From 883f0d255758ad8ea59b94beedb6dab52fef36d2 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 4 Aug 2026 13:57:51 +0000 Subject: [PATCH] Document restricting DMs to teammates in Mattermost's README MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Answers a real gap: Teams alone don't limit who can Direct Message whom — that's a separate System Console setting (TeamSettings.RestrictDirectMessage), free in Team Edition. Documented it in the Teams section along with the caveat that it only filters the DM picker UI, not a hard boundary (existing DMs unaffected, multi-team users can still DM across all their teams). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01NQkdAn3iG5A4WoqU9FHMaN --- services/mattermost.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/services/mattermost.sh b/services/mattermost.sh index 007cc74..9d7682d 100644 --- a/services/mattermost.sh +++ b/services/mattermost.sh @@ -405,6 +405,16 @@ sidebar icons. By default any user can create a team — restrict that at System Console → User Management → Permissions if you only want admins creating them. +By default, Direct Messages ignore team boundaries — anyone on the server +can DM anyone else regardless of shared team membership. To limit the DM +picker to teammates only: **System Console → Site Configuration → Users and +Teams → "Enable users to open Direct Message channels with" → Any member of +the team** (free in Team Edition, no license needed). This is a UI filter, +not a hard boundary — it doesn't hide DM channels that already exist, and a +user in multiple teams can still DM anyone across all of them, not just the +team currently open. If you need real isolation between groups rather than +a tidier picker, that means separate Mattermost instances, not this setting. + ## Voice/Video Calls (Calls plugin) Port 8443/udp must be open on your router/firewall. coturn relay runs on port 3479 (HMAC secret in .env).