machines/losurdo/prosody.nix

   1 { pkgs, lib, config, machines, ... }:
   2 let
   3   inherit (builtins.extraBuiltins) pass-chomp;
   4   inherit (config) networking;
   5   inherit (config.services) prosody;
   6   inherit (machines.mermet.config.services) coturn;
   7 in
   8 {
   9 imports = [
  10   #prosody/biboumi.nix
  11 ];
  12 networking.nftables.ruleset = ''
  13   add rule inet filter net2fw tcp dport {5222,5269} counter accept comment "XMPP"
  14   add rule inet filter net2fw tcp dport 5000 counter accept comment "XMPP XEP-0065 File Transfer Proxy"
  15   add rule inet filter net2fw tcp dport {${lib.concatMapStringsSep "," toString prosody.httpsPorts}} counter accept comment "XMPP HTTPS"
  16   add rule inet filter fw2net meta skuid ${prosody.user} counter accept comment "Prosody"
  17   add rule inet filter fw2net meta skuid ${prosody.user} tcp dport 3478 counter accept comment "TURN"
  18   add rule inet filter fw2net meta skuid ${prosody.user} udp dport 3478 counter accept comment "TURN"
  19 '';
  20 users.groups.acme.members = [ prosody.user ];
  21 security.acme.certs."${networking.domain}" = {
  22   postRun = "systemctl reload prosody";
  23 };
  24 systemd.services.prosody = {
  25   wants = [ "acme-selfsigned-${networking.domain}.service" "acme-${networking.domain}.service"];
  26   after = [ "acme-selfsigned-${networking.domain}.service" ];
  27 };
  28 # sudo -u prosody prosodyctl check
  29 services.prosody = {
  30   enable = true;
  31   xmppComplianceSuite = true;
  32   modules = {
  33     announce = true;
  34     cloud_notify = true;
  35     groups = true;
  36     limits = false;
  37     motd = true;
  38     watchregistrations = true;
  39     websocket = false;
  40     welcome = true;
  41     proxy65 = false;
  42   };
  43   extraModules = [
  44     #"turncredentials"
  45     #"net_multiplex"
  46     "extdisco"
  47   ];
  48   extraConfig = ''
  49     --turncredentials_host = "turn.${networking.domain}"
  50     --turncredentials_secret = "${pass-chomp "machines/mermet/coturn/static-auth-secret"}"
  51     --turncredentials_port = 3478
  52
  53     external_services = {
  54       ["stun.${networking.domain}"] = {
  55         type="stun";
  56         transport="udp";
  57         port="${toString coturn.alt-listening-port}";
  58       };
  59       ["turn.${networking.domain}"] = {
  60         type="turn";
  61         transport="udp";
  62         port="${toString coturn.listening-port}";
  63         password="${pass-chomp "machines/mermet/coturn/static-auth-secret"}";
  64         -- username="";
  65       };
  66     }
  67
  68     --http_files_dir = "/var/lib/prosody/files"
  69     --http_external_url = "https://tmp.${networking.domain}:5281"
  70     --https_certificate = "/var/lib/acme/${networking.domain}/fullchain.pem"
  71     --https_key = "/var/lib/acme/${networking.domain}/key.pem"
  72     --certificates = "/var/lib/acme"
  73
  74     proxy65_ports = 5000
  75     Component "proxy65.${networking.domain}" "proxy65"
  76       proxy65_address = "proxy65.${networking.domain}"
  77       proxy65_acl = { "${networking.domain}" }
  78
  79     -- Component "irc.${networking.domain}"
  80     --   component_secret = "useless-secret-on-loopback"
  81   '';
  82   #ports = {80};
  83   #ssl_ports = {443};
  84   c2sRequireEncryption = true;
  85   s2sRequireEncryption = true;
  86   s2sSecureAuth = true;
  87   uploadHttp = {
  88     domain = "tmp.${networking.domain}";
  89     # Prosody's HTTP parser limit on body size
  90     uploadFileSizeLimit = "10485760";
  91     userQuota = 100 * 1024 * 1024;
  92     uploadExpireAfter = "60 * 60 * 24 * 7";
  93     httpUploadPath = "/var/lib/prosody/upload";
  94   };
  95   muc = [
  96     { domain = "salons.${networking.domain}";
  97       extraConfig = ''
  98         restrict_room_creation = "local"
  99         max_history_messages = 42
 100         muc_room_locking = true
 101         muc_room_lock_timeout = 600
 102         muc_tombstones = true
 103         muc_tombstone_expiry = 31 * 24 * 60 * 60
 104         muc_room_default_public = true
 105         muc_room_default_members_only = false
 106         muc_room_default_moderated = true
 107         muc_room_default_public_jids = false
 108         muc_room_default_change_subject = true
 109         muc_room_default_history_length = 42
 110         muc_room_default_language = "fr"
 111       '';
 112     }
 113   ];
 114   ssl.key = "/var/lib/acme/${networking.domain}/key.pem";
 115   ssl.cert = "/var/lib/acme/${networking.domain}/fullchain.pem";
 116   admins = [
 117     "julm@${networking.domain}"
 118   ];
 119   virtualHosts."${networking.domain}" = {
 120     enabled = true;
 121     domain = "${networking.domain}";
 122     ssl.key = "/var/lib/acme/${networking.domain}/key.pem";
 123     ssl.cert = "/var/lib/acme/${networking.domain}/fullchain.pem";
 124   };
 125   allowRegistration = false;
 126   authentication = "internal_hashed";
 127   httpPorts = [];
 128   httpsPorts = [5281];
 129   disco_items = [];
 130   package = pkgs.prosody.override {
 131     withCommunityModules = [
 132       #"turncredentials"
 133       "extdisco"
 134     ];
 135   };
 136 };
 137 }