diff --git a/roles/prosody/defaults/main.yml b/roles/prosody/defaults/main.yml index ebd029b..bbadc9c 100644 --- a/roles/prosody/defaults/main.yml +++ b/roles/prosody/defaults/main.yml @@ -3,42 +3,6 @@ prosody_domain: "jabber.ccchb.de" prosody_ssl_cert: "/etc/letsencrypt/live/{{ prosody_domain }}/fullchain.pem" prosody_ssl_key: "/etc/letsencrypt/live/{{ prosody_domain }}/privkey.pem" prosody_allow_registration: false -prosody_modules: - - roster - - saslauth - - tls - - dialback - - disco - - private - - bookmarks - - vcard - - proxy65 - - legacyauth - - version - - uptime - - time - - ping - - pep - - register - - adhoc - - admin_adhoc - - posix - - bosh - - websocket - - groups - - announce - - watchregistrations - - blocking - - smacks - - carbons - - cloud_notify - - csi - - mam - - filter_chatstates - - throttle_presence - - http_upload - - turncredentials - - vcard_legacy prosody_nginx_install: true prosody_nginx_conf: | diff --git a/roles/prosody/templates/nginx.j2 b/roles/prosody/templates/nginx.j2 index bf6f639..6609a1d 100644 --- a/roles/prosody/templates/nginx.j2 +++ b/roles/prosody/templates/nginx.j2 @@ -15,4 +15,8 @@ server { proxy_set_header Host {{ prosody_domain }}; proxy_pass http://127.0.0.1:5280/upload; } + + location /file_share { + proxy_pass http://127.0.0.1:5280/file_share; + } } diff --git a/roles/prosody/templates/prosody.cfg.lua.j2 b/roles/prosody/templates/prosody.cfg.lua.j2 index 6ac7996..32dfeae 100644 --- a/roles/prosody/templates/prosody.cfg.lua.j2 +++ b/roles/prosody/templates/prosody.cfg.lua.j2 @@ -1,5 +1,15 @@ -- Prosody XMPP Server Configuration --- {{ ansible_managed }} +-- +-- Information on configuring Prosody can be found on our +-- website at http://prosody.im/doc/configure +-- +-- Tip: You can check that the syntax of this file is correct +-- when you have finished by running: luac -p prosody.cfg.lua +-- If there are any errors, it will let you know what and where +-- they are, otherwise it will keep quiet. +-- +-- Good luck, and happy Jabbering! + ---------- Server-wide settings ---------- -- Settings in this section apply to the whole server and are the default settings @@ -13,27 +23,62 @@ admins = { "deelkar@jabber.ccchb.de", "freak@jabber.ccchb.de", "jali@jabber.ccch -- Enable use of libevent for better performance under high load -- For more information see: http://prosody.im/doc/libevent -use_libevent = false; - -plugin_paths = { "/opt/prosody-modules" } +use_libevent = true; -- This is the list of modules Prosody will load on startup. -- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too. -- Documentation on modules can be found at: http://prosody.im/doc/modules modules_enabled = { - {% for module in prosody_modules %} - "{{ module }}"; - {% endfor %} + + -- Generally required + "roster"; -- Allow users to have a roster. Recommended ;) + "saslauth"; -- Authentication for clients and servers. Recommended if you want to log in. + "tls"; -- Add support for secure TLS on c2s/s2s connections + "dialback"; -- s2s dialback support + "disco"; -- Service discovery + "posix"; -- POSIX functionality, sends server to background, enables syslog, etc. + + -- Not essential, but recommended + "private"; -- Private XML storage (for room bookmarks, etc.) + "vcard"; -- Allow users to set vCards + + -- These are commented by default as they have a performance impact + --"privacy"; -- Support privacy lists + --"compression"; -- Stream compression (requires the lua-zlib package installed) + + -- Nice to have + "version"; -- Replies to server version requests + "uptime"; -- Report how long server has been running + "time"; -- Let others know the time here on this server + "ping"; -- Replies to XMPP pings with pongs + "pep"; -- Enables users to publish their mood, activity, playing music and more + "register"; -- Allow users to register on this server using a client and change passwords + + -- Admin interfaces + "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands + --"admin_telnet"; -- Opens telnet console interface on localhost port 5582 + + -- HTTP modules + "bosh"; -- Enable BOSH clients, aka "Jabber over HTTP" + "http_files"; -- Serve static files from a directory over HTTP + "http_file_share"; + + -- Other specific functionality + "groups"; -- Shared roster support + --"announce"; -- Send announcement to all online users + --"welcome"; -- Welcome users who register accounts + "watchregistrations"; -- Alert admins of registrations + --"motd"; -- Send a message to users when they log in + --"legacyauth"; -- Legacy authentication. Only used by some old clients and bots. + "turn_external"; }; --- These modules are auto-loaded, should you --- (for some mad reason) want to disable --- them then uncomment them below +-- These modules are auto-loaded, but should you want +-- to disable them then uncomment them here: modules_disabled = { - -- "presence"; -- Route user/contact status information - -- "message"; -- Route messages - -- "iq"; -- Route info queries -- "offline"; -- Store offline messages + -- "c2s"; -- Handle client connections + -- "s2s"; -- Handle server-to-server connections }; -- Disable account creation by default, for security @@ -42,26 +87,33 @@ allow_registration = {{ prosody_allow_registration }}; -- These are the SSL/TLS-related settings. If you don't want -- to use SSL/TLS, you may comment or remove this --- *** DUMMY CERT *** DO NOT CHANGE *** SET CERT IN HOST SECTION *** -ssl = { - protocol = "sslv23"; - key = "{{ prosody_ssl_key }}"; - certificate = "{{ prosody_ssl_cert }}"; - dhparam = "/etc/prosody/certs/dh-2048.pem"; - options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" }; - ciphers = "ECDH:DH:HIGH+kEDH:HIGH+kEECDH:HIGH:!CAMELLIA128:!3DES:!MD5:!RC4:!aNULL:!NULL:!EXPORT:!LOW:!MEDIUM"; -} -legacy_ssl_ports = { 5223 } -http_external_url = "https://{{ prosody_domain }}/" --- Only allow encrypted streams? Encryption is already used when --- available. These options will cause Prosody to deny connections that --- are not encrypted. Note that some servers do not support s2s --- encryption or have it disabled, including gmail.com and Google Apps --- domains. +-- Force clients to use encrypted connections? This option will +-- prevent clients from authenticating unless they are using encryption. ---c2s_require_encryption = false ---s2s_require_encryption = false +c2s_require_encryption = true + +-- Force certificate authentication for server-to-server connections? +-- This provides ideal security, but requires servers you communicate +-- with to support encryption AND present valid, trusted certificates. +-- NOTE: Your version of LuaSec must support certificate verification! +-- For more information see http://prosody.im/doc/s2s#security + +s2s_secure_auth = false + +-- Many servers don't support encryption or have invalid or self-signed +-- certificates. You can list domains here that will not be required to +-- authenticate using certificates. They will be authenticated using DNS. + +--s2s_insecure_domains = { "gmail.com" } + +-- Even if you leave s2s_secure_auth disabled, you can still require valid +-- certificates for some domains by specifying a list here. + +--s2s_secure_domains = { "jabber.org" } + +-- Required for init scripts and prosodyctl +pidfile = "/var/run/prosody/prosody.pid" -- Select the authentication backend to use. The 'internal' providers -- use Prosody's configured data storage to store the authentication data. @@ -84,35 +136,16 @@ authentication = "internal_hashed" --sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" } --sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" } - --- STUN/TURN ---turncredentials_host = "jabber.emma.ccchb.de" -turncredentials_host = "einstein.cskreie.de" -turncredentials_secret = "gabbagabbahey" - - --- HTTP-UPLOAD -http_upload_file_size_limit = 10485760 -- 10M -http_max_content_size = 20971520 -- 20M -http_upload_quota = 104857600 -- 100M -http_upload_expire_after = 2592000 -- 30d - -- Logging configuration -- For advanced logging see http://prosody.im/doc/logging --- Hint: If you create a new log file or rename them, don't forget --- to update the logrotate config at /etc/logrotate.d/prosody log = { - -- Log all error messages to prosody.err error = "/var/log/prosody/prosody.err"; - -- Log everything of level "info" and higher (that is, all except "debug" messages) - -- to prosody.log - -- info = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for more verbose logging - -- debug = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for more verbose logging - --"*syslog"; -- Uncomment this for logging to syslog } --- Pidfile, used by prosodyctl and the init.d script -pidfile = "/var/run/prosody/prosody.pid"; +http_external_url = "https://{{ prosody_domain }}/" +trusted_proxies = { "127.0.0.1", "::1", "192.168.1.1", } +turn_external_host = "einstein.cskreie.de" +turn_external_secret = "gabbagabbahey" ----------- Virtual hosts ----------- -- You need to add a VirtualHost entry for each domain you wish Prosody to serve. @@ -131,9 +164,9 @@ VirtualHost "{{ prosody_domain }}" protocol = "sslv23"; key = "{{ prosody_ssl_key }}"; certificate = "{{ prosody_ssl_cert }}"; - dhparam = "/etc/prosody/certs/dh-2048.pem"; - options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" }; - ciphers = "ECDH:DH:HIGH+kEDH:HIGH+kEECDH:HIGH:!CAMELLIA128:!3DES:!MD5:!RC4:!aNULL:!NULL:!EXPORT:!LOW:!MEDIUM"; + dhparam = "/etc/prosody/certs/dh-2048.pem"; + options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" }; + ciphers = "ECDH:DH:HIGH+kEDH:HIGH+kEECDH:HIGH:!CAMELLIA128:!3DES:!MD5:!RC4:!aNULL:!NULL:!EXPORT:!LOW:!MEDIUM"; } ------ Components ------ @@ -142,10 +175,15 @@ VirtualHost "{{ prosody_domain }}" -- For more information on components, see http://prosody.im/doc/components ---Set up a MUC (multi-user chat) room server on conference.example.com: +--Component "conference.example.com" "muc" Component "muc.{{ prosody_domain }}" "muc" -modules_enabled = { - "vcard_muc", "muc_mam", -} + modules_enabled = { + "vcard_muc", + "muc_mam" + } + +Component "upload.{{ prosody_domain }}" "http_file_share" + -- Set up a SOCKS5 bytestream proxy for server-proxied file transfers: --Component "proxy.example.com" "proxy65" @@ -157,4 +195,3 @@ modules_enabled = { -- --Component "gateway.example.com" -- component_secret = "password" -