Accessing Mattermost via Multiple URLs within a LAN and Over the Internet?

Troubleshooting
1

I have a small Mattermost server that’s accessible over the internet via a Cloudflare Tunnel at https://mattermost.domain.tld. This setup works perfectly for external access. However, I’d like to expand the accessibility options for users within our LAN. Specifically, I aim to enable access to the same Mattermost server directly via an internal IP address (http[s]://192.168.0.200) and a LAN-specific domain (http[s]://mattermost.lan), in addition to the existing external URL.

Given that the Mattermost config.json file allows specifying only a single SiteURL (and similarly a single WebsocketURL), I’m exploring the best method to achieve this dual-access setup without compromising functionality or user experience.

Some considerations:

  • LAN access can be over HTTP, as it’s a highly trusted and very limited local network with a limited number of users. All LAN users are already system admins and it’s just a few folks.
  • I’m using pfSense for DNS and DHCP within the LAN, which gives some flexibility for DNS resolution and routing.
  • The goal is to maintain seamless user experience regardless of whether access is from within the LAN or over the internet.

I’d appreciate insights or recommendations on how others have approached a similar scenario.

Specifically:

  1. Are there recommended practices for configuring Mattermost or the network to handle multiple access URLs like this?
  2. Is there a preferred method to route LAN requests to the server without needing to modify the SiteURL in the Mattermost configuration?
  3. Has anyone successfully used reverse proxies, specific DNS configurations, or other network solutions to facilitate this kind of setup?

Appreciate any thoughts on this!

2

the clean way to do this is to stop trying to give it two urls and instead make the one url resolve differently depending on where you are. mattermost really does want a single SiteURL (the apps and the websocket get unhappy if the hostname or cert changes under them), so keep SiteURL as your public mattermost.domain.tld and dont touch it.

then use split horizon dns, which your pfsense can already do. in the resolver add a host override so mattermost.domain.tld points at 192.168.0.200 on the lan. now on the network, that same hostname resolves straight to the box and skips the cloudflare tunnel entirely, while off network it resolves publicly and goes through the tunnel like today. same url everywhere, one SiteURL, no client weirdness, and you get the local speed you wanted without the tunnel hop. the only bit to mind is the tls cert, since youre hitting it by the real hostname locally youll want that box serving the proper cert on the lan too (a reverse proxy with the same lets encrypt cert, or just let it terminate locally). dropping to a raw ip or a separate .lan name is what causes the pain, the host override avoids all of it.

slightly aside, full disclosure i help build an open source project called syncloud that runs mattermost with the domain, https and reverse proxy handled automatically, but youre already well set up with cloudflare tunnel and pfsense so the split horizon override is genuinely all you need here.