nixos/modules/services/networking/prosody.nix

   1 { config, lib, pkgs, ... }:
   2
   3 with lib;
   4 let
   5   cfg = config.services.prosody;
   6
   7   sslOpts = { ... }: {
   8
   9     options = {
  10
  11       key = mkOption {
  12         type = types.path;
  13         description = "Path to the key file.";
  14       };
  15
  16       # TODO: rename to certificate to match the prosody config
  17       cert = mkOption {
  18         type = types.path;
  19         description = "Path to the certificate file.";
  20       };
  21
  22       extraOptions = mkOption {
  23         type = types.attrs;
  24         default = { };
  25         description = "Extra SSL configuration options.";
  26       };
  27
  28     };
  29   };
  30
  31   discoOpts = {
  32     options = {
  33       url = mkOption {
  34         type = types.str;
  35         description = "URL of the endpoint you want to make discoverable";
  36       };
  37       description = mkOption {
  38         type = types.str;
  39         description = "A short description of the endpoint you want to advertise";
  40       };
  41     };
  42   };
  43
  44   moduleOpts = {
  45     # Required for compliance with https://compliance.conversations.im/about/
  46     roster = mkOption {
  47       type = types.bool;
  48       default = true;
  49       description = "Allow users to have a roster";
  50     };
  51
  52     saslauth = mkOption {
  53       type = types.bool;
  54       default = true;
  55       description = "Authentication for clients and servers. Recommended if you want to log in.";
  56     };
  57
  58     tls = mkOption {
  59       type = types.bool;
  60       default = true;
  61       description = "Add support for secure TLS on c2s/s2s connections";
  62     };
  63
  64     dialback = mkOption {
  65       type = types.bool;
  66       default = true;
  67       description = "s2s dialback support";
  68     };
  69
  70     disco = mkOption {
  71       type = types.bool;
  72       default = true;
  73       description = "Service discovery";
  74     };
  75
  76     # Not essential, but recommended
  77     carbons = mkOption {
  78       type = types.bool;
  79       default = true;
  80       description = "Keep multiple clients in sync";
  81     };
  82
  83     csi = mkOption {
  84       type = types.bool;
  85       default = true;
  86       description = "Implements the CSI protocol that allows clients to report their active/inactive state to the server";
  87     };
  88
  89     cloud_notify = mkOption {
  90       type = types.bool;
  91       default = true;
  92       description = "Push notifications to inform users of new messages or other pertinent information even when they have no XMPP clients online";
  93     };
  94
  95     pep = mkOption {
  96       type = types.bool;
  97       default = true;
  98       description = "Enables users to publish their mood, activity, playing music and more";
  99     };
 100
 101     private = mkOption {
 102       type = types.bool;
 103       default = true;
 104       description = "Private XML storage (for room bookmarks, etc.)";
 105     };
 106
 107     blocklist = mkOption {
 108       type = types.bool;
 109       default = true;
 110       description = "Allow users to block communications with other users";
 111     };
 112
 113     vcard = mkOption {
 114       type = types.bool;
 115       default = false;
 116       description = "Allow users to set vCards";
 117     };
 118
 119     vcard_legacy = mkOption {
 120       type = types.bool;
 121       default = true;
 122       description = "Converts users profiles and Avatars between old and new formats";
 123     };
 124
 125     bookmarks = mkOption {
 126       type = types.bool;
 127       default = true;
 128       description = "Allows interop between older clients that use XEP-0048: Bookmarks in its 1.0 version and recent clients which use it in PEP";
 129     };
 130
 131     # Nice to have
 132     version = mkOption {
 133       type = types.bool;
 134       default = true;
 135       description = "Replies to server version requests";
 136     };
 137
 138     uptime = mkOption {
 139       type = types.bool;
 140       default = true;
 141       description = "Report how long server has been running";
 142     };
 143
 144     time = mkOption {
 145       type = types.bool;
 146       default = true;
 147       description = "Let others know the time here on this server";
 148     };
 149
 150     ping = mkOption {
 151       type = types.bool;
 152       default = true;
 153       description = "Replies to XMPP pings with pongs";
 154     };
 155
 156     register = mkOption {
 157       type = types.bool;
 158       default = true;
 159       description = "Allow users to register on this server using a client and change passwords";
 160     };
 161
 162     mam = mkOption {
 163       type = types.bool;
 164       default = true;
 165       description = "Store messages in an archive and allow users to access it";
 166     };
 167
 168     smacks = mkOption {
 169       type = types.bool;
 170       default = true;
 171       description = "Allow a client to resume a disconnected session, and prevent message loss";
 172     };
 173
 174     # Admin interfaces
 175     admin_adhoc = mkOption {
 176       type = types.bool;
 177       default = true;
 178       description = "Allows administration via an XMPP client that supports ad-hoc commands";
 179     };
 180
 181     http_files = mkOption {
 182       type = types.bool;
 183       default = true;
 184       description = "Serve static files from a directory over HTTP";
 185     };
 186
 187     proxy65 = mkOption {
 188       type = types.bool;
 189       default = true;
 190       description = "Enables a file transfer proxy service which clients behind NAT can use";
 191     };
 192
 193     admin_telnet = mkOption {
 194       type = types.bool;
 195       default = false;
 196       description = "Opens telnet console interface on localhost port 5582";
 197     };
 198
 199     # HTTP modules
 200     bosh = mkOption {
 201       type = types.bool;
 202       default = false;
 203       description = "Enable BOSH clients, aka 'Jabber over HTTP'";
 204     };
 205
 206     websocket = mkOption {
 207       type = types.bool;
 208       default = false;
 209       description = "Enable WebSocket support";
 210     };
 211
 212     # Other specific functionality
 213     limits = mkOption {
 214       type = types.bool;
 215       default = false;
 216       description = "Enable bandwidth limiting for XMPP connections";
 217     };
 218
 219     groups = mkOption {
 220       type = types.bool;
 221       default = false;
 222       description = "Shared roster support";
 223     };
 224
 225     server_contact_info = mkOption {
 226       type = types.bool;
 227       default = false;
 228       description = "Publish contact information for this service";
 229     };
 230
 231     announce = mkOption {
 232       type = types.bool;
 233       default = false;
 234       description = "Send announcement to all online users";
 235     };
 236
 237     welcome = mkOption {
 238       type = types.bool;
 239       default = false;
 240       description = "Welcome users who register accounts";
 241     };
 242
 243     watchregistrations = mkOption {
 244       type = types.bool;
 245       default = false;
 246       description = "Alert admins of registrations";
 247     };
 248
 249     motd = mkOption {
 250       type = types.bool;
 251       default = false;
 252       description = "Send a message to users when they log in";
 253     };
 254
 255     legacyauth = mkOption {
 256       type = types.bool;
 257       default = false;
 258       description = "Legacy authentication. Only used by some old clients and bots";
 259     };
 260   };
 261
 262   toLua = x:
 263     if builtins.isString x then ''"${x}"''
 264     else if builtins.isBool x then boolToString x
 265     else if builtins.isInt x then toString x
 266     else if builtins.isList x then ''{ ${lib.concatStringsSep ", " (map (n: toLua n) x) } }''
 267     else throw "Invalid Lua value";
 268
 269   settingsToLua = prefix: settings: generators.toKeyValue
 270     {
 271       listsAsDuplicateKeys = false;
 272       mkKeyValue = k:
 273         generators.mkKeyValueDefault
 274           {
 275             mkValueString = toLua;
 276           } " = "
 277           (prefix + k);
 278     }
 279     (filterAttrs (_k: v: v != null) settings);
 280
 281   createSSLOptsStr = o: ''
 282     ssl = {
 283       cafile = "/etc/ssl/certs/ca-bundle.crt";
 284       key = "${o.key}";
 285       certificate = "${o.cert}";
 286       ${concatStringsSep "\n" (mapAttrsToList (name: value: "${name} = ${toLua value};") o.extraOptions)}
 287     };
 288   '';
 289
 290   mucOpts = { ... }: {
 291     options = {
 292       domain = mkOption {
 293         type = types.str;
 294         description = "Domain name of the MUC";
 295       };
 296       name = mkOption {
 297         type = types.str;
 298         description = "The name to return in service discovery responses for the MUC service itself";
 299         default = "Prosody Chatrooms";
 300       };
 301       restrictRoomCreation = mkOption {
 302         type = types.enum [ true false "admin" "local" ];
 303         default = false;
 304         description = "Restrict room creation to server admins";
 305       };
 306       maxHistoryMessages = mkOption {
 307         type = types.int;
 308         default = 20;
 309         description = "Specifies a limit on what each room can be configured to keep";
 310       };
 311       roomLocking = mkOption {
 312         type = types.bool;
 313         default = true;
 314         description = ''
 315           Enables room locking, which means that a room must be
 316           configured before it can be used. Locked rooms are invisible
 317           and cannot be entered by anyone but the creator
 318         '';
 319       };
 320       roomLockTimeout = mkOption {
 321         type = types.int;
 322         default = 300;
 323         description = ''
 324           Timout after which the room is destroyed or unlocked if not
 325           configured, in seconds
 326         '';
 327       };
 328       tombstones = mkOption {
 329         type = types.bool;
 330         default = true;
 331         description = ''
 332           When a room is destroyed, it leaves behind a tombstone which
 333           prevents the room being entered or recreated. It also allows
 334           anyone who was not in the room at the time it was destroyed
 335           to learn about it, and to update their bookmarks. Tombstones
 336           prevents the case where someone could recreate a previously
 337           semi-anonymous room in order to learn the real JIDs of those
 338           who often join there.
 339         '';
 340       };
 341       tombstoneExpiry = mkOption {
 342         type = types.int;
 343         default = 2678400;
 344         description = ''
 345           This settings controls how long a tombstone is considered
 346           valid. It defaults to 31 days. After this time, the room in
 347           question can be created again.
 348         '';
 349       };
 350
 351       vcard_muc = mkOption {
 352         type = types.bool;
 353         default = true;
 354         description = "Adds the ability to set vCard for Multi User Chat rooms";
 355       };
 356
 357       # Extra parameters. Defaulting to prosody default values.
 358       # Adding them explicitly to make them visible from the options
 359       # documentation.
 360       #
 361       # See https://prosody.im/doc/modules/mod_muc for more details.
 362       roomDefaultPublic = mkOption {
 363         type = types.bool;
 364         default = true;
 365         description = "If set, the MUC rooms will be public by default.";
 366       };
 367       roomDefaultMembersOnly = mkOption {
 368         type = types.bool;
 369         default = false;
 370         description = "If set, the MUC rooms will only be accessible to the members by default.";
 371       };
 372       roomDefaultModerated = mkOption {
 373         type = types.bool;
 374         default = false;
 375         description = "If set, the MUC rooms will be moderated by default.";
 376       };
 377       roomDefaultPublicJids = mkOption {
 378         type = types.bool;
 379         default = false;
 380         description = "If set, the MUC rooms will display the public JIDs by default.";
 381       };
 382       roomDefaultChangeSubject = mkOption {
 383         type = types.bool;
 384         default = false;
 385         description = "If set, the rooms will display the public JIDs by default.";
 386       };
 387       roomDefaultHistoryLength = mkOption {
 388         type = types.int;
 389         default = 20;
 390         description = "Number of history message sent to participants by default.";
 391       };
 392       roomDefaultLanguage = mkOption {
 393         type = types.str;
 394         default = "en";
 395         description = "Default room language.";
 396       };
 397       extraConfig = mkOption {
 398         type = types.lines;
 399         default = "";
 400         description = "Additional MUC specific configuration";
 401       };
 402     };
 403   };
 404
 405   uploadHttpOpts = { ... }: {
 406     options = {
 407       domain = mkOption {
 408         type = types.nullOr types.str;
 409         description = "Domain name for the http-upload service";
 410       };
 411       uploadFileSizeLimit = mkOption {
 412         type = types.str;
 413         default = "50 * 1024 * 1024";
 414         description = "Maximum file size, in bytes. Defaults to 50MB.";
 415       };
 416       uploadExpireAfter = mkOption {
 417         type = types.str;
 418         default = "60 * 60 * 24 * 7";
 419         description = "Max age of a file before it gets deleted, in seconds.";
 420       };
 421       userQuota = mkOption {
 422         type = types.nullOr types.int;
 423         default = null;
 424         example = 1234;
 425         description = ''
 426           Maximum size of all uploaded files per user, in bytes. There
 427           will be no quota if this option is set to null.
 428         '';
 429       };
 430       httpUploadPath = mkOption {
 431         type = types.str;
 432         description = ''
 433           Directory where the uploaded files will be stored
 434           when the http_upload module is used.
 435           By default, uploaded files are put in a sub-directory of the
 436           default Prosody storage path (usually /var/lib/prosody).
 437         '';
 438         default = "/var/lib/prosody";
 439       };
 440     };
 441   };
 442
 443   httpFileShareOpts = { ... }: {
 444     freeformType = with types;
 445       let atom = oneOf [ int bool str (listOf atom) ]; in
 446       attrsOf (nullOr atom);
 447     options.domain = mkOption {
 448       type = with types; nullOr str;
 449       description = "Domain name for a http_file_share service.";
 450     };
 451   };
 452
 453   vHostOpts = { ... }: {
 454
 455     options = {
 456
 457       # TODO: require attribute
 458       domain = mkOption {
 459         type = types.str;
 460         description = "Domain name";
 461       };
 462
 463       enabled = mkOption {
 464         type = types.bool;
 465         default = false;
 466         description = "Whether to enable the virtual host";
 467       };
 468
 469       ssl = mkOption {
 470         type = types.nullOr (types.submodule sslOpts);
 471         default = null;
 472         description = "Paths to SSL files";
 473       };
 474
 475       extraConfig = mkOption {
 476         type = types.lines;
 477         default = "";
 478         description = "Additional virtual host specific configuration";
 479       };
 480
 481     };
 482
 483   };
 484
 485 in
 486
 487 {
 488
 489   ###### interface
 490
 491   options = {
 492
 493     services.prosody = {
 494
 495       enable = mkOption {
 496         type = types.bool;
 497         default = false;
 498         description = "Whether to enable the prosody server";
 499       };
 500
 501       xmppComplianceSuite = mkOption {
 502         type = types.bool;
 503         default = true;
 504         description = ''
 505           The XEP-0423 defines a set of recommended XEPs to implement
 506           for a server. It's generally a good idea to implement this
 507           set of extensions if you want to provide your users with a
 508           good XMPP experience.
 509
 510           This NixOS module aims to provide a "advanced server"
 511           experience as per defined in the XEP-0423[1] specification.
 512
 513           Setting this option to true will prevent you from building a
 514           NixOS configuration which won't comply with this standard.
 515           You can explicitely decide to ignore this standard if you
 516           know what you are doing by setting this option to false.
 517
 518           [1] https://xmpp.org/extensions/xep-0423.html
 519         '';
 520       };
 521
 522       package = mkOption {
 523         type = types.package;
 524         description = "Prosody package to use";
 525         default = pkgs.prosody;
 526         defaultText = literalExpression "pkgs.prosody";
 527         example = literalExpression ''
 528           pkgs.prosody.override {
 529             withExtraLibs = [ pkgs.luaPackages.lpty ];
 530             withCommunityModules = [ "auth_external" ];
 531           };
 532         '';
 533       };
 534
 535       dataDir = mkOption {
 536         type = types.path;
 537         description = "Directory where Prosody stores its data";
 538         default = "/var/lib/prosody";
 539       };
 540
 541       disco_items = mkOption {
 542         type = types.listOf (types.submodule discoOpts);
 543         default = [ ];
 544         description = "List of discoverable items you want to advertise.";
 545       };
 546
 547       user = mkOption {
 548         type = types.str;
 549         default = "prosody";
 550         description = "User account under which prosody runs.";
 551       };
 552
 553       group = mkOption {
 554         type = types.str;
 555         default = "prosody";
 556         description = "Group account under which prosody runs.";
 557       };
 558
 559       allowRegistration = mkOption {
 560         type = types.bool;
 561         default = false;
 562         description = "Allow account creation";
 563       };
 564
 565       # HTTP server-related options
 566       httpPorts = mkOption {
 567         type = types.listOf types.int;
 568         description = "Listening HTTP ports list for this service.";
 569         default = [ 5280 ];
 570       };
 571
 572       httpInterfaces = mkOption {
 573         type = types.listOf types.str;
 574         default = [ "*" "::" ];
 575         description = "Interfaces on which the HTTP server will listen on.";
 576       };
 577
 578       httpsPorts = mkOption {
 579         type = types.listOf types.int;
 580         description = "Listening HTTPS ports list for this service.";
 581         default = [ 5281 ];
 582       };
 583
 584       httpsInterfaces = mkOption {
 585         type = types.listOf types.str;
 586         default = [ "*" "::" ];
 587         description = "Interfaces on which the HTTPS server will listen on.";
 588       };
 589
 590       c2sRequireEncryption = mkOption {
 591         type = types.bool;
 592         default = true;
 593         description = ''
 594           Force clients to use encrypted connections? This option will
 595           prevent clients from authenticating unless they are using encryption.
 596         '';
 597       };
 598
 599       s2sRequireEncryption = mkOption {
 600         type = types.bool;
 601         default = true;
 602         description = ''
 603           Force servers to use encrypted connections? This option will
 604           prevent servers from authenticating unless they are using encryption.
 605           Note that this is different from authentication.
 606         '';
 607       };
 608
 609       s2sSecureAuth = mkOption {
 610         type = types.bool;
 611         default = false;
 612         description = ''
 613           Force certificate authentication for server-to-server connections?
 614           This provides ideal security, but requires servers you communicate
 615           with to support encryption AND present valid, trusted certificates.
 616           For more information see https://prosody.im/doc/s2s#security
 617         '';
 618       };
 619
 620       s2sInsecureDomains = mkOption {
 621         type = types.listOf types.str;
 622         default = [ ];
 623         example = [ "insecure.example.com" ];
 624         description = ''
 625           Some servers have invalid or self-signed certificates. You can list
 626           remote domains here that will not be required to authenticate using
 627           certificates. They will be authenticated using DNS instead, even
 628           when s2s_secure_auth is enabled.
 629         '';
 630       };
 631
 632       s2sSecureDomains = mkOption {
 633         type = types.listOf types.str;
 634         default = [ ];
 635         example = [ "jabber.org" ];
 636         description = ''
 637           Even if you leave s2s_secure_auth disabled, you can still require valid
 638           certificates for some domains by specifying a list here.
 639         '';
 640       };
 641
 642
 643       modules = moduleOpts;
 644
 645       extraModules = mkOption {
 646         type = types.listOf types.str;
 647         default = [ ];
 648         description = "Enable custom modules";
 649       };
 650
 651       extraPluginPaths = mkOption {
 652         type = types.listOf types.path;
 653         default = [ ];
 654         description = "Addtional path in which to look find plugins/modules";
 655       };
 656
 657       uploadHttp = mkOption {
 658         description = ''
 659           Configures the old Prosody builtin HTTP server to handle user uploads.
 660         '';
 661         type = types.nullOr (types.submodule uploadHttpOpts);
 662         default = null;
 663         example = {
 664           domain = "uploads.my-xmpp-example-host.org";
 665         };
 666       };
 667
 668       httpFileShare = mkOption {
 669         description = ''
 670           Configures the http_file_share module to handle user uploads.
 671         '';
 672         type = types.nullOr (types.submodule httpFileShareOpts);
 673         default = null;
 674         example = {
 675           domain = "uploads.my-xmpp-example-host.org";
 676         };
 677       };
 678
 679       muc = mkOption {
 680         type = types.listOf (types.submodule mucOpts);
 681         default = [ ];
 682         example = [{
 683           domain = "conference.my-xmpp-example-host.org";
 684         }];
 685         description = "Multi User Chat (MUC) configuration";
 686       };
 687
 688       virtualHosts = mkOption {
 689
 690         description = "Define the virtual hosts";
 691
 692         type = with types; attrsOf (submodule vHostOpts);
 693
 694         example = {
 695           myhost = {
 696             domain = "my-xmpp-example-host.org";
 697             enabled = true;
 698           };
 699         };
 700
 701         default = {
 702           localhost = {
 703             domain = "localhost";
 704             enabled = true;
 705           };
 706         };
 707
 708       };
 709
 710       ssl = mkOption {
 711         type = types.nullOr (types.submodule sslOpts);
 712         default = null;
 713         description = "Paths to SSL files";
 714       };
 715
 716       admins = mkOption {
 717         type = types.listOf types.str;
 718         default = [ ];
 719         example = [ "admin1@example.com" "admin2@example.com" ];
 720         description = "List of administrators of the current host";
 721       };
 722
 723       authentication = mkOption {
 724         type = types.enum [ "internal_plain" "internal_hashed" "cyrus" "anonymous" ];
 725         default = "internal_hashed";
 726         example = "internal_plain";
 727         description = "Authentication mechanism used for logins.";
 728       };
 729
 730       extraConfig = mkOption {
 731         type = types.lines;
 732         default = "";
 733         description = "Additional prosody configuration";
 734       };
 735
 736     };
 737   };
 738
 739
 740   ###### implementation
 741
 742   config = mkIf cfg.enable {
 743
 744     assertions =
 745       let
 746         genericErrMsg = ''
 747
 748           Having a server not XEP-0423-compliant might make your XMPP
 749           experience terrible. See the NixOS manual for further
 750           informations.
 751
 752           If you know what you're doing, you can disable this warning by
 753           setting config.services.prosody.xmppComplianceSuite to false.
 754       '';
 755         errors = [
 756           {
 757             assertion = (builtins.length cfg.muc > 0) || !cfg.xmppComplianceSuite;
 758             message = ''
 759               You need to setup at least a MUC domain to comply with
 760               XEP-0423.
 761             '' + genericErrMsg;
 762           }
 763           {
 764             assertion = cfg.uploadHttp != null || cfg.httpFileShare != null || !cfg.xmppComplianceSuite;
 765             message = ''
 766               You need to setup the http_upload or http_file_share modules through
 767               config.services.prosody.uploadHttp
 768               or config.services.prosody.httpFileShare
 769               to comply with XEP-0423.
 770             '' + genericErrMsg;
 771           }
 772         ];
 773       in
 774       errors;
 775
 776     environment.systemPackages = [ cfg.package ];
 777
 778     environment.etc."prosody/prosody.cfg.lua".text =
 779       let
 780         httpDiscoItems =
 781           optional (cfg.uploadHttp != null)
 782             { url = cfg.uploadHttp.domain; description = "HTTP upload endpoint"; } ++
 783           optional (cfg.httpFileShare != null)
 784             { url = cfg.httpFileShare.domain; description = "HTTP file share endpoint"; };
 785         mucDiscoItems = builtins.foldl'
 786           (acc: muc: [{ url = muc.domain; description = "${muc.domain} MUC endpoint"; }] ++ acc)
 787           [ ]
 788           cfg.muc;
 789         discoItems = cfg.disco_items ++ httpDiscoItems ++ mucDiscoItems;
 790       in
 791       ''
 792
 793       pidfile = "/run/prosody/prosody.pid"
 794
 795       log = "*syslog"
 796
 797       data_path = "${cfg.dataDir}"
 798       plugin_paths = {
 799         ${lib.concatStringsSep ", " (map (n: "\"${n}\"") cfg.extraPluginPaths) }
 800       }
 801
 802       ${ optionalString  (cfg.ssl != null) (createSSLOptsStr cfg.ssl) }
 803
 804       admins = ${toLua cfg.admins}
 805
 806       -- we already build with libevent, so we can just enable it for a more performant server
 807       use_libevent = true
 808
 809       modules_enabled = {
 810
 811         ${ lib.concatStringsSep "\n  " (lib.mapAttrsToList
 812           (name: val: optionalString val "${toLua name};")
 813         cfg.modules) }
 814         ${ lib.concatStringsSep "\n" (map (x: "${toLua x};") cfg.package.communityModules)}
 815         ${ lib.concatStringsSep "\n" (map (x: "${toLua x};") cfg.extraModules)}
 816       };
 817
 818       disco_items = {
 819       ${ lib.concatStringsSep "\n" (builtins.map (x: ''{ "${x.url}", "${x.description}"};'') discoItems)}
 820       };
 821
 822       allow_registration = ${toLua cfg.allowRegistration}
 823
 824       c2s_require_encryption = ${toLua cfg.c2sRequireEncryption}
 825
 826       s2s_require_encryption = ${toLua cfg.s2sRequireEncryption}
 827
 828       s2s_secure_auth = ${toLua cfg.s2sSecureAuth}
 829
 830       s2s_insecure_domains = ${toLua cfg.s2sInsecureDomains}
 831
 832       s2s_secure_domains = ${toLua cfg.s2sSecureDomains}
 833
 834       authentication = ${toLua cfg.authentication}
 835
 836       http_interfaces = ${toLua cfg.httpInterfaces}
 837
 838       https_interfaces = ${toLua cfg.httpsInterfaces}
 839
 840       http_ports = ${toLua cfg.httpPorts}
 841
 842       https_ports = ${toLua cfg.httpsPorts}
 843
 844       ${ cfg.extraConfig }
 845
 846       ${lib.concatMapStrings (muc: ''
 847         Component ${toLua muc.domain} "muc"
 848             modules_enabled = { "muc_mam"; ${optionalString muc.vcard_muc ''"vcard_muc";'' } }
 849             name = ${toLua muc.name}
 850             restrict_room_creation = ${toLua muc.restrictRoomCreation}
 851             max_history_messages = ${toLua muc.maxHistoryMessages}
 852             muc_room_locking = ${toLua muc.roomLocking}
 853             muc_room_lock_timeout = ${toLua muc.roomLockTimeout}
 854             muc_tombstones = ${toLua muc.tombstones}
 855             muc_tombstone_expiry = ${toLua muc.tombstoneExpiry}
 856             muc_room_default_public = ${toLua muc.roomDefaultPublic}
 857             muc_room_default_members_only = ${toLua muc.roomDefaultMembersOnly}
 858             muc_room_default_moderated = ${toLua muc.roomDefaultModerated}
 859             muc_room_default_public_jids = ${toLua muc.roomDefaultPublicJids}
 860             muc_room_default_change_subject = ${toLua muc.roomDefaultChangeSubject}
 861             muc_room_default_history_length = ${toLua muc.roomDefaultHistoryLength}
 862             muc_room_default_language = ${toLua muc.roomDefaultLanguage}
 863             ${ muc.extraConfig }
 864         '') cfg.muc}
 865
 866       ${ lib.optionalString (cfg.uploadHttp != null) ''
 867         Component ${toLua cfg.uploadHttp.domain} "http_upload"
 868             http_upload_file_size_limit = ${cfg.uploadHttp.uploadFileSizeLimit}
 869             http_upload_expire_after = ${cfg.uploadHttp.uploadExpireAfter}
 870             ${lib.optionalString (cfg.uploadHttp.userQuota != null) "http_upload_quota = ${toLua cfg.uploadHttp.userQuota}"}
 871             http_upload_path = ${toLua cfg.uploadHttp.httpUploadPath}
 872       ''}
 873
 874       ${ lib.optionalString (cfg.httpFileShare != null) ''
 875         Component ${toLua cfg.httpFileShare.domain} "http_file_share"
 876         ${settingsToLua "  http_file_share_" (cfg.httpFileShare // { domain = null; })}
 877       ''}
 878
 879       ${ lib.concatStringsSep "\n" (lib.mapAttrsToList (_n: v: ''
 880         VirtualHost "${v.domain}"
 881           enabled = ${boolToString v.enabled};
 882           ${ optionalString (v.ssl != null) (createSSLOptsStr v.ssl) }
 883           ${ v.extraConfig }
 884         '') cfg.virtualHosts) }
 885     '';
 886
 887     users.users.prosody = mkIf (cfg.user == "prosody") {
 888       uid = config.ids.uids.prosody;
 889       description = "Prosody user";
 890       createHome = true;
 891       inherit (cfg) group;
 892       home = "${cfg.dataDir}";
 893     };
 894
 895     users.groups.prosody = mkIf (cfg.group == "prosody") {
 896       gid = config.ids.gids.prosody;
 897     };
 898
 899     systemd.services.prosody = {
 900       description = "Prosody XMPP server";
 901       after = [ "network-online.target" ];
 902       wants = [ "network-online.target" ];
 903       wantedBy = [ "multi-user.target" ];
 904       restartTriggers = [ config.environment.etc."prosody/prosody.cfg.lua".source ];
 905       serviceConfig = {
 906         User = cfg.user;
 907         Group = cfg.group;
 908         Type = "forking";
 909         RuntimeDirectory = [ "prosody" ];
 910         PIDFile = "/run/prosody/prosody.pid";
 911         ExecStart = "${cfg.package}/bin/prosodyctl start";
 912         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
 913
 914         MemoryDenyWriteExecute = true;
 915         PrivateDevices = true;
 916         PrivateMounts = true;
 917         PrivateTmp = true;
 918         ProtectControlGroups = true;
 919         ProtectHome = true;
 920         ProtectHostname = true;
 921         ProtectKernelModules = true;
 922         ProtectKernelTunables = true;
 923         RestrictNamespaces = true;
 924         RestrictRealtime = true;
 925         RestrictSUIDSGID = true;
 926       };
 927     };
 928
 929   };
 930   meta.doc = ./prosody.xml;
 931 }