link unfurling will simply fail.
|
||||
- **Plugin-initiated outbound calls**. Each plugin has its own outbound behavior. Audit each plugin you install. The Mattermost Calls plugin in particular requires careful egress configuration; see [Calls Deployment](/administration-guide/configure/calls-deployment-guide).
|
||||
## Telemetry
|
||||
|
||||
### Verification
|
||||
|
||||
After applying the snippet and restarting Mattermost:
|
||||
|
||||
1. Tail the server log for one hour during steady-state traffic.
|
||||
2. Grep the log for any of the disabled targets:
|
||||
```
|
||||
grep -E '(telemetry|security|releases|notices|customers|api.integrations)\.mattermost\.com' mattermost.log
|
||||
```
|
||||
Expected output: **none**.
|
||||
3. Run a packet capture at the enclave boundary for one hour. Confirm zero connections to any row of the table above.
|
||||
|
||||
If any outbound call is observed despite the settings being applied, file a security issue at `[email protected]`. In an air-gapped enclave, you may need to send this out-of-band via your security liaison.
|
||||
|
||||
## Reference
|
||||
|
||||
This page consolidates phone-home behavior previously scattered across multiple admin configuration pages. The canonical home for this inventory is here under Air-Gapped Operations because the Air-Gapped Operator persona (`docs/_redesign/personas.md` §4 in the repo) is the primary consumer.
|
||||
To avoid log errors, we recommend disabling [telemetry-related features](/administration-guide/manage/telemetry), including the security update check, and error and diagnostics reporting features.
|
||||
|
||||
@@ -1,34 +1,26 @@
|
||||
---
|
||||
title: Air-Gapped Operations
|
||||
sidebar_position: 5
|
||||
description: Deploy and operate Mattermost in network-isolated enclaves — air-gapped, sovereign-cloud, and tactical-edge environments.
|
||||
description: Deploy and operate Mattermost in a self-hosted air-gapped environment with no direct internet access.
|
||||
---
|
||||
|
||||
<EditionAvailability tiers="enterprise,enterprise-advanced" />
|
||||
<DeploymentAvailability modes="self-hosted,air-gapped,tactical-edge,cloud-government" />
|
||||
<EditionAvailability tiers="free,professional,enterprise,enterprise-advanced" />
|
||||
<DeploymentAvailability modes="self-hosted,air-gapped" />
|
||||
|
||||
# Air-Gapped Operations
|
||||
|
||||
This section is for operators deploying Mattermost in **network-isolated enclaves** — environments with no egress to public networks, no DNS to public resolvers, no upstream package mirrors, and no telemetry. Typical contexts: DoD SIPRNet / JWICS, IL4 / IL5 enclaves, sovereign-cloud (AWS GovCloud, Azure Government), and forward-deployed tactical edges with DDIL (Disconnected, Intermittent, Limited bandwidth) connectivity.
|
||||
An air-gapped environment is one that's isolated from the public internet, requiring all necessary components to be available locally. This section outlines what you'll need to deploy and operate Mattermost in a self-hosted air-gapped environment — preparation, deployment guidance, and the configuration changes required for a successful deployment.
|
||||
|
||||
Mattermost runs fully in air-gapped mode. The procedure differs from a connected install in five ways: package mirroring, offline license activation, disabling phone-home features, push-notification mediation, and audit-log export topology. Each is documented below.
|
||||
Deploying Mattermost in an air-gapped environment requires preparing all necessary software, container images, and configuration resources in advance, since the target system has no direct internet access; transferring these artifacts to the isolated network using secure media; and then installing, configuring, and validating the deployment within the air-gapped environment.
|
||||
|
||||
:::note[Persona scope]
|
||||
This sub-tree is the canonical home for the **Air-Gapped Operator** persona (see `docs/_redesign/personas.md` §4 in the repo). Companion pages for **Security Architects** live under Security & Compliance; compliance machinery for **Compliance Officers** lives under Administration Guide → Comply.
|
||||
:::
|
||||
<Tip>
|
||||
|
||||
Consider [talking to a Mattermost expert](https://mattermost.com/contact-sales/) if your organization needs support deploying Mattermost and supporting services in an air-gapped environment.
|
||||
|
||||
</Tip>
|
||||
|
||||
## In this section
|
||||
|
||||
- [Quick-Start Runbook](/deployment-guide/air-gapped-operations/quick-start-runbook) — 12-step procedure to stand up a working air-gapped Mattermost cluster from scratch.
|
||||
- [Mirror Package Repositories](/deployment-guide/air-gapped-operations/mirror-package-repositories) — internal Linux package + container registry topology and trust setup.
|
||||
- [Offline License Activation](/deployment-guide/air-gapped-operations/offline-license-activation) — activate Enterprise / Enterprise Advanced licenses without phoning home to `mattermost.com`.
|
||||
- [Disable Phone-Home Features](/deployment-guide/air-gapped-operations/disable-phone-home-features) — inventory of every outbound network call Mattermost makes and how to disable it in air-gapped mode.
|
||||
|
||||
## Roadmap (Phase 2)
|
||||
|
||||
Phase 2 of the IA redesign (see `docs/_redesign/proposed-ia.md` §6 in the repo) adds four more pages:
|
||||
|
||||
- Push Notifications without Direct APNs / FCM Egress
|
||||
- Air-Gapped Upgrade Procedure
|
||||
- Audit Log Export to Air-Gapped SIEM
|
||||
- Tactical Edge / DDIL Operations
|
||||
- [Deployment Overview](/deployment-guide/air-gapped-operations/quick-start-runbook) — the high-level steps to prepare for and complete an air-gapped install.
|
||||
- [Bill of Materials and Registry Mirroring](/deployment-guide/air-gapped-operations/mirror-package-repositories) — what to gather before you cross the air gap, and how to set up a private package mirror or container registry.
|
||||
- [Configure for Air-Gapped Operation](/deployment-guide/air-gapped-operations/disable-phone-home-features) — server settings that depend on internet access and should be disabled or adjusted.
|
||||
|
||||
@@ -1,66 +1,375 @@
|
||||
---
|
||||
title: Mirror Package Repositories
|
||||
title: Bill of Materials and Registry Mirroring
|
||||
sidebar_position: 2
|
||||
description: Stand up internal Linux package mirrors and container registries that host Mattermost artifacts inside the enclave.
|
||||
description: Gather the packages, images, and certificates you need before crossing the air gap, and set up a private registry or package mirror.
|
||||
---
|
||||
|
||||
import Tabs from '@theme/Tabs';
|
||||
|
||||
<EditionAvailability tiers="free,professional,enterprise,enterprise-advanced" />
|
||||
<DeploymentAvailability modes="self-hosted,air-gapped" />
|
||||
|
||||
# Mirror Package Repositories
|
||||
# Bill of Materials and Registry Mirroring
|
||||
|
||||
In an air-gapped enclave, every package and container image Mattermost depends on must come from a mirror inside the enclave. There is no fall-through to upstream registries. This page enumerates the artifacts that need mirroring and the trust topology that ties them together.
|
||||
On an internet-connected machine, you must gather all required packages, container images, and dependencies needed for the installation process. The resources you'll need will depend on your deployment method.
|
||||
|
||||
## What needs mirroring
|
||||
## Bill of materials
|
||||
|
||||
### Linux distribution packages
|
||||
<Tabs>
|
||||
<TabItem value="linux" label="Linux">
|
||||
|
||||
Mirror the upstream Linux package repositories for the OS image you run Mattermost on. Mattermost requires recent versions of `glibc`, `ca-certificates`, and (for plugins) `ImageMagick` and `xpdf-utils`. PostgreSQL is the only supported database for new installs.
|
||||
Using our provided tarball is recommended as the simplest installation method for air-gapped environments. You can install the Mattermost Server in a few minutes on any air-gapped 64-bit Linux system.
|
||||
|
||||
- **Ubuntu / Debian**: mirror the upstream `apt` repos for the release you use (e.g., `noble`, `jammy`). Tools: `apt-mirror`, `aptly`, internal Pulp 3.
|
||||
- **RHEL / Rocky / Alma / SUSE**: mirror upstream `dnf` / `zypper` repos. Tools: `reposync`, Red Hat Satellite, Pulp.
|
||||
**Prerequisites**
|
||||
|
||||
### Mattermost release artifacts
|
||||
- [Mattermost tarball](/product-overview/version-archive). We recommend using the latest [ESR](/product-overview/release-policy#extended-support-releases) for extended support where server upgrades may be infrequent.
|
||||
- Database: PostgreSQL [installation packages](https://www.postgresql.org/download/) or container images for your Linux distribution.
|
||||
- File Storage: Local filesystem storage is sufficient for deployments under 2,000 users. For larger deployments requiring high availability, we recommend using an S3-compatible object storage solution or an NFS (Network File System) server for shared storage needs.
|
||||
- Load balancer: If you already have a load balancer running in your air-gapped environment you can skip this resource, otherwise we recommend deploying [NGINX](/deployment-guide/server/setup-nginx-proxy) from these [Linux packages](https://nginx.org/en/linux_packages.html).
|
||||
- Desktop app: Download the [required package](https://github.com/mattermost/desktop/releases) based on your deployment method.
|
||||
|
||||
Mattermost publishes three artifact families. Stage all three on your operator workstation, verify checksums and signatures, then transfer across the air gap.
|
||||
**(Optional) Supporting services**
|
||||
|
||||
| Artifact | Source | Verification |
|
||||
|---|---|---|
|
||||
| Server tarball (`mattermost-VERSION-linux-amd64.tar.gz`) | `releases.mattermost.com` | SHA-256 + PGP signature |
|
||||
| Container images (`mattermost/mattermost-enterprise-edition:VERSION`, `mattermost/mattermost-mobile-push-proxy:VERSION`) | Docker Hub | Image digest (`sha256:…`) |
|
||||
| Mattermost Operator Helm chart | `chartmuseum.mattermost.com` | SHA-256 of `.tgz` |
|
||||
Consider downloading these additional resources if you plan to enable these optional components:
|
||||
|
||||
### Plugin and integration artifacts
|
||||
- [Mattermost Calls](/administration-guide/configure/calls-deployment-guide): [mattermost-calls-offloader](https://github.com/mattermost/calls-offloader/releases) (required for recording, transcription, and live captions) and [mattermost-rtcd](https://github.com/mattermost/rtcd/releases) (required for performance and scalability).
|
||||
- [Elasticsearch](https://www.elastic.co/downloads/elasticsearch) can be [deployed](https://www.elastic.co/docs/deploy-manage/deploy/self-managed/installing-elasticsearch) for enhanced search performance at scale.
|
||||
- [Prometheus](https://prometheus.io/download/) and [Grafana](https://grafana.com/grafana/download) for monitoring and observability.
|
||||
|
||||
Pre-built plugins ship as signed `.tar.gz` files from the Mattermost Marketplace. Stage the bundle of plugins you intend to install (e.g., Channel Export, Legal Hold, Calls, AI Agents) before the air-gap transfer.
|
||||
</TabItem>
|
||||
<TabItem value="kubernetes" label="Kubernetes">
|
||||
|
||||
:::important
|
||||
The Mattermost Marketplace itself **cannot reach your enclave**. After air-gapped install, the Marketplace UI surface is disabled (see [Disable Phone-Home Features](./disable-phone-home-features)). Plugins are installed via `mmctl plugin add` from the local file system.
|
||||
:::
|
||||
Kubernetes is recommended for a highly scalable and robust deployment if your organization is already running a Kubernetes cluster in the air-gapped environment.
|
||||
|
||||
## Internal container registry
|
||||
**Prerequisites**
|
||||
|
||||
For Kubernetes / container deployments, push the Mattermost container images to your internal registry (Harbor, Artifactory, Quay, GitLab Container Registry, AWS ECR inside GovCloud). Tag images with the same version strings you pulled upstream.
|
||||
- [Mattermost Operator](https://github.com/mattermost/mattermost-helm/tree/master/charts/mattermost-operator) and [values](https://github.com/mattermost/mattermost-helm/blob/master/charts/mattermost-operator/values.yaml).
|
||||
- Database: We recommend options such as the [Postgres Operator](https://access.crunchydata.com/documentation/postgres-operator/latest/quickstart) from Crunchy Data, [CloudNativePG](https://cloudnative-pg.io/documentation/1.27/installation_upgrade/), or [pgEdge](https://github.com/pgEdge/pgedge-helm).
|
||||
- File Storage: We recommend using an S3-compatible storage service or a mounted NFS volume for shared storage needs.
|
||||
- Load balancer: If you already have a load balancer running in your air-gapped environment you can skip this resource, otherwise we recommend deploying [NGINX](/deployment-guide/server/setup-nginx-proxy), using the [NGINX Ingress Controller operator](https://docs.nginx.com/nginx-ingress-controller/installation/installing-nic/installation-with-operator/).
|
||||
- Desktop app: Download the [required package](https://github.com/mattermost/desktop/releases) based on your deployment method.
|
||||
|
||||
Configure your Kubernetes cluster's `imagePullSecrets` to authenticate to the internal registry, and configure the Mattermost Operator Helm chart's `image.repository` value to point at the internal path (e.g., `registry.enclave.example/mattermost/mattermost-enterprise-edition`).
|
||||
**(Optional) Supporting services**
|
||||
|
||||
## Trust topology
|
||||
Consider downloading these additional resources if you plan to enable these optional components:
|
||||
|
||||
The artifact-trust chain inside the enclave depends on:
|
||||
- [Mattermost Calls](/administration-guide/configure/calls-deployment-guide) helm charts: [mattermost-calls-offloader](https://github.com/mattermost/mattermost-helm/tree/master/charts/mattermost-calls-offloader) and [values](https://github.com/mattermost/mattermost-helm/blob/master/charts/mattermost-calls-offloader/values.yaml) (required for recording, transcription, and live captions), [mattermost-rtcd](https://github.com/mattermost/mattermost-helm/tree/master/charts/mattermost-rtcd) and [values](https://github.com/mattermost/mattermost-helm/blob/master/charts/mattermost-rtcd/values.yaml) (required for performance and scalability).
|
||||
- [Elasticsearch](https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s) can be [deployed in air-gapped k8s environments](https://www.elastic.co/guide/en/cloud-on-k8s/2.8/k8s-air-gapped.html) for enhanced search performance at scale.
|
||||
- [Prometheus](https://github.com/prometheus-operator/prometheus-operator) and [Grafana](https://github.com/grafana/grafana-operator) operators for monitoring and observability.
|
||||
|
||||
1. **Your internal CA** signing the TLS certificate served by the internal package mirror and container registry.
|
||||
2. **The enclave OS trust store** including your internal CA. Without this, `apt update` / `dnf install` will fail with TLS errors.
|
||||
3. **A verified signature chain** for the Mattermost artifacts themselves. The enclave operator should verify checksums and PGP signatures *before* publishing to the internal mirror.
|
||||
</TabItem>
|
||||
<TabItem value="docker" label="Docker">
|
||||
|
||||
## Validation
|
||||
Docker can be used if you don't have a running Kubernetes cluster in the air-gapped environment, but want to use containers for simplified installation and dependency management. Docker is not recommended for production environments at high scale, as it doesn't support clustered deployments or High Availability (HA) configurations out-of-the-box.
|
||||
|
||||
After mirroring is complete:
|
||||
**Prerequisites**
|
||||
|
||||
- `apt update` (or distribution equivalent) succeeds against only the internal mirror.
|
||||
- `docker pull registry.enclave.example/mattermost/mattermost-enterprise-edition:VERSION` succeeds.
|
||||
- `helm pull oci://registry.enclave.example/charts/mattermost-operator --version VERSION` succeeds.
|
||||
- Outbound traffic capture at the enclave boundary shows **no connections to `releases.mattermost.com`, `chartmuseum.mattermost.com`, or Docker Hub** during install.
|
||||
- [Mattermost Enterprise Edition](https://hub.docker.com/r/mattermost/mattermost-enterprise-edition) image.
|
||||
- Database: [PostgreSQL](https://hub.docker.com/_/postgres) image.
|
||||
- Load balancer: If you already have a load balancer running in your air-gapped environment you can skip this resource, otherwise we recommend deploying [NGINX](/deployment-guide/server/setup-nginx-proxy) from these [images](https://hub.docker.com/_/nginx).
|
||||
- Desktop app: Download the [required package](https://github.com/mattermost/desktop/releases) based on your deployment method.
|
||||
|
||||
## Reference
|
||||
**(Optional) Supporting services**
|
||||
|
||||
This page is a stub — Phase 2 will add per-distribution `apt-mirror` / `reposync` configuration examples and a Harbor + GovCloud ECR worked example. Tracked in `docs/_redesign/proposed-ia.md` §6 in the repo.
|
||||
Consider downloading these additional resources if you plan to enable these optional components:
|
||||
|
||||
- [Mattermost Calls](/administration-guide/configure/calls-deployment-guide) images: [calls-offloader](https://hub.docker.com/r/mattermost/calls-offloader) (required for recording, transcription, and live captions) and [rtcd](https://hub.docker.com/r/mattermost/rtcd) (required for performance and scalability).
|
||||
- [Elasticsearch](https://hub.docker.com/_/elasticsearch) image for enhanced search performance at scale.
|
||||
- [Prometheus](https://hub.docker.com/r/prom/prometheus) and [Grafana](https://hub.docker.com/r/grafana/grafana) images for monitoring and observability.
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
|
||||
## Mattermost plugins
|
||||
|
||||
Mattermost includes a number of [pre-built integrations](/integrations-guide/popular-integrations) for mission-critical tools. If you'd like to use any plugins beyond those that are pre-built in the Mattermost package, you'll need to download the plugin binaries from the [Mattermost Marketplace](https://mattermost.com/marketplace/). Once you have Mattermost deployed, these plugin binaries can be uploaded directly in the System Console.
|
||||
|
||||
## SSL/TLS certificates and keys
|
||||
|
||||
If your deployment requires SSL, ensure you have the necessary certificates. This includes certificates and keys for enabling HTTPS with Mattermost, as well as any CA files or certificates needed to access internal services such as LDAP or SAML. See [Setup TLS](/deployment-guide/server/setup-tls) for configuration details.
|
||||
|
||||
## Set up a private registry or mirror
|
||||
|
||||
A private container registry securely stores the Docker images necessary for air-gapped deployments, ensuring compliance with data isolation requirements. Similarly, a private package mirror stores operating system packages necessary for air-gapped deployments in Ubuntu or RHEL/CentOS Linux environments. Setting up a local registry or mirror is a critical step in deploying Mattermost to ensure all images, dependencies, and packages are available to you in the air-gapped environment. The steps below outline the process required to set up a local registry or mirror, depending on the deployment method you are using. These steps are a rough guide, and can be supplemented with online resources depending on your specific deployment needs.
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="linux" label="Linux">
|
||||
|
||||
**(Ubuntu) Set up a private Debian package mirror**
|
||||
|
||||
We will use Aptly to create a local mirror, although you can also use other options such as debmirror.
|
||||
|
||||
1. **Install Aptly** (on an internet-connected machine):
|
||||
|
||||
```bash
|
||||
apt-get update
|
||||
apt-get install aptly gnupg
|
||||
```
|
||||
|
||||
2. **Create a GPG key for signing packages**:
|
||||
|
||||
```bash
|
||||
gpg --gen-key
|
||||
```
|
||||
|
||||
3. **Create a mirror configuration**:
|
||||
|
||||
```bash
|
||||
aptly mirror create -architectures=amd64 debian-bullseye http://deb.debian.org/debian bullseye main contrib non-free
|
||||
```
|
||||
|
||||
4. **Update the mirror to download packages**:
|
||||
|
||||
```bash
|
||||
aptly mirror update debian-bullseye
|
||||
```
|
||||
|
||||
5. **Create and publish a snapshot**:
|
||||
|
||||
```bash
|
||||
aptly snapshot create debian-bullseye-$(date +%Y%m%d) from mirror debian-bullseye
|
||||
aptly publish snapshot debian-bullseye-$(date +%Y%m%d)
|
||||
```
|
||||
|
||||
6. **Serve the repository**:
|
||||
|
||||
```bash
|
||||
aptly serve
|
||||
```
|
||||
|
||||
7. **Client configuration:** Configure apt to use your local mirror:
|
||||
|
||||
```bash
|
||||
cat > /etc/apt/sources.list << EOF
|
||||
deb http://mirror.example.com/debian bullseye main contrib non-free
|
||||
EOF
|
||||
```
|
||||
|
||||
**(RHEL/CentOS) Set up a private RHEL package mirror**
|
||||
|
||||
We will use reposync for a local mirror.
|
||||
|
||||
1. **Install required tools** (on an internet-connected RHEL system):
|
||||
|
||||
```bash
|
||||
yum install yum-utils createrepo
|
||||
```
|
||||
|
||||
2. **Download packages**:
|
||||
|
||||
```bash
|
||||
mkdir -p /var/www/html/repos/rhel8
|
||||
reposync -p /var/www/html/repos/rhel8 --download-metadata --repo=rhel-8-for-x86_64-baseos-rpms
|
||||
reposync -p /var/www/html/repos/rhel8 --download-metadata --repo=rhel-8-for-x86_64-appstream-rpms
|
||||
```
|
||||
|
||||
3. **Create repository metadata**:
|
||||
|
||||
```bash
|
||||
createrepo /var/www/html/repos/rhel8/rhel-8-for-x86_64-baseos-rpms
|
||||
createrepo /var/www/html/repos/rhel8/rhel-8-for-x86_64-appstream-rpms
|
||||
```
|
||||
|
||||
4. **Set up a web server**:
|
||||
|
||||
```bash
|
||||
yum install httpd
|
||||
systemctl enable httpd
|
||||
systemctl start httpd
|
||||
```
|
||||
|
||||
5. **Client configuration:** Disable existing repositories:
|
||||
|
||||
```bash
|
||||
cd /etc/yum.repos.d/
|
||||
mkdir backup
|
||||
mv *.repo backup/
|
||||
```
|
||||
|
||||
6. **Client configuration:** Create new repository files:
|
||||
|
||||
```bash
|
||||
cat > /etc/yum.repos.d/local-baseos.repo << EOF
|
||||
[local-baseos]
|
||||
name=Red Hat Enterprise Linux 8 BaseOS
|
||||
baseurl=http://mirror.example.com/repos/rhel8/rhel-8-for-x86_64-baseos-rpms
|
||||
enabled=1
|
||||
gpgcheck=0
|
||||
EOF
|
||||
|
||||
cat > /etc/yum.repos.d/local-appstream.repo << EOF
|
||||
[local-appstream]
|
||||
name=Red Hat Enterprise Linux 8 AppStream
|
||||
baseurl=http://mirror.example.com/repos/rhel8/rhel-8-for-x86_64-appstream-rpms
|
||||
enabled=1
|
||||
gpgcheck=0
|
||||
EOF
|
||||
```
|
||||
|
||||
7. **Client configuration:** Clear cache and test:
|
||||
|
||||
```bash
|
||||
yum clean all
|
||||
yum repolist
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="kubernetes" label="Kubernetes">
|
||||
|
||||
**Set up a self-hosted private container registry**
|
||||
|
||||
1. **Install Docker Registry**:
|
||||
|
||||
```bash
|
||||
docker run -d -p 5000:5000 --restart=always --name registry registry:2
|
||||
```
|
||||
|
||||
2. **Configure persistent storage**:
|
||||
|
||||
```bash
|
||||
docker run -d -p 5000:5000 --restart=always --name registry \
|
||||
-v /mnt/registry:/var/lib/registry \
|
||||
registry:2
|
||||
```
|
||||
|
||||
3. **Add TLS security** (recommended):
|
||||
|
||||
a. Generate self-signed certificates:
|
||||
|
||||
```bash
|
||||
mkdir -p certs
|
||||
openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
|
||||
-x509 -days 365 -out certs/domain.crt
|
||||
```
|
||||
|
||||
b. Run the registry with TLS:
|
||||
|
||||
```bash
|
||||
docker run -d -p 5000:5000 --restart=always --name registry \
|
||||
-v /mnt/registry:/var/lib/registry \
|
||||
-v $(pwd)/certs:/certs \
|
||||
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
|
||||
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
|
||||
registry:2
|
||||
```
|
||||
|
||||
**Configure Kubernetes to use private image registries**
|
||||
|
||||
When using Kubernetes in an air-gapped environment, you need to configure it to use your private registry.
|
||||
|
||||
1. **Create a Kubernetes secret for registry authentication**:
|
||||
|
||||
```bash
|
||||
kubectl create secret docker-registry regcred \
|
||||
--docker-server=registry.example.com:5000 \
|
||||
--docker-username=your_username \
|
||||
--docker-password=your_password \
|
||||
[email protected]
|
||||
```
|
||||
|
||||
2. **Reference the secret in pod specifications**:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: mattermost-pod
|
||||
spec:
|
||||
containers:
|
||||
- name: mattermost
|
||||
image: registry.example.com:5000/mattermost/mattermost-enterprise-edition:latest
|
||||
imagePullSecrets:
|
||||
- name: regcred
|
||||
```
|
||||
|
||||
3. **For Helm deployments**, specify the registry in `values.yaml`:
|
||||
|
||||
```yaml
|
||||
image:
|
||||
repository: registry.example.com:5000/mattermost/mattermost-enterprise-edition
|
||||
tag: latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
imagePullSecrets:
|
||||
- name: regcred
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="docker" label="Docker">
|
||||
|
||||
**Set up a self-hosted private container registry**
|
||||
|
||||
1. **Install Docker Registry**:
|
||||
|
||||
```bash
|
||||
docker run -d -p 5000:5000 --restart=always --name registry registry:2
|
||||
```
|
||||
|
||||
2. **Configure persistent storage**:
|
||||
|
||||
```bash
|
||||
docker run -d -p 5000:5000 --restart=always --name registry \
|
||||
-v /mnt/registry:/var/lib/registry \
|
||||
registry:2
|
||||
```
|
||||
|
||||
3. **Add TLS security** (recommended):
|
||||
|
||||
a. Generate self-signed certificates:
|
||||
|
||||
```bash
|
||||
mkdir -p certs
|
||||
openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
|
||||
-x509 -days 365 -out certs/domain.crt
|
||||
```
|
||||
|
||||
b. Run the registry with TLS:
|
||||
|
||||
```bash
|
||||
docker run -d -p 5000:5000 --restart=always --name registry \
|
||||
-v /mnt/registry:/var/lib/registry \
|
||||
-v $(pwd)/certs:/certs \
|
||||
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
|
||||
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
|
||||
registry:2
|
||||
```
|
||||
|
||||
**Populate your private registry**
|
||||
|
||||
Ensure the required images from the [Bill of Materials](#bill-of-materials) are downloaded and pushed to the private registry.
|
||||
|
||||
**Configure Docker to use private image registries**
|
||||
|
||||
Configure Docker on all hosts to trust and use your private registry.
|
||||
|
||||
1. **Add your registry to Docker's trusted registries**:
|
||||
|
||||
Edit or create `/etc/docker/daemon.json`:
|
||||
|
||||
```json
|
||||
{
|
||||
"insecure-registries": ["registry.example.com:5000"]
|
||||
}
|
||||
```
|
||||
|
||||
For registries using self-signed certificates:
|
||||
|
||||
```bash
|
||||
mkdir -p /etc/docker/certs.d/registry.example.com:5000
|
||||
cp domain.crt /etc/docker/certs.d/registry.example.com:5000/ca.crt
|
||||
```
|
||||
|
||||
2. **Restart Docker daemon**:
|
||||
|
||||
```bash
|
||||
systemctl restart docker
|
||||
```
|
||||
|
||||
3. **Test the configuration**:
|
||||
|
||||
```bash
|
||||
docker pull registry.example.com:5000/mattermost/mattermost-enterprise-edition:latest
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
|
||||
@@ -1,64 +0,0 @@
|
||||
---
|
||||
title: Offline License Activation
|
||||
sidebar_position: 3
|
||||
description: Activate Mattermost Enterprise or Enterprise Advanced licenses inside an enclave without phoning home.
|
||||
---
|
||||
|
||||
<EditionAvailability tiers="enterprise,enterprise-advanced" />
|
||||
<DeploymentAvailability modes="self-hosted,air-gapped,cloud-government" />
|
||||
|
||||
# Offline License Activation
|
||||
|
||||
In a connected install, Mattermost activates Enterprise licenses by contacting `customers.mattermost.com` and validating the license signature against Mattermost's signing key. In an air-gapped enclave, that callback is impossible.
|
||||
|
||||
Offline activation produces a **license file** that is signed by Mattermost's customer-success team and validated locally by the Mattermost server using a pre-installed public key. No network access is required at activation time.
|
||||
|
||||
## Procedure
|
||||
|
||||
1. **Open a license request with Mattermost Customer Success** through your standard support channel. Provide:
|
||||
- The Mattermost server version you'll install (e.g., `v10.5.0`).
|
||||
- The expected user count (must match your purchased seat count).
|
||||
- Your enclave's clock authority (so the license `IssuedAt` is sensible relative to your NTP source).
|
||||
- Whether the deployment requires the **FIPS-compliant container image** (see [FIPS / STIG container builds](../server/containers/fips-stig)).
|
||||
2. **Receive a signed `mattermost.license` file** out-of-band (typically encrypted email, customer portal download, or shipped on physical media for sovereign-cloud deployments).
|
||||
3. **Transfer the license across the air gap** using your approved transfer mechanism. Verify the file SHA-256 hash on both sides.
|
||||
4. **Install the license** on the running Mattermost server:
|
||||
```
|
||||
mmctl license upload /path/to/mattermost.license
|
||||
```
|
||||
Or via the System Console: **System Console → Edition and License → Upload Mattermost License File**.
|
||||
5. **Verify activation**:
|
||||
```
|
||||
mmctl license status
|
||||
```
|
||||
The output should list the licensee, expiration, and active feature set.
|
||||
|
||||
## License lifecycle in air-gapped mode
|
||||
|
||||
| Event | Connected install | Air-gapped install |
|
||||
|---|---|---|
|
||||
| Initial activation | Online callback to `customers.mattermost.com` | Local validation of pre-signed `.license` file |
|
||||
| Renewal | Automatic prompt 60 days before expiry | Manual: customer-success issues new file; operator re-uploads |
|
||||
| Automated utilization reporting | Daily POST to `customers.mattermost.com` | **Disabled** — Mattermost does not contact `customers.mattermost.com` from inside the enclave. Reporting is done manually at renewal. |
|
||||
|
||||
:::important[Automated license utilization reporting must be disabled]
|
||||
The `EnableLicenseReporting` server setting must be set to `false` in `config.json`. Otherwise, Mattermost attempts (and silently fails) a daily POST to `customers.mattermost.com`. The failure does not affect functionality, but it pollutes egress logs and triggers boundary alerts. See [Disable Phone-Home Features](./disable-phone-home-features).
|
||||
:::
|
||||
|
||||
## License signature verification
|
||||
|
||||
Mattermost server ships with the public key used to verify license signatures embedded in the binary. There is no need to import or trust an additional key.
|
||||
|
||||
If license validation fails after upload, the server logs an explicit error message. Common causes:
|
||||
|
||||
- **Clock skew**: enclave clock is more than 5 minutes off from the license `IssuedAt`. Fix your NTP source.
|
||||
- **Version mismatch**: the license was issued for a different Mattermost major version than the one installed. Re-request from customer success.
|
||||
- **Tampering**: SHA-256 hash of the license file changed during air-gap transfer. Re-transfer.
|
||||
|
||||
## Renewal cadence
|
||||
|
||||
Mattermost Enterprise licenses are typically 12-month terms. In air-gapped mode, plan for license renewal **60 days before expiry** to allow time for customer-success issuance + air-gap transfer. Expired licenses degrade Mattermost to free-tier features; they do not lock the server.
|
||||
|
||||
## Reference
|
||||
|
||||
This page is a stub — Phase 2 will add a worked example for sovereign-cloud (GovCloud) deployments where the license file is delivered via the customer portal rather than out-of-band. Tracked in `docs/_redesign/proposed-ia.md` §6 in the repo.
|
||||
@@ -1,53 +1,32 @@
|
||||
---
|
||||
title: Quick-Start Runbook
|
||||
title: Deployment Overview
|
||||
sidebar_position: 1
|
||||
description: 12-step procedure to stand up a working Mattermost cluster in an air-gapped enclave from scratch.
|
||||
description: The high-level steps to prepare for and complete a self-hosted air-gapped Mattermost deployment.
|
||||
---
|
||||
|
||||
<EditionAvailability tiers="enterprise,enterprise-advanced" />
|
||||
<EditionAvailability tiers="free,professional,enterprise,enterprise-advanced" />
|
||||
<DeploymentAvailability modes="self-hosted,air-gapped" />
|
||||
|
||||
# Air-Gapped Quick-Start Runbook
|
||||
# Air-Gapped Deployment Overview
|
||||
|
||||
This runbook brings a Mattermost cluster online inside a network-isolated enclave. It assumes you are the **deploying operator** with administrative access to the enclave's package mirror, container registry, certificate authority, and DNS.
|
||||
This is a summary of the steps involved in deploying Mattermost in an air-gapped environment.
|
||||
|
||||
:::important[Prerequisites]
|
||||
- An enclave with internal-only DNS, an internal package mirror (Linux distro repos), and an internal container registry (Harbor / Artifactory / equivalent).
|
||||
- An offline-activatable Enterprise or Enterprise Advanced license — see [Offline License Activation](./offline-license-activation).
|
||||
- A staged Mattermost Server release tarball + checksums verified out-of-band, and a Mattermost Operator Helm chart (Kubernetes) or Linux package (`.deb` / `.rpm`).
|
||||
- A PostgreSQL database reachable from the Mattermost host(s) inside the enclave.
|
||||
- An NTP source reachable from inside the enclave.
|
||||
:::
|
||||
1. **Select your preferred Mattermost deployment option.** This step is often dictated by the infrastructure already running in your air-gapped environment. If you're deploying from scratch, review our [server deployment documentation](/deployment-guide/server/server-deployment-planning#deployment-options) to select the optimal option given your organization's needs.
|
||||
|
||||
## The 12 steps
|
||||
2. **Set up a private container registry or package mirror.** Ideally the air-gapped environment already has a private container registry or package mirror available. If not, see [Bill of Materials and Registry Mirroring](./mirror-package-repositories) for setup guidance.
|
||||
|
||||
1. **Stage the release artifacts on the operator workstation.** Download the Mattermost Server tarball, container images, Helm chart, and Vale + plugin assets from `releases.mattermost.com` on an internet-connected workstation. Verify SHA-256 checksums and PGP signatures against the published list. *Never* let a non-verified artifact cross the air gap.
|
||||
2. **Transfer artifacts across the air gap.** Use the enclave's approved transfer mechanism (one-way diode, manual media, or cross-domain solution). Re-verify checksums on the enclave side before staging in the internal mirror.
|
||||
3. **Publish artifacts to the internal package mirror and container registry.** Mirror the Linux package repos (Ubuntu, RHEL, SLES — whichever your hosts use) and push container images (e.g., `mattermost/mattermost-enterprise-edition`, `mattermost/mattermost-mobile-push-proxy`) to the internal registry. Tag images with the same version strings published upstream.
|
||||
4. **Provision PostgreSQL.** Provision the database inside the enclave per [Reference Architecture](/deployment-guide/reference-architecture/reference-architecture-index). Set `max_connections`, `shared_buffers`, and `effective_cache_size` per the [scale tier](/deployment-guide/reference-architecture/reference-architecture-index) you're targeting.
|
||||
5. **Configure DNS and TLS inside the enclave.** Create an internal DNS A record for the Mattermost host (e.g., `mattermost.enclave.example`). Issue a TLS certificate from your internal CA. Configure NGINX or your reverse proxy with [TLS](../server/setup-tls.mdx).
|
||||
6. **Install the Mattermost binary.** Install on Linux ([deploy-linux](../server/deploy-linux.mdx)), Kubernetes via the Mattermost Operator ([deploy-kubernetes](../server/deploy-kubernetes.mdx)), or containers ([deploy-containers](../server/deploy-containers.mdx)). Point image references at your internal registry, not Docker Hub.
|
||||
7. **Apply the air-gapped configuration profile.** See [Disable Phone-Home Features](./disable-phone-home-features) for the complete list. At minimum, disable: `EnableDiagnostics`, `EnableSecurityFixAlert`, `EnableMarketplace`, automated license utilization reporting, image proxy, and the in-product version check.
|
||||
8. **Activate the license.** Apply the offline license file produced by the Customer Account team — see [Offline License Activation](./offline-license-activation).
|
||||
9. **Mediate push notifications.** Apple APNs and Google FCM are reachable only from internet-connected networks. Deploy a mediated push proxy at your enclave boundary; see *Push Notifications without Direct APNs / FCM Egress* (Phase 2).
|
||||
10. **Configure NTP.** Mattermost relies on accurate clocks for token validation, audit-log timestamps, and rate-limiting. Point hosts at the enclave's internal NTP source.
|
||||
12. **Verify and run smoke tests.** Confirm the cluster passes the [post-install verification checklist](../server/server-deployment-planning.mdx). Run a manual smoke: log in as system admin, create a team, send a message, install one bundled plugin, trigger an audit-log export.
|
||||
3. **Prepare your Bill of Materials.** Depending on your deployment method, you'll need to download, tag, and push required materials into your private registry or mirror.
|
||||
|
||||
## Validation
|
||||
4. **Transfer materials into the air-gapped environment.** If the private registry cannot access the public internet, you can prepare an archive of the registry data on your internet-connected machine and securely transfer it using approved data transfer methods — for example, burning to a disk.
|
||||
|
||||
After completing all 12 steps, your air-gapped cluster should:
|
||||
5. **Install Mattermost Server.** Once you have all the necessary resources in your air-gapped environment, you can move forward with deployment following the instructions for [Linux](/deployment-guide/server/deploy-linux), [Kubernetes](/deployment-guide/server/deploy-kubernetes), or [Docker](/deployment-guide/server/deploy-containers).
|
||||
|
||||
- Reach the in-product login page over TLS from inside the enclave.
|
||||
- Authenticate users against your internal directory (AD/LDAP, SAML, OIDC) — no public IdP.
|
||||
- Make **no outbound DNS queries to public resolvers** during steady-state operation. Verify with packet capture at the enclave boundary.
|
||||
- Show no "Mattermost installation telemetry" or "Marketplace pings" in egress logs.
|
||||
6. **Install Mattermost Desktop Apps.** Since air-gapped devices cannot access the publicly available app stores, you'll need to install the apps directly from the latest [packages available on our GitHub release page](https://github.com/mattermost/desktop/releases). You'll find [installation instructions](/deployment-guide/desktop/desktop-app-deployment) in our documentation based on your desired deployment method.
|
||||
|
||||
## What this runbook does *not* cover
|
||||
7. **Configure Mattermost for air-gapped operation.** See [Configure for Air-Gapped Operation](./disable-phone-home-features) for the settings that accommodate the lack of internet access.
|
||||
|
||||
- **Hardening beyond the install procedure** — see [Security & Compliance → Hardening Guides](../../security-guide/security-guide-index.mdx).
|
||||
- **Upgrade procedure for an already-installed air-gapped cluster** — see *Air-Gapped Upgrade Procedure* (Phase 2).
|
||||
- **Tactical edge / DDIL operation** — for forward-deployed nodes that sync intermittently to a parent enclave, see *Tactical Edge / DDIL Operations* (Phase 2).
|
||||
<Tip>
|
||||
|
||||
## Reference
|
||||
Consider [talking to a Mattermost expert](https://mattermost.com/contact-sales/) if your organization needs support deploying Mattermost and supporting services in an air-gapped environment.
|
||||
|
||||
This runbook is modelled on GitLab's [Offline GitLab Quick Start Guide](https://docs.gitlab.com/topics/offline/quick_start_guide/) and Red Hat OpenShift's [Disconnected installation chapter](https://docs.okd.io/4.18/installing/disconnected_install/index.html). Both treat air-gapped deployment as a first-class, runbook-shaped operation rather than a "contact sales" stub.
|
||||
</Tip>
|
||||
|
||||
@@ -20,8 +20,8 @@ Pick your scale tier, deployment type, and hosting provider. The builder below r
|
||||
|
||||
Once you've sized the architecture:
|
||||
|
||||
- For **air-gapped, sovereign-cloud, or DDIL** environments, also work through [Air-Gapped Operations](/deployment-guide/air-gapped-operations/quick-start-runbook). The architecture is the same; the install procedure and dependency-staging are different.
|
||||
- For **regulated workloads** (FedRAMP, DoD IL, DISA STIG), see [Security & Compliance → Compliance Frameworks](/security-guide/compliance-frameworks) for the configuration overlay that goes on top of the architecture choices above.
|
||||
- For **air-gapped** environments, also work through [Air-Gapped Operations](/deployment-guide/air-gapped-operations/quick-start-runbook). The architecture is the same; the install procedure and dependency-staging are different.
|
||||
- For **regulated workloads** (DoD IL, DISA STIG), see [Security & Compliance → Compliance Frameworks](/security-guide/compliance-frameworks) for the configuration overlay that goes on top of the architecture choices above.
|
||||
- For **HA tuning** (clustering, Redis configuration, multi-AZ database topology), see [High Availability cluster-based deployment](/administration-guide/scale/high-availability-cluster-based-deployment).
|
||||
- For **specific install paths**, jump to [Install on Linux](/deployment-guide/server/deploy-linux), [Install on Kubernetes](/deployment-guide/server/deploy-kubernetes), or [Install with Containers](/deployment-guide/server/deploy-containers).
|
||||
|
||||
|
||||
@@ -48,8 +48,8 @@ Once Mattermost is running, complete these steps before exposing it to users:
|
||||
- Configure [pre-authentication secrets](/deployment-guide/server/pre-authentication-secrets) if your environment requires them.
|
||||
- Review the [post-install configuration checklist](/deployment-guide/server/server-deployment-planning) under Server deployment planning.
|
||||
|
||||
:::tip[Air-gapped environments]
|
||||
If you're deploying into a network-isolated enclave, use the [Air-Gapped Quick-Start Runbook](/deployment-guide/air-gapped-operations/quick-start-runbook) instead of the connected install paths above. The runbook adds package mirroring, offline license activation, and the phone-home-disable inventory on top of the standard install.
|
||||
:::tip Air-gapped environments
|
||||
If you're deploying into a network-isolated enclave, see [Air-Gapped Operations](/deployment-guide/air-gapped-operations/quick-start-runbook) instead of the connected install paths above. It covers package mirroring and the configuration changes needed on top of the standard install.
|
||||
:::
|
||||
|
||||
:::note[Troubleshooting]
|
||||
|
||||
@@ -68,7 +68,7 @@ Enterprise and Team Edition releases are listed in the [version archive](/produc
|
||||
|
||||
<Note title="Air-gapped installs">
|
||||
|
||||
In an air-gapped environment, stage the tarball on your operator workstation, verify the SHA-256 and PGP signature, then transfer it across the boundary. See [Air-Gapped Operations → Quick-Start Runbook](/deployment-guide/air-gapped-operations/quick-start-runbook) for the full procedure.
|
||||
In an air-gapped environment, stage the tarball on your operator workstation, verify the SHA-256 and PGP signature, then transfer it across the boundary. See [Air-Gapped Operations → Deployment Overview](/deployment-guide/air-gapped-operations/quick-start-runbook) for the full procedure.
|
||||
|
||||
</Note>
|
||||
|
||||
@@ -191,4 +191,4 @@ sudo userdel mattermost
|
||||
|
||||
- [Set up an NGINX reverse proxy](/deployment-guide/server/setup-nginx-proxy)
|
||||
- [Set up TLS](/deployment-guide/server/setup-tls)
|
||||
- For air-gapped deployments: [Air-Gapped Quick-Start Runbook](/deployment-guide/air-gapped-operations/quick-start-runbook), [Disable Phone-Home Features](/deployment-guide/air-gapped-operations/disable-phone-home-features)
|
||||
- For air-gapped deployments: [Air-Gapped Deployment Overview](/deployment-guide/air-gapped-operations/quick-start-runbook), [Configure for Air-Gapped Operation](/deployment-guide/air-gapped-operations/disable-phone-home-features)
|
||||
|
||||
@@ -18,17 +18,15 @@ Every page linked from here works without internet access. Stage artifacts on an
|
||||
## Start here
|
||||
|
||||
<CardGrid columns={3} cards={[
|
||||
{title: 'Air-Gapped Quick-Start Runbook', to: '/deployment-guide/air-gapped-operations/quick-start-runbook', description: '12-step procedure to stand up a working air-gapped cluster.'},
|
||||
{title: 'Mirror Package Repositories', to: '/deployment-guide/air-gapped-operations/mirror-package-repositories', description: 'Internal package mirror + container registry.'},
|
||||
{title: 'Deployment Overview', to: '/deployment-guide/air-gapped-operations/quick-start-runbook', description: 'High-level steps to deploy Mattermost in an air-gapped enclave.'},
|
||||
{title: 'Bill of Materials and Registry Mirroring', to: '/deployment-guide/air-gapped-operations/mirror-package-repositories', description: 'Internal package mirror + container registry.'},
|
||||
{title: 'FIPS / STIG container builds', to: '/deployment-guide/server/containers/fips-stig', description: 'Deploy the FIPS-compliant, STIG-hardened container image.'},
|
||||
]} />
|
||||
|
||||
## Common tasks
|
||||
|
||||
<CardGrid columns={3} cards={[
|
||||
{title: 'Offline License Activation', to: '/deployment-guide/air-gapped-operations/offline-license-activation', description: 'Activate Enterprise licenses without phoning home.'},
|
||||
{title: 'Disable Phone-Home Features', to: '/deployment-guide/air-gapped-operations/disable-phone-home-features', description: 'Inventory of every outbound call.'},
|
||||
{title: 'FedRAMP Moderate', to: '/security-guide/compliance-frameworks/fedramp-moderate', description: 'Baseline NIST 800-53 alignment.'},
|
||||
{title: 'Configure for Air-Gapped Operation', to: '/deployment-guide/air-gapped-operations/disable-phone-home-features', description: 'Server settings that depend on internet access.'},
|
||||
{title: 'DoD IL4 / IL5', to: '/security-guide/compliance-frameworks/dod-il-4-5', description: 'CC SRG impact level posture.'},
|
||||
{title: 'DISA STIG', to: '/security-guide/compliance-frameworks/disa-stig', description: 'Application Security and Development SRG mapping.'},
|
||||
{title: 'Reference architecture', to: '/deployment-guide/reference-architecture/reference-architecture-index', description: 'Application + scaling for sovereign deployments.'},
|
||||
|
||||
@@ -15,7 +15,6 @@ You evaluate Mattermost for use in regulated, classified, or DISC (Defense, Inte
|
||||
|
||||
<CardGrid columns={3} cards={[
|
||||
{title: 'Compliance Frameworks index', to: '/security-guide/compliance-frameworks', description: 'FedRAMP, DoD IL, DISA STIG, CMMC, HIPAA, FINRA.'},
|
||||
{title: 'FedRAMP Moderate', to: '/security-guide/compliance-frameworks/fedramp-moderate', description: 'Authorization status + NIST 800-53 mapping.'},
|
||||
{title: 'Cryptography & FIPS', to: '/deployment-guide/server/containers/fips-stig', description: 'FIPS 140-3 / STIG-hardened container image builds.'},
|
||||
]} />
|
||||
|
||||
|
||||
@@ -24,7 +24,7 @@ You own Mattermost's deployment, scaling, and operations. This page is a curated
|
||||
<CardGrid columns={3} cards={[
|
||||
{title: 'High availability', to: '/administration-guide/scale/high-availability-cluster-based-deployment', description: 'Clustering across app, DB, and proxy layers.'},
|
||||
{title: 'Hardware sizing', to: '/deployment-guide/software-hardware-requirements', description: 'CPU, memory, disk, network per scale tier.'},
|
||||
{title: 'Air-gapped quick-start', to: '/deployment-guide/air-gapped-operations/quick-start-runbook', description: '12-step runbook for network-isolated enclaves.'},
|
||||
{title: 'Air-gapped deployment overview', to: '/deployment-guide/air-gapped-operations/quick-start-runbook', description: 'Deploy Mattermost in a network-isolated enclave.'},
|
||||
{title: 'Calls operations (RTCD)', to: '/administration-guide/configure/calls-deployment-guide', description: 'RTCD, Offloader, Calls on Kubernetes, metrics.'},
|
||||
{title: 'Prometheus and Grafana', to: '/administration-guide/scale/deploy-prometheus-grafana-for-performance-monitoring', description: 'Scrape configs, dashboards, alert rules.'},
|
||||
{title: 'Active/Passive on AWS', to: '/deployment-guide/disaster-recovery-aws', description: 'Cross-region failover topology.'},
|
||||
|
||||
@@ -113,11 +113,10 @@ While the full STIG checklist is on the roadmap, customers can begin hardening t
|
||||
1. **Apply OS STIG** for the host OS (RHEL 9 / Ubuntu 22.04 / Windows Server).
|
||||
2. **Apply PostgreSQL STIG** for the database tier.
|
||||
3. **Apply Web Server SRG** to the NGINX reverse proxy.
|
||||
4. **Apply Mattermost configuration** from the [Required configuration summary on the FedRAMP Moderate page](./fedramp-moderate#required-configuration) — this satisfies the majority of Application Security and Development SRG requirements applicable to Mattermost.
|
||||
5. **Deploy using the FIPS-compliant container image** — see [FIPS / STIG container builds](../../deployment-guide/server/containers/fips-stig).
|
||||
6. **Disable phone-home features** — see [Disable Phone-Home Features](../../deployment-guide/air-gapped-operations/disable-phone-home-features).
|
||||
7. **Configure audit log export** to a STIG-compliant SIEM.
|
||||
8. **Configure IdP-side** policies for MFA, PIV/CAC, session lifetime, account lockout.
|
||||
4. **Deploy using the FIPS-compliant container image** — see [FIPS / STIG container builds](../../deployment-guide/server/containers/fips-stig).
|
||||
5. **Disable internet-dependent features** — see [Configure for Air-Gapped Operation](../../deployment-guide/air-gapped-operations/disable-phone-home-features).
|
||||
6. **Configure audit log export** to a STIG-compliant SIEM.
|
||||
7. **Configure IdP-side** policies for MFA, PIV/CAC, session lifetime, account lockout.
|
||||
|
||||
## Customer responsibility
|
||||
|
||||
@@ -125,7 +124,7 @@ DISA STIG compliance is **deployment-specific and customer-led**. Mattermost pro
|
||||
|
||||
- Default configurations aligned with SRG requirements where Mattermost owns the control.
|
||||
- This mapping document for the controls Mattermost contributes to.
|
||||
- Validated configuration guidance for the [FedRAMP Moderate](./fedramp-moderate) and [DoD IL4 / IL5](./dod-il-4-5) baselines that share many SRG requirements.
|
||||
- Documented configuration guidance for the [DoD IL4 / IL5](./dod-il-4-5) baseline, which shares many SRG requirements.
|
||||
|
||||
Customers are responsible for OS-tier, database-tier, proxy-tier, and CAP-tier hardening, plus the assessment + authorization process.
|
||||
|
||||
@@ -134,4 +133,3 @@ Customers are responsible for OS-tier, database-tier, proxy-tier, and CAP-tier h
|
||||
- [DISA STIG library](https://public.cyber.mil/stigs/downloads/) — canonical source.
|
||||
- [Application Security and Development SRG](https://public.cyber.mil/stigs/srg-stig-tools/) — the primary applicable SRG.
|
||||
- [DoD IL4 / IL5](./dod-il-4-5) — companion compliance page; STIG and IL4/IL5 are typically pursued together.
|
||||
- [FedRAMP Moderate](./fedramp-moderate) — the underlying NIST 800-53 baseline that backs both IL and STIG requirements.
|
||||
|
||||
@@ -18,10 +18,8 @@ description: Mattermost's posture against the DoD Cloud Computing Security Requi
|
||||
|
||||
This page documents Mattermost's posture against the DoD Cloud Computing Security Requirements Guide (CC SRG) Impact Level (IL) 4 and Impact Level 5 baselines. IL4 covers Controlled Unclassified Information (CUI) including export-controlled and mission-critical data. IL5 covers National Security Systems data and unclassified information requiring a higher level of protection than IL4.
|
||||
|
||||
:::important[Status]
|
||||
Current status is **Roadmap** — see the `<AttestationStatus>` badge above. Mattermost is FedRAMP Moderate–aligned (see [FedRAMP Moderate](./fedramp-moderate)), which is the standard prerequisite for IL4 sponsorship. IL5 additionally requires US-citizen-only operational support and dedicated infrastructure.
|
||||
|
||||
This page documents the gap honestly: what controls are met today via the FedRAMP Moderate baseline, what additional controls IL4/IL5 require beyond FedRAMP Moderate, and the customer's role in deploying Mattermost inside an authorized boundary.
|
||||
:::important Status
|
||||
Current status is **Roadmap** — see the `<AttestationStatus>` badge above. This page documents the gap honestly: what controls are met today, what additional controls IL4/IL5 require, and the customer's role in deploying Mattermost inside an authorized boundary.
|
||||
:::
|
||||
|
||||
## Authorization landscape
|
||||
@@ -33,15 +31,13 @@ This page documents the gap honestly: what controls are met today via the FedRAM
|
||||
| **IL5** | National Security Systems, mission-critical | DISA NIPRNet (dedicated) | Self-Hosted Enterprise on AWS GovCloud (US) or Azure Government, dedicated single-tenant infrastructure, US-citizen-only operational support, customer-managed authorization boundary. |
|
||||
| **IL6** | Classified up to Secret | SIPRNet | Self-Hosted Enterprise in customer-managed enclave (out of scope for this page — see [Air-Gapped Operations](../../deployment-guide/air-gapped-operations/)). |
|
||||
|
||||
## Baseline inheritance from FedRAMP Moderate
|
||||
## Baseline mapping
|
||||
|
||||
A Mattermost deployment that meets the configuration on the [FedRAMP Moderate](./fedramp-moderate) page inherits the majority of the IL4 / IL5 control baseline. The CC SRG explicitly maps DoD impact levels to NIST 800-53 baselines:
|
||||
The CC SRG explicitly maps DoD impact levels to NIST 800-53 baselines:
|
||||
|
||||
- **IL4** ≈ FedRAMP Moderate + DoD-specific overlays.
|
||||
- **IL5** ≈ FedRAMP High + DoD-specific overlays, with the additional dedicated-infrastructure and US-person operational support requirements.
|
||||
|
||||
Customers pursuing IL4 / IL5 authorization should start with the FedRAMP Moderate configuration as the baseline.
|
||||
|
||||
## Additional controls beyond FedRAMP Moderate
|
||||
|
||||
### Cryptography
|
||||
@@ -117,5 +113,4 @@ Mattermost will provide attestation letters, FIPS certificates, and configuratio
|
||||
|
||||
- [DoD Cloud Computing Security Requirements Guide](https://public.cyber.mil/dccs/dccs-documents/) — the canonical CC SRG.
|
||||
- [NIST SP 800-53 Rev. 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) — the underlying control catalog.
|
||||
- [FedRAMP Moderate](./fedramp-moderate) — the baseline Mattermost is aligned to today.
|
||||
- [Mattermost Trust Portal](https://mattermost.com/trust/) — current attestation status and supporting evidence.
|
||||
|
||||
@@ -1,137 +0,0 @@
|
||||
---
|
||||
title: FedRAMP Moderate
|
||||
sidebar_position: 1
|
||||
description: Mattermost's FedRAMP Moderate authorization posture, configuration guidance, and NIST 800-53 control mappings.
|
||||
---
|
||||
|
||||
<AttestationStatus
|
||||
framework="FedRAMP Moderate"
|
||||
status="in-process"
|
||||
asOf="2026-05-11"
|
||||
detailsHref="https://mattermost.com/trust/"
|
||||
/>
|
||||
|
||||
<EditionAvailability tiers="enterprise,enterprise-advanced" />
|
||||
<DeploymentAvailability modes="self-hosted,cloud-government,air-gapped" />
|
||||
|
||||
# FedRAMP Moderate
|
||||
|
||||
This page documents Mattermost's posture against the **FedRAMP Moderate** baseline (NIST 800-53 Rev. 5 Moderate control set). It is the primary entry surface for **Security Architects** and **Accreditors** (`docs/_redesign/personas.md` §5 in the repo) preparing System Security Plans (SSPs) or evaluating Mattermost for use in FedRAMP-bounded environments.
|
||||
|
||||
:::important[Status]
|
||||
Current authorization status is set by the `<AttestationStatus>` badge above. Status updates require sign-off from Mattermost's compliance team — do not change in PRs without product + legal approval. See `docs/_redesign/proposed-ia.md` §5 risk 4 in the repo.
|
||||
:::
|
||||
|
||||
## Authorization scope
|
||||
|
||||
When Mattermost achieves FedRAMP Moderate authorization, the authorization will apply to a specific deployment configuration. Customers using Mattermost in a FedRAMP-bounded environment **inherit** the authorization only when their deployment matches the authorized configuration. Deviations require customer-managed re-authorization.
|
||||
|
||||
Documented in this page:
|
||||
|
||||
- The authorized **edition** (Enterprise / Enterprise Advanced).
|
||||
- The authorized **deployment mode** (Cloud Government or Self-Hosted in a FedRAMP-bounded enclave).
|
||||
- The authorized **release version range**.
|
||||
- The **shared responsibility model** — which controls Mattermost implements, which the customer implements, and which are shared.
|
||||
|
||||
## NIST 800-53 control mapping
|
||||
|
||||
The mapping below is organized by NIST 800-53 control family. Each row identifies the Mattermost feature, plugin, or configuration setting that implements the control. Where multiple controls share an implementation, the implementation is listed once and cross-referenced.
|
||||
|
||||
This structure is modeled on [Teleport's FedRAMP page](https://goteleport.com/docs/zero-trust-access/compliance-frameworks/fedramp/), which organizes by NIST control family because that is the abstraction auditors cite in SSPs.
|
||||
|
||||
### Access Control (AC)
|
||||
|
||||
| Control | Implementation | Configuration |
|
||||
|---|---|---|
|
||||
| AC-2 (Account Management) | System Console → Users + SCIM provisioning | [Onboard Users](../../administration-guide/onboard/sso-saml) |
|
||||
| AC-3 (Access Enforcement) | Role-based access control (System / Team / Channel) + Advanced Permissions | [Manage Permissions](../../administration-guide/manage/admin/user-management) |
|
||||
| AC-6 (Least Privilege) | Custom roles + ABAC (Enterprise Advanced) | [Manage Permissions](../../administration-guide/manage/admin/user-management) |
|
||||
| AC-7 (Unsuccessful Login Attempts) | `ServiceSettings.MaximumLoginAttempts` + account lockout | System Console → Authentication |
|
||||
| AC-11 (Session Lock) | `ServiceSettings.SessionLengthWebInHours` + session expiration | System Console → Session Lengths |
|
||||
| AC-17 (Remote Access) | TLS enforcement + MFA | [Transport Encryption](../../deployment-guide/transport-encryption.mdx) |
|
||||
|
||||
### Audit and Accountability (AU)
|
||||
|
||||
| Control | Implementation | Configuration |
|
||||
|---|---|---|
|
||||
| AU-2 (Event Logging) | Audit log + JSON audit log schema | [Comply](../../administration-guide/comply/compliance-export) |
|
||||
| AU-3 (Content of Audit Records) | JSON audit log fields | Audit Log Reference (Phase 2) |
|
||||
| AU-6 (Audit Review, Analysis, and Reporting) | SIEM integration via audit log export | *Audit Log Export to Air-Gapped SIEM* (Phase 2) |
|
||||
| AU-9 (Protection of Audit Information) | Audit log immutability + offline export | Audit Log Reference (Phase 2) |
|
||||
| AU-12 (Audit Record Generation) | Per-action audit emissions | Audit Log Reference (Phase 2) |
|
||||
|
||||
### Identification and Authentication (IA)
|
||||
|
||||
| Control | Implementation | Configuration |
|
||||
|---|---|---|
|
||||
| IA-2 (Identification and Authentication) | SAML 2.0, OIDC, AD/LDAP | [Onboard Users](../../administration-guide/onboard/sso-saml) |
|
||||
| IA-2(1) (MFA for Privileged Accounts) | MFA enforcement for system admins | System Console → MFA |
|
||||
| IA-2(2) (MFA for Non-Privileged Accounts) | MFA enforcement for all users | System Console → MFA |
|
||||
| IA-5 (Authenticator Management) | Password complexity policy + rotation | System Console → Password |
|
||||
| IA-8 (Identification and Authentication, Non-Organizational Users) | Guest accounts with separate permission model | [Guest Accounts](../../administration-guide/onboard/guest-accounts) |
|
||||
|
||||
### Configuration Management (CM)
|
||||
|
||||
| Control | Implementation | Configuration |
|
||||
|---|---|---|
|
||||
| CM-2 (Baseline Configuration) | `config.json` version control + Operator CR | [Configure](../../administration-guide/configure/configuration-settings) |
|
||||
| CM-6 (Configuration Settings) | Hardening guide + STIG profile | [Hardening Guides](../../security-guide/security-guide-index) |
|
||||
| CM-7 (Least Functionality) | Per-feature enable/disable flags + plugin gating | [Disable Phone-Home Features](../../deployment-guide/air-gapped-operations/disable-phone-home-features) |
|
||||
| CM-8 (Information System Component Inventory) | `mmctl system info` + Support Packet | [Maintain](../../administration-guide/manage/admin/server-maintenance) |
|
||||
|
||||
### System and Communications Protection (SC)
|
||||
|
||||
| Control | Implementation | Configuration |
|
||||
|---|---|---|
|
||||
| SC-7 (Boundary Protection) | NGINX reverse proxy + TLS + image proxy | [Setup NGINX Proxy](../../deployment-guide/server/setup-nginx-proxy.mdx) |
|
||||
| SC-8 (Transmission Confidentiality and Integrity) | TLS 1.2+ enforcement | [Setup TLS](../../deployment-guide/server/setup-tls.mdx) |
|
||||
| SC-13 (Cryptographic Protection) | FIPS 140-3 validated modules (when FIPS mode enabled at install time) | *Configure FIPS at Install Time* (Phase 1) and *Cryptography & FIPS* (Phase 2) |
|
||||
| SC-28 (Protection of Information at Rest) | Database encryption at rest + file storage encryption | [Encryption Options](../../deployment-guide/encryption-options.mdx) |
|
||||
|
||||
### System and Information Integrity (SI)
|
||||
|
||||
| Control | Implementation | Configuration |
|
||||
|---|---|---|
|
||||
| SI-2 (Flaw Remediation) | Security advisory feed + ESR cadence | [ESR Support Policy](../../product-overview/release-policy) |
|
||||
| SI-4 (Information System Monitoring) | Prometheus / Grafana / Loki integration | [Monitor & Operate](../../administration-guide/scale/deploy-prometheus-grafana-for-performance-monitoring) |
|
||||
| SI-7 (Software, Firmware, and Information Integrity) | Signed releases + checksum verification | Release verification — Phase 2 |
|
||||
|
||||
### Other control families — Phase 2
|
||||
|
||||
The following control families will be added in Phase 2 as the Mattermost compliance team completes the authorization package:
|
||||
|
||||
- **AT** — Awareness and Training (operator + user training references)
|
||||
- **CA** — Assessment, Authorization, and Monitoring (ATO process documentation)
|
||||
- **CP** — Contingency Planning (backup, DR, BCP)
|
||||
- **IR** — Incident Response
|
||||
- **MA** — Maintenance
|
||||
- **MP** — Media Protection
|
||||
- **PE** — Physical and Environmental Protection (deployment-context specific)
|
||||
- **PL** — Planning
|
||||
- **PS** — Personnel Security
|
||||
- **RA** — Risk Assessment
|
||||
- **SA** — System and Services Acquisition
|
||||
- **SR** — Supply Chain Risk Management
|
||||
|
||||
## Shared responsibility
|
||||
|
||||
When Mattermost achieves FedRAMP Moderate authorization for the Cloud Government deployment mode, a formal shared responsibility model will be published here. Self-Hosted deployments operate entirely under the customer's authorization boundary — Mattermost's contribution is the validated configuration guidance on this page.
|
||||
|
||||
## Required configuration
|
||||
|
||||
For a Mattermost deployment to align with FedRAMP Moderate, the following configuration is required:
|
||||
|
||||
1. **FIPS mode enabled at install time** — see *Configure FIPS at Install Time* (Phase 1). FIPS cannot be enabled post-deploy.
|
||||
2. **TLS 1.2+ for all client and inter-service traffic** — see [Transport Encryption](../../deployment-guide/transport-encryption.mdx).
|
||||
3. **Audit log retention ≥ 1 year** — configure via `LogSettings.FileLevel` and external SIEM export.
|
||||
4. **MFA enforced for all users** — System Console → MFA.
|
||||
5. **Phone-home features disabled** — see [Disable Phone-Home Features](../../deployment-guide/air-gapped-operations/disable-phone-home-features).
|
||||
6. **Audit log offline export configured** — see *Audit Log Export to Air-Gapped SIEM* (Phase 2).
|
||||
|
||||
## References
|
||||
|
||||
- [NIST SP 800-53 Rev. 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) — base control catalog.
|
||||
- [FedRAMP Moderate baseline](https://www.fedramp.gov/baselines/) — the Moderate control selection.
|
||||
- [Mattermost Trust Portal](https://mattermost.com/trust/) — formal attestation letters and authorization artifacts.
|
||||
- [Teleport FedRAMP documentation](https://goteleport.com/docs/zero-trust-access/compliance-frameworks/fedramp/) — reference model for the NIST-control-family structure used on this page.
|
||||
- [GitLab FedRAMP secure configuration guide](https://docs.gitlab.com/security/dedicated_for_government_secure_config_guide/) — reference model for numbered requirement / recommendation structure.
|
||||
@@ -18,7 +18,6 @@ Cross-link both ways when adding new content.
|
||||
|
||||
## Pages
|
||||
|
||||
- [FedRAMP Moderate](/security-guide/compliance-frameworks/fedramp-moderate) — Authorization status, configuration guidance, and NIST 800-53 control mappings.
|
||||
- [DoD IL4 / IL5](/security-guide/compliance-frameworks/dod-il-4-5) — Posture against DoD Cloud Computing Security Requirements Guide Impact Levels 4 and 5.
|
||||
- [DISA STIG](/security-guide/compliance-frameworks/disa-stig) — Posture against the Application Security and Development SRG and applicable STIG layers.
|
||||
- [CMMC Compliance](/security-guide/cmmc-compliance) — preserved at parent level pending Phase 2 re-organization.
|
||||
|
||||
Reference in New Issue
Block a user