syncoid: use DynamicUser=

[sourcephile-nix.git] / hosts / mermet / prosody.nix

diff --git a/hosts/mermet/prosody.nix b/hosts/mermet/prosody.nix
index 5cc608dd4ccf27f031c7786c34733d9dbfad76ed..7b496dd687e53e0a88afad299466d2389995a436 100644 (file)
--- a/hosts/mermet/prosody.nix
+++ b/hosts/mermet/prosody.nix
@@ -1,8 +1,8 @@
 { pkgs, lib, config, inputs, hosts, ipv4, ... }:
 let
-  inherit (config) networking;
   inherit (config.services) prosody;
   inherit (hosts.mermet.config.services) coturn;
+  domain = config.networking.domain;
 in
 {
 imports = [
@@ -44,10 +44,10 @@ services.upnpc.redirections =
   }) prosody.httpsPorts;
 */
 /*
-services.tor.relay.hiddenServices."${networking.domain}/xmpp".map = [ 5222 5269 5000 ] ++ prosody.httpsPorts;
+services.tor.relay.hiddenServices."${domain}/xmpp".map = [ 5222 5269 5000 ] ++ prosody.httpsPorts;
 */
 users.groups.acme.members = [ prosody.user ];
-security.acme.certs."${networking.domain}" = {
+security.acme.certs."${domain}" = {
   postRun = "systemctl reload prosody";
 };
 fileSystems."/var/lib/prosody" = {
@@ -56,13 +56,13 @@ fileSystems."/var/lib/prosody" = {
 };
 services.sanoid.datasets = {
   "rpool/var/prosody" = {
-    use_template = [ "local" ];
+    use_template = [ "snap" ];
     daily = 7;
   };
 };
 systemd.services.prosody = {
-  wants = [ "acme-selfsigned-${networking.domain}.service" "acme-${networking.domain}.service"];
-  after = [ "acme-selfsigned-${networking.domain}.service" ];
+  wants = [ "acme-selfsigned-${domain}.service" "acme-${domain}.service"];
+  after = [ "acme-selfsigned-${domain}.service" ];
 };
 # sudo -u prosody prosodyctl check
 services.prosody = {
@@ -87,37 +87,43 @@ services.prosody = {
     #"extdisco"
   ];
   extraConfig = ''
+    log = {
+      -- debug = "*syslog";
+      info = "*syslog";
+      warn  = "*syslog";
+      error = "*syslog";
+    }
     -- Listen only in IPv4 until hosting provider's IPv6 works well.
     interfaces = { "0.0.0.0" }
     c2s_interfaces = { "0.0.0.0" }
     contact_info = {
-      --abuse = { "mailto:abuse@${networking.domain}", "xmpp:abuse@${networking.domain}" };
-      --admin = { "mailto:admin@${networking.domain}", "xmpp:admin@${networking.domain}" };
-      --feedback = { "http://${networking.domain}/feedback.php", "mailto:feedback@${networking.domain}", "xmpp:feedback@${networking.domain}" };
-      --sales = { "xmpp:bard@${networking.domain}" };
-      --security = { "xmpp:security@${networking.domain}" };
-      --support = { "http://${networking.domain}/support.php", "xmpp:support@${networking.domain}" };
+      --abuse = { "mailto:abuse@${domain}", "xmpp:abuse@${domain}" };
+      --admin = { "mailto:admin@${domain}", "xmpp:admin@${domain}" };
+      --feedback = { "http://${domain}/feedback.php", "mailto:feedback@${domain}", "xmpp:feedback@${domain}" };
+      --sales = { "xmpp:bard@${domain}" };
+      --security = { "xmpp:security@${domain}" };
+      --support = { "http://${domain}/support.php", "xmpp:support@${domain}" };
     }
     legacy_ssl_ports = { 5222 }
 
-    turncredentials_host = "turn.${networking.domain}"
+    turncredentials_host = "turn.${domain}"
     turncredentials_port = 3478
     turncredentials_secret = "${lib.removeSuffix "\n" (builtins.readFile (inputs.secrets + "/coturn/static-auth-secret"))}";
     smacks_enabled_s2s = true;
     smacks_s2s_resend = true;
 
     --http_files_dir = "/var/lib/prosody/files"
-    --http_external_url = "https://tmp.${networking.domain}:5281"
-    --https_certificate = "/var/lib/acme/${networking.domain}/fullchain.pem"
-    --https_key = "/var/lib/acme/${networking.domain}/key.pem"
+    --http_external_url = "https://tmp.${domain}:5281"
+    --https_certificate = "/var/lib/acme/${domain}/fullchain.pem"
+    --https_key = "/var/lib/acme/${domain}/key.pem"
     --certificates = "/var/lib/acme"
 
     proxy65_ports = 5000
-    Component "proxy65.${networking.domain}" "proxy65"
-      proxy65_address = "proxy65.${networking.domain}"
-      proxy65_acl = { "${networking.domain}" }
+    Component "proxy65.${domain}" "proxy65"
+      proxy65_address = "proxy65.${domain}"
+      proxy65_acl = { "${domain}" }
 
-    Component "biboumi.${networking.domain}"
+    Component "biboumi.${domain}"
       component_secret = "useless-secret-on-loopback"
   '';
   #ports = {80};
@@ -126,7 +132,7 @@ services.prosody = {
   s2sRequireEncryption = true;
   s2sSecureAuth = true;
   uploadHttp = {
-    domain = "tmp.${networking.domain}";
+    domain = "tmp.${domain}";
     # Prosody's HTTP parser limit on body size
     uploadFileSizeLimit = "10485760";
     userQuota = 100 * 1024 * 1024;
@@ -134,7 +140,8 @@ services.prosody = {
     httpUploadPath = "/var/lib/prosody/upload";
   };
   muc = [
-    { domain = "salons.${networking.domain}";
+    {
+      domain = "salons.${domain}";
       extraConfig = ''
         restrict_room_creation = "local"
         max_history_messages = 42
@@ -152,23 +159,23 @@ services.prosody = {
       '';
     }
   ];
-  ssl.key = "/var/lib/acme/${networking.domain}/key.pem";
-  ssl.cert = "/var/lib/acme/${networking.domain}/fullchain.pem";
+  ssl.key = "/var/lib/acme/${domain}/key.pem";
+  ssl.cert = "/var/lib/acme/${domain}/fullchain.pem";
   admins = [
-    "julm@${networking.domain}"
+    "julm@${domain}"
   ];
-  virtualHosts."${networking.domain}" = {
+  virtualHosts."${domain}" = {
     enabled = true;
-    domain = "${networking.domain}";
-    ssl.key = "/var/lib/acme/${networking.domain}/key.pem";
-    ssl.cert = "/var/lib/acme/${networking.domain}/fullchain.pem";
+    domain = "${domain}";
+    ssl.key = "/var/lib/acme/${domain}/key.pem";
+    ssl.cert = "/var/lib/acme/${domain}/fullchain.pem";
   };
   allowRegistration = false;
   authentication = "internal_hashed";
   httpPorts = [];
   httpsPorts = [5281];
   disco_items = [
-    { url = "biboumi.${networking.domain}";
+    { url = "biboumi.${domain}";
       description = "Passerelle vers des serveurs IRC (Internet Relay Chat)"; }
   ];
   package = pkgs.prosody.override {