Operate grommunio Chat 2026 for teams and tenants

Goal of this guide

This guide shows how to install, configure and test grommunio Chat on an existing grommunio 2026.06.1 appliance with multiple users. The goal is not just that `/chat/` loads. Teams, channels, WebSocket connectivity, user privileges and domain mapping need to work together.

You install grommunio Chat 10 from the grommunio repository.
You configure database, Chat configuration, local admin and admin API integration.
You enable Chat per domain and per user.
You validate the nginx upstream for `/chat/`.
You test two users in the same team and channel.
You evaluate what is multi-tenant capable and when a separate installation is required.

The series remains chronological: install grommunio, antispam with Rspamd, SSO with Keycloak, Meet with Jitsi and now Chat. Product context is available on the grommunio product page.

Architecture: what grommunio Chat is

grommunio Chat is the team communication layer inside the grommunio platform and is technically based on Mattermost. The appliance runs the Chat service locally and exposes it through nginx under `/chat/`. grommunio Admin keeps the mapping between grommunio domain, grommunio user and Chat team.

Browser
  -> https://mail.example.test/chat/
  -> nginx location /chat/
  -> upstream chat_server
  -> grommunio-chat on 127.0.0.1:8065
  -> MariaDB database grochat
  -> domain Chat team and user mapping through grommunio Admin

Step 1: Install the package and check the state

First check whether Chat is already installed. On the validated appliance only the admin driver was present; the actual Chat server had to be installed.

bash

rpm -qa | grep -Ei 'grommunio-chat|mattermost' | sort
zypper search -s grommunio-chat
zypper --non-interactive install --auto-agree-with-licenses grommunio-chat-v10

Step 2: Prepare database and configuration

Chat needs its own database and a `config.json`. Use unique passwords and never paste them into tickets, screenshots or articles. In production runbooks these values belong in secret management or at least in root-readable files.

bash

install -d -m 0750 -o grochat -g grochat /etc/grommunio-chat /var/log/grommunio-chat /var/lib/grommunio-chat
cp -n /etc/grommunio-chat/config.json.example /etc/grommunio-chat/config.json

# Beispiel: Datenbank und Benutzer anlegen.
# Ersetze <secure-password> durch ein starkes Secret.
mariadb <<'SQL'
CREATE DATABASE IF NOT EXISTS grochat CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS 'grochat'@'localhost' IDENTIFIED BY '<secure-password>';
GRANT ALL PRIVILEGES ON grochat.* TO 'grochat'@'localhost';
FLUSH PRIVILEGES;
SQL

In `config.json`, at minimum `SiteURL`, SQL driver, SQL data source and local mode must be correct. The `SiteURL` must match the URL users actually use in the browser. In validation, a mismatched port/origin combination produced WebSocket 403 errors.

bash

python3 - <<'PY'
import json
from pathlib import Path

path = Path('/etc/grommunio-chat/config.json')
data = json.loads(path.read_text())
data['ServiceSettings']['SiteURL'] = 'https://mail.example.test/chat'
data['ServiceSettings']['ListenAddress'] = '127.0.0.1:8065'
data['ServiceSettings']['EnableLocalMode'] = True
data['ServiceSettings']['LocalModeSocketLocation'] = '/var/tmp/grommunio-chat_local.socket'
data['SqlSettings']['DriverName'] = 'mysql'
data['SqlSettings']['DataSource'] = 'grochat:<secure-password>@tcp(localhost:3306)/grochat?charset=utf8mb4,utf8&readTimeout=30s&writeTimeout=30s'
data['TeamSettings']['EnableOpenServer'] = False
data['TeamSettings']['RestrictCreationToDomains'] = 'example.test'
path.write_text(json.dumps(data, indent=2) + '\n')
PY
chown grochat:grochat /etc/grommunio-chat/config.json
chmod 0640 /etc/grommunio-chat/config.json

Step 3: Start the service and validate nginx upstream

Start Chat and verify the local socket. On the validated appliance it was also important to activate the shipped nginx upstream file from the `.example` file. Without this upstream, `nginx -t` failed with `host not found in upstream "chat_server"`.

bash

systemctl enable --now grommunio-chat
test -S /var/tmp/grommunio-chat_local.socket

cp -n /etc/grommunio-common/nginx/upstreams.d/grommunio-chat.conf.example \
  /etc/grommunio-common/nginx/upstreams.d/grommunio-chat.conf

nginx -t
systemctl restart nginx grommunio-admin-api

curl -kI https://mail.example.test/chat/
curl -k https://mail.example.test/chat/api/v4/system/ping

Step 4: Connect local Chat admin and admin API

grommunio Admin needs a technical Chat admin so domains and users can be mirrored into Chat. Use an address inside the allowed domain. If you set `RestrictCreationToDomains = example.test`, `admin@localhost` is deliberately not allowed.

bash

export MMCTL_LOCAL_SOCKET_PATH=/var/tmp/grommunio-chat_local.socket
/usr/share/grommunio-chat/bin/grommunio-chat-ctl --local user create \
  --email groadmin@example.test \
  --username groadmin \
  --password '<secure-password>' \
  --system-admin \
  --email-verified \
  --disable-welcome-email

cat >/etc/grommunio-admin-api/conf.d/chat.yaml <<'YAML'
chat:
  connection:
    login_id: groadmin
    password: '<secure-password>'
    url: mail.example.test
    basepath: /chat/api/v4
    port: 443
    scheme: https
    verify: False
YAML
chmod 0600 /etc/grommunio-admin-api/conf.d/chat.yaml
systemctl restart grommunio-admin-api

Step 5: Enable domain and users

Enable Chat on the domain first. Only then can users be linked to Chat reliably. In validation, `grommunio-admin domain modify example.test --chat true` created a Chat team for this domain.

bash

grommunio-admin domain modify example.test --chat true
grommunio-admin user modify alex@example.test --chat true --privChat true
grommunio-admin user modify meet@example.test --chat true --privChat true

grommunio-admin domain query domainname chat chatID --format json-flat
grommunio-admin user query username chat chatAdmin privChat privWeb --format json-flat

If an appliance version throws an error during `user modify`, check domain Chat, technical Chat admin and admin API connectivity. Do not manipulate the database directly in production; fix the admin API integration first and repeat the supported `grommunio-admin` commands.

Open Chat with a normal user. After the first login, the domain team must be visible. In this guide, team and channel names are synthetic, but the flow is identical to a production environment.