]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/prosody.nix
losurdo: syncoid: move to LoadCredentialEncrypted=
[sourcephile-nix.git] / hosts / mermet / prosody.nix
1 { pkgs, lib, config, inputs, hosts, ipv4, ... }:
2 let
3 inherit (config.services) prosody;
4 inherit (hosts.mermet.config.services) coturn;
5 domain = config.networking.domain;
6 in
7 {
8 imports = [
9 prosody/biboumi.nix
10 ];
11 networking.nftables.ruleset = ''
12 table inet filter {
13 chain input-net {
14 tcp dport { xmpp-client, xmpp-server } counter accept comment "prosody: XMPP"
15 tcp dport 5000 counter accept comment "prosody: XMPP XEP-0065 File Transfer Proxy"
16 tcp dport {${lib.concatMapStringsSep "," toString prosody.httpsPorts}} counter accept comment "prosody: HTTPS"
17 }
18 chain output-net {
19 skuid ${prosody.user} counter accept comment "prosody"
20 }
21 }
22 '';
23 /*
24 services.upnpc.redirections =
25 [
26 { description = "XMPP";
27 externalPort = 5222; protocol = "TCP";
28 duration = 30 * 60;
29 service.wantedBy = ["prosody.service"];
30 service.partOf = ["prosody.service"];
31 }
32 { description = "XMPP";
33 externalPort = 5269; protocol = "TCP";
34 duration = 30 * 60;
35 service.wantedBy = ["prosody.service"];
36 service.partOf = ["prosody.service"];
37 }
38 { description = "XMPP-FTP";
39 externalPort = 5000; protocol = "TCP";
40 duration = 30 * 60;
41 service.wantedBy = ["prosody.service"];
42 service.partOf = ["prosody.service"];
43 }
44 ] ++ map (externalPort: {
45 description = "XMPP-HTTPS";
46 inherit externalPort; protocol="TCP";
47 duration = 30 * 60;
48 service.wantedBy = ["prosody.service"];
49 service.partOf = ["prosody.service"];
50 }) prosody.httpsPorts;
51 */
52 /*
53 services.tor.relay.hiddenServices."${domain}/xmpp".map = [ 5222 5269 5000 ] ++ prosody.httpsPorts;
54 */
55 users.groups.acme.members = [ prosody.user ];
56 security.acme.certs."${domain}" = {
57 postRun = "systemctl restart prosody";
58 };
59 fileSystems."/var/lib/prosody" = {
60 device = "rpool/var/prosody";
61 fsType = "zfs";
62 };
63 services.sanoid.datasets = {
64 "rpool/var/prosody" = {
65 use_template = [ "snap" ];
66 daily = 7;
67 };
68 };
69 systemd.services.prosody = {
70 wants = [ "acme-selfsigned-${domain}.service" "acme-${domain}.service"];
71 after = [ "acme-selfsigned-${domain}.service" ];
72 };
73 # sudo -u prosody prosodyctl check
74 services.prosody = {
75 enable = true;
76 xmppComplianceSuite = true;
77 modules = {
78 announce = true;
79 blocklist = true;
80 cloud_notify = false; # not encrypted even with OMEMO
81 #cloud_notify_encrypted = true;
82 groups = true;
83 limits = false;
84 motd = true;
85 server_contact_info = true;
86 watchregistrations = true;
87 websocket = false;
88 welcome = true;
89 proxy65 = false;
90 };
91 extraModules = [
92 "turn_external"
93 #"turncredentials"
94 #"net_multiplex"
95 #"extdisco"
96 ];
97 extraConfig = ''
98 log = {
99 -- debug = "*syslog";
100 info = "*syslog";
101 warn = "*syslog";
102 error = "*syslog";
103 }
104 -- Listen only in IPv4 until hosting provider's IPv6 works well.
105 interfaces = { "0.0.0.0" }
106 c2s_interfaces = { "0.0.0.0" }
107 contact_info = {
108 --abuse = { "mailto:abuse@${domain}", "xmpp:abuse@${domain}" };
109 --admin = { "mailto:admin@${domain}", "xmpp:admin@${domain}" };
110 --feedback = { "http://${domain}/feedback.php", "mailto:feedback@${domain}", "xmpp:feedback@${domain}" };
111 --sales = { "xmpp:bard@${domain}" };
112 --security = { "xmpp:security@${domain}" };
113 --support = { "http://${domain}/support.php", "xmpp:support@${domain}" };
114 }
115 legacy_ssl_ports = { 5222 }
116
117 -- turncredentials_host = "turn.${domain}"
118 -- turncredentials_port = 3478
119 -- turncredentials_secret = "${lib.removeSuffix "\n" (builtins.readFile (inputs.secrets + "/coturn/static-auth-secret"))}";
120
121 turn_external_secret = "${lib.removeSuffix "\n" (builtins.readFile (inputs.secrets + "/coturn/static-auth-secret"))}"
122 turn_external_host = "turn.${domain}"
123 turn_external_port = 3478
124 turn_external_ttl = 86400
125
126 smacks_enabled_s2s = true;
127 smacks_s2s_resend = true;
128
129 --http_files_dir = "/var/lib/prosody/files"
130 --http_external_url = "https://tmp.${domain}:5281"
131 --https_certificate = "/var/lib/acme/${domain}/fullchain.pem"
132 --https_key = "/var/lib/acme/${domain}/key.pem"
133 --certificates = "/var/lib/acme"
134
135 proxy65_ports = 5000
136 Component "proxy65.${domain}" "proxy65"
137 proxy65_address = "proxy65.${domain}"
138 proxy65_acl = { "${domain}" }
139
140 Component "biboumi.${domain}"
141 component_secret = "useless-secret-on-loopback"
142 '';
143 httpFileShare = {
144 domain = "tmp.${domain}";
145 size_limit = 16*1024*1024; # 16 MiB
146 daily_quota = 100*1024*1024; # 100 MiB per day per user
147 global_quota = 1024*1024*1024; # 1 GiB total
148 };
149 #ports = {80};
150 #ssl_ports = {443};
151 c2sRequireEncryption = true;
152 s2sRequireEncryption = true;
153 s2sSecureAuth = true;
154 muc = [
155 {
156 domain = "salons.${domain}";
157 extraConfig = ''
158 restrict_room_creation = "local"
159 max_history_messages = 42
160 muc_room_locking = true
161 muc_room_lock_timeout = 600
162 muc_tombstones = true
163 muc_tombstone_expiry = 31 * 24 * 60 * 60
164 muc_room_default_public = true
165 muc_room_default_members_only = false
166 muc_room_default_moderated = true
167 muc_room_default_public_jids = false
168 muc_room_default_change_subject = true
169 muc_room_default_history_length = 42
170 muc_room_default_language = "fr"
171 '';
172 }
173 ];
174 ssl.key = "/var/lib/acme/${domain}/key.pem";
175 ssl.cert = "/var/lib/acme/${domain}/fullchain.pem";
176 admins = [
177 "julm@${domain}"
178 ];
179 virtualHosts."${domain}" = {
180 enabled = true;
181 domain = "${domain}";
182 ssl.key = "/var/lib/acme/${domain}/key.pem";
183 ssl.cert = "/var/lib/acme/${domain}/fullchain.pem";
184 };
185 allowRegistration = false;
186 authentication = "internal_hashed";
187 httpPorts = [];
188 httpsPorts = [5281];
189 disco_items = [
190 { url = "biboumi.${domain}";
191 description = "Passerelle vers des serveurs IRC (Internet Relay Chat)"; }
192 ];
193 package = pkgs.prosody.override {
194 withCommunityModules = [
195 "turncredentials"
196 #"extdisco"
197 ];
198 };
199 };
200 }