docs: nest 19 files into audit/ clients/ infrastructure/ monitoring/ projects/ super-search/

2026-08-08 13:04:55 -04:00
parent 11a1110b81
commit a522d11c35
20 changed files with 927 additions and 0 deletions
@@ -0,0 +1,280 @@
+# Mattermost Replacement Analysis: Self-Hosted Team Chat with Native iOS Push Notifications
+
+**Date:** August 7, 2026
+**Context:** Evaluating self-hosted Mattermost alternatives that provide iOS push notifications without relying on a fragile self-hosted push proxy (MPNS/HPNS relay complexity).
+
+---
+
+## Executive Summary
+
+**Recommendation: Zulip** — for most use cases. It offers a built-in Mattermost importer, the lightest resource footprint, Apache 2.0 licensing, and push notifications through Zulip's professionally maintained relay service with E2EE (since v12.0, April 2026). The push architecture is similar to Mattermost's HPNS, but Zulip's service is better maintained, fully documented, and the E2EE layer means Zulip cannot read your notification content.
+
+**Alternative: Rocket.Chat** — if you require push notifications to be *fully* self-hosted (no external relay at all), Rocket.Chat is the only viable option. It supports direct APNs/FCM with your own Apple developer credentials, but requires white-labeling the mobile app — a significant ongoing maintenance burden.
+
+---
+
+## Why Push Notifications Are Hard for Self-Hosted Chat
+
+Apple and Google require a single app bundle ID to be tied to a single set of push notification credentials. This means the official Rocket.Chat, Zulip, and Element apps in the App Store can only receive push from *one* push gateway — the one the app developer controls. All self-hosted deployments of these apps must route through the developer's push relay (or build their own app).
+
+There are only two ways around this:
+
+1. **Use the vendor's push relay** (Rocket.Chat gateway, Zulip push service, matrix.org) — simplest, but your notifications transit through a third party
+2. **Build/white-label your own mobile app** with your own Apple Developer credentials — fully self-hosted push, but significant operational overhead
+
+**The hard truth: no option achieves "100% self-hosted push with zero external dependencies using the official App Store app."** The question is which compromise best fits your requirements.
+
+---
+
+## Candidate Comparison
+
+### 1. Zulip ⭐ RECOMMENDED
+
+| Metric | Detail |
+|--------|--------|
+| **GitHub** | [zulip/zulip](https://github.com/zulip/zulip) — 25,617 stars, Apache 2.0 |
+| **Language** | Python (backend), TypeScript/Flutter (mobile) |
+| **iOS App** | 3.1/5.0 rating (new Flutter app launched June 2025, ratings still stabilizing); fully native |
+| **Push Architecture** | Central push notification service (`push.zulip.com`) — server → Zulip relay → APNs/FCM |
+| **E2EE Push** | ✅ Yes since Zulip Server 12.0 (April 2026). Content + metadata encrypted. Zulip's relay cannot read your messages. |
+| **Self-Hosted Push?** | Code is 100% open source and *technically* self-hostable, but not documented/supported as a turnkey deployment. Requires building custom mobile app with your own APNs keys. |
+| **Free Push Tier** | ✅ Free for ≤10 users (all features). Community plan (open source, academic, non-profit): unlimited free. |
+| **Paid Push** | Basic: $3.50/user/mo. Business: $6.67/user/mo (annual). 25-user minimum for Business. |
+| **Docker** | ✅ Official Docker Compose support. Single-server deployment well-documented. |
+| **Resource Requirements** | ~2 GB RAM for small teams, scales well. Significantly lighter than Mattermost. |
+| **Mattermost Migration** | ✅ **Built-in importer** — `zulip.com/help/import-from-mattermost`. Also imports from Slack, Teams, Rocket.Chat. |
+| **Differentiator** | **Topic-based threading model** — every message lives in a topic within a stream. Far superior to Slack/Mattermost's "channel soup" for async/distributed teams. |
+| **Maintenance** | Very active — daily commits. Strong documentation (ReadTheDocs). |
+| **Push Dependency** | Depends on `push.zulip.com` (Zulip Cloud infrastructure). Not fully self-sovereign — if Zulip the company disappears, push stops working unless you build your own app. |
+
+**Pros:**
+- Lightest resource footprint of all candidates
+- Built-in Mattermost importer
+- E2EE push notifications — Zulip can't read your content
+- Free for ≤10 users; generous Community plan
+- Apache 2.0 — most permissive license
+- Uniquely powerful threading model
+
+**Cons:**
+- Push relay dependency (same fundamental architecture as Mattermost HPNS)
+- iOS app ratings still stabilizing after Flutter rewrite
+- Smaller enterprise customer base than Rocket.Chat/Mattermost
+- $6.67/user/mo at Business tier is cheaper than Mattermost Enterprise but not free
+
+---
+
+### 2. Rocket.Chat
+
+| Metric | Detail |
+|--------|--------|
+| **GitHub** | [RocketChat/Rocket.Chat](https://github.com/RocketChat/Rocket.Chat) — 45,944 stars, mixed license |
+| **Language** | TypeScript (Meteor.js framework) |
+| **iOS App** | 4.4/5.0, 3,700+ ratings — mature, well-rated |
+| **Push Architecture** | **Two modes:** (1) Push Gateway via `gateway.rocket.chat` (recommended), or (2) Self-Configured with direct APNs/FCM certificates |
+| **Self-Hosted Push (Gateway)** | 10,000 free push/month for Community Edition. Then requires paid plan. Traffic routes through Rocket.Chat's gateway. |
+| **Self-Hosted Push (Direct APNs)** | ✅ Fully self-hosted push possible — provide your own APN passphrase/key/cert + FCM credentials. But **requires white-labeling the mobile app** (building from source with your bundle ID and credentials). This is the only truly "no external relay" option among all candidates. |
+| **White-Label App** | [Documented](https://developer.rocket.chat/docs/mobile-app-white-labeling) — requires Apple Developer account ($99/yr), building from source, and ongoing maintenance to track upstream releases. |
+| **Free Tier** | Community Edition (CE) — free, but 10K push/month limit. No per-user cost. |
+| **Paid Plans** | From $7/user/mo for unlimited push + enterprise features |
+| **Docker** | ✅ Docker Compose. Requires MongoDB replica set. |
+| **Resource Requirements** | **Heaviest** of all candidates. Meteor.js + MongoDB replica set. Needs more RAM for equivalent user counts vs Mattermost. ~4 GB minimum recommended. |
+| **Mattermost Migration** | ⚠️ No built-in importer. Must convert Mattermost export to CSV, then import as CSV. Community scripts exist but no official tool. |
+| **Differentiator** | Omnichannel — integrated customer-facing live chat, WhatsApp, Telegram, Instagram alongside internal team chat. Best if you need customer comms too. |
+| **Push Dependency** | Mode-dependent. Gateway mode depends on `gateway.rocket.chat`. Self-configured mode has no external dependency. |
+| **Maintenance** | Active but ~6-month release support cadence. MongoDB requirement adds operational complexity. |
+
+**Pros:**
+- Largest install base (45.9K stars)
+- Mature, well-rated iOS app
+- *Can* achieve fully self-hosted push via direct APNs + white-label app
+- Omnichannel if you need customer-facing chat
+- Rich integration ecosystem
+
+**Cons:**
+- Heaviest resource requirements (MongoDB replica set + Meteor.js)
+- No built-in Mattermost importer
+- Push gateway: 10K free/month, then paid
+- White-label path: significant ongoing maintenance
+- Community Edition push limit may be restrictive
+
+---
+
+### 3. Element / Matrix (Synapse)
+
+| Metric | Detail |
+|--------|--------|
+| **GitHub** | [element-hq/synapse](https://github.com/element-hq/synapse) — 4,501 stars, AGPL-3.0 |
+| **Language** | Python |
+| **iOS App** | Element X: 4.9/5.0 (excellent). Element Classic: 4.3/5.0. Both actively maintained. |
+| **Push Architecture** | **Android:** Fully self-hostable via UnifiedPush + ntfy (self-hosted push server). **iOS: ALL push routes through matrix.org.** There is no way to self-host iOS push with the official Element app. |
+| **iOS Push Reality** | Element/New Vector holds the Apple Developer credentials for the App Store app. Your Synapse server sends push events to matrix.org's push gateway, which forwards to APNs. `format: event_id_only` by default — matrix.org only learns "user X on homeserver Y has a notification," not message content. Element then fetches the actual message from your homeserver. |
+| **Fully Self-Hosted iOS Push?** | ❌ **Impossible** without building your own iOS Matrix client with your own Apple Developer account. This is an Apple platform restriction, not a Matrix design choice. |
+| **Free Tier** | ✅ Synapse is fully open-source, free. Push via matrix.org is free (no per-notification cost). |
+| **Docker** | ✅ Docker Compose. Requires PostgreSQL. |
+| **Resource Requirements** | Heavy. Synapse is known for high resource consumption. ~4 GB RAM minimum. Consider Dendrite (lighter Matrix homeserver in Go) as alternative. |
+| **Mattermost Migration** | ⚠️ Via [matrix-appservice-mattermost](https://github.com/hifi/mattermost-matrix-bridge) — more of a bridge than a migration. |
+| **Differentiator** | Decentralized federation — users on your server can chat with users on other Matrix servers. Open standard. Multiple client choices (Element, FluffyChat, etc.). |
+| **Push Dependency** | iOS: `matrix.org` push gateway (always). Android: optional UnifiedPush (self-hostable). |
+| **Maintenance** | Actively maintained by Element/New Vector. Federation adds complexity. |
+
+**Pros:**
+- Element X iOS app is the highest rated (4.9)
+- Android push fully self-hostable
+- Federation — chat across servers
+- Open standard, multiple clients
+- Free push (routed through matrix.org)
+
+**Cons:**
+- ❌ **iOS push CANNOT be self-hosted** with the official app
+- Synapse is resource-heavy
+- Federation adds operational complexity
+- AGPL-3.0 license (more restrictive than Apache 2.0)
+- Bridge to Mattermost, not a clean migration
+
+---
+
+### 4. Nextcloud Talk
+
+| Metric | Detail |
+|--------|--------|
+| **Push Architecture** | All push goes through `push-notifications.nextcloud.com`. The push proxy is **NOT open source**. Enterprise customers get a proprietary self-hosted push proxy option. |
+| **Self-Hosted Push?** | ❌ Not available to community. Enterprise-only, proprietary. |
+| **Viability as Mattermost Replacement** | ❌ Not standalone — requires the full Nextcloud stack (Files, Talk, server, database, HPB signaling server). Massive operational overhead if you only need chat. |
+| **Verdict** | **Not recommended.** Only viable if you already run Nextcloud and want to add chat. Even then, push dependency on Nextcloud's proxy is a concern. |
+
+---
+
+### 5. Discourse (Chat Plugin)
+
+| Metric | Detail |
+|--------|--------|
+| **iOS Push** | For self-hosted Discourse: push notifications work via **polling**, not real push. Only Discourse-hosted sites get real push via DiscourseHub app. |
+| **Verdict** | **Not recommended.** Not a team chat platform — it's a forum with chat bolted on. No real iOS push for self-hosted. |
+
+---
+
+### 6. Wire
+
+| Metric | Detail |
+|--------|--------|
+| **Self-Hosted** | Enterprise-only. Kubernetes + Cassandra deployment. Heaviest infra footprint of any candidate. |
+| **Free Tier** | None for self-hosted. Per-user enterprise pricing. |
+| **Verdict** | **Not recommended.** Overkill for typical teams. No free self-hosted tier. Requires dedicated infrastructure team. Only suitable for large enterprises with strict security/compliance requirements. |
+
+---
+
+## Push Notification Architecture: Summary Table
+
+| Platform | iOS Push Self-Hostable? | Push Relay Required? | E2EE Push? | Free Push Tier |
+|----------|:------------------------:|:--------------------:|:----------:|:--------------:|
+| **Mattermost** (baseline) | ⚠️ Via self-hosted push proxy (MPNS/HPNS) | Yes (HPNS) or self-hosted proxy | ❌ No | TPNS: free, limited |
+| **Zulip** | ⚠️ Technically possible, not documented | Yes (`push.zulip.com`) | ✅ v12.0+ | ✅ ≤10 users free; Community plan unlimited free |
+| **Rocket.Chat** | ✅ Direct APNs + white-label app | Optional (gateway or direct) | ⚠️ Privacy mode available | 10K push/month free (gateway) |
+| **Element/Matrix** | ❌ iOS always routes through matrix.org | Yes (`matrix.org`) | ❌ No (event_id_only reduces exposure) | ✅ Free |
+| **Nextcloud Talk** | ❌ Enterprise-only proprietary | Yes (`push-notifications.nextcloud.com`) | ✅ (encrypted proxy) | ✅ Free (throttled) |
+
+---
+
+## Quick Comparison Matrix
+
+| Factor | Zulip | Rocket.Chat | Element/Matrix |
+|--------|-------|-------------|----------------|
+| **GitHub Stars** | 25.6K | 45.9K | 4.5K (Synapse) |
+| **License** | Apache 2.0 | Mixed | AGPL-3.0 |
+| **iOS App Rating** | ~3.1 (new Flutter) | 4.4 (3.7K reviews) | 4.9 (Element X) |
+| **RAM (min)** | 2 GB | 4 GB+ | 4 GB+ |
+| **Docker** | ✅ Compose | ✅ Compose + MongoDB RS | ✅ Compose |
+| **Mattermost Import** | ✅ Built-in | ⚠️ CSV only | ⚠️ Bridge only |
+| **Push Cost** | Free ≤10 / $3.50-6.67/user | Free 10K/mo / $7+/user | Free |
+| **Push Independence** | Low (relay-dependent) | High (direct APNs possible) | None for iOS (matrix.org) |
+| **E2EE Push** | ✅ v12.0+ | ⚠️ Privacy mode | ❌ |
+| **Threading** | ⭐ Topic-based (best) | Threads | Threads |
+| **Differentiator** | Async threading model | Omnichannel customer comms | Federation |
+
+---
+
+## Recommendation
+
+### Primary Recommendation: Zulip
+
+**Why:**
+1. **Built-in Mattermost importer** — lowest migration friction
+2. **Lightest resource footprint** — 2 GB RAM, runs on modest VPS
+3. **E2EE push notifications since v12.0 (April 2026)** — Zulip's relay cannot read your notification content
+4. **Apache 2.0 license** — most permissive, no copyleft concerns
+5. **Free for ≤10 users**; Community plan covers many use cases for free
+6. **Topic-based threading** — superior to Mattermost's channel model for organized communication
+7. **Push architecture is well-documented and stable** — same relay model as Mattermost, but better maintained
+
+**The tradeoff:** Like Mattermost, push notifications depend on Zulip's cloud relay service. If Zulip the company disappears, push stops working unless you build your own mobile app. This is the same risk you have with Mattermost today. The E2EE in v12.0 mitigates the privacy concern — Zulip sees encrypted blobs, not your content.
+
+### Alternative Recommendation: Rocket.Chat (self-configured push)
+
+**Choose Rocket.Chat if:**
+- You require **zero external push relay dependency**
+- You are willing to maintain a white-labeled mobile app
+- You have an Apple Developer account ($99/yr)
+- You have the operational capacity to manage MongoDB and a heavier stack
+
+**The tradeoff:** You get *truly* self-hosted push (your server talks directly to Apple APNs), but you must build, sign, and distribute your own iOS app. This is a significant ongoing maintenance commitment (tracking upstream releases, rebuilding, re-signing, deploying to MDM/TestFlight).
+
+### What About Element?
+
+Element X has the best iOS app and free push, but iOS push *always* routes through matrix.org. If you're comfortable with that relay dependency (which you already accept with Mattermost today), Element is worth considering for the federation benefits and excellent mobile UX. The lack of a clean Mattermost importer and AGPL license are the main blockers.
+
+### What About the "Ideal" Solution?
+
+The ideal — 100% self-hosted push with the official App Store app and zero external dependencies — **does not exist.** This is an Apple/Google platform constraint, not a failing of any particular project. The only way to achieve it is to build and maintain your own iOS app (Rocket.Chat's white-label path).
+
+---
+
+## Migration Path: Mattermost → Zulip
+
+Zulip has [documented import support](https://zulip.com/help/import-from-mattermost) for Mattermost exports:
+
+```bash
+# 1. Export from Mattermost (bulk export or database dump)
+# 2. Convert to Zulip import format
+# 3. Import into Zulip
+/home/zulip/deployments/current/manage.py import mattermost_organization.zip
+```
+
+Zulip supports importing:
+- User accounts (name, email, avatar)
+- Channels → Streams
+- Message history
+- Attachments/file uploads
+- Custom emoji (limited)
+
+**Not imported:** integrations, bots, webhooks (must be recreated)
+
+### Deployment Pattern (Docker)
+
+```bash
+# Zulip Docker quick-start
+git clone https://github.com/zulip/docker-zulip.git
+cd docker-zulip
+# Configure .env with your settings
+docker compose up -d
+```
+
+---
+
+## Sources
+
+- [Rocket.Chat Push Notification Documentation](https://docs.rocket.chat/docs/push)
+- [Rocket.Chat Mobile App White-Labeling](https://developer.rocket.chat/docs/mobile-app-white-labeling)
+- [Zulip Mobile Push Notification Service](https://zulip.readthedocs.io/en/latest/production/mobile-push-notifications.html)
+- [Zulip Plans and Pricing](https://zulip.com/plans/)
+- [Zulip Import from Mattermost](https://zulip.com/help/import-from-mattermost)
+- [Element/Matrix UnifiedPush + ntfy Setup](https://docs.element.io/latest/element-support/element-androidios-client-settings/using-unified-push-and-ntfy-for-push-notifications/)
+- [Self-Hosted Matrix Notifications (CodingKiwi)](https://blog.coding.kiwi/selfhosted-matrix-notifications/)
+- [iOS Push Limitations for Self-Hosters (YunoHost Forum)](https://forum.yunohost.org/t/how-to-setup-push-notification-with-synapse-and-element-or-element-x-android/36897)
+- [Nextcloud Push Notifications Blog](https://nextcloud.com/blog/nextclouds-push-notifications-for-ios-and-android/)
+- [Nextcloud Custom Push Server (Community Discussion)](https://help.nextcloud.com/t/custom-push-notifications-server-setup-for-talk/143412)
+- [Discourse iOS Push for Self-Hosted](https://meta.discourse.org/t/ios-android-push-notifications-on-self-hosted-discourse-docker/394149)
+- Video: [iOS Messenger App Development in 2026 (ForaSoft)](https://www.forasoft.com/blog/article/ios-messenger-app-development) — reference architecture confirming APNs constraints
+
+---
+
+*Research conducted August 7, 2026. All push notification details verified against official project documentation. App Store ratings are US region snapshots and may vary by region.*