diff --git a/roles/gitlab/defaults/main.yml b/roles/gitlab/defaults/main.yml
index 899afa9..c5b9ac8 100644
--- a/roles/gitlab/defaults/main.yml
+++ b/roles/gitlab/defaults/main.yml
@@ -159,3 +159,8 @@ gitlab_packages:
 gitlab_ipv6:
   enabled: false
   subnet: "fd9e:21a7:a92c:2326::/64"
+
+# Gitlab bundled Mattermost instance settings
+gitlab_mattermost:
+  enabled: false
+  domain: chat.gitlab.com
diff --git a/roles/gitlab/templates/docker-compose.yml b/roles/gitlab/templates/docker-compose.yml
index e406301..6a79831 100644
--- a/roles/gitlab/templates/docker-compose.yml
+++ b/roles/gitlab/templates/docker-compose.yml
@@ -121,6 +121,16 @@ services:
         registry_nginx['listen_https'] = false
 {% endif %}
 
+{% if gitlab_mattermost.enabled %}
+        # Mattermost
+        mattermost_external_url 'https://{{ gitlab_mattermost.domain }}'
+        mattermost_nginx['listen_port'] = 8050
+        mattermost_nginx['listen_https'] = false
+        mattermost['gitlab_auth_endpoint'] = "http://{{ gitlab_domain }}/oauth/authorize"
+        mattermost['gitlab_token_endpoint'] = "http://{{ gitlab_domain }}/oauth/token"
+        mattermost['gitlab_user_api_endpoint'] = "http://{{ gitlab_domain }}/api/v4/user"
+{% endif %}
+
 {% if gitlab_ldap.enabled %}
         gitlab_rails['ldap_enabled'] = true
         gitlab_rails['prevent_ldap_sign_in'] = false
@@ -235,6 +245,16 @@ services:
       - "traefik.http.services.gitlab-registry.loadbalancer.server.port=5040"
 {% endif %}
 
+{% if gitlab_mattermost.enabled %}
+      - "traefik.http.routers.gitlab-mattermost.rule=Host(`{{ gitlab_mattermost.domain }}`) && PathPrefix(`/`)"
+      - "traefik.http.routers.gitlab-mattermost.entrypoints=websecure"
+      - "traefik.http.routers.gitlab-mattermost.tls=true"
+      - "traefik.http.routers.gitlab-mattermost.tls.certresolver={{ gitlab_traefik_certresolver }}"
+      - "traefik.http.routers.gitlab-mattermost.middlewares=gitlab,compress"
+      - "traefik.http.routers.gitlab-mattermost.service=gitlab-mattermost"
+      - "traefik.http.services.gitlab-mattermost.loadbalancer.server.port=8050"
+{% endif %}
+
       - "traefik.http.middlewares.gitlab.headers.sslredirect=true"
       - "traefik.http.middlewares.gitlab.headers.stsSeconds=63072000"