241 lines
7.2 KiB
Nix
241 lines
7.2 KiB
Nix
{ zentralwerk, config, hostRegistry, pkgs, lib, ... }:
|
|
|
|
let
|
|
domain = "jabber.c3d2.de";
|
|
|
|
inherit (pkgs.jabber-secrets) coturnUser coturnPassword;
|
|
in
|
|
{
|
|
c3d2 = {
|
|
deployment.server = "server10";
|
|
hq.statistics.enable = true;
|
|
};
|
|
|
|
microvm.mem = 2048;
|
|
|
|
networking = {
|
|
hostName = "jabber";
|
|
firewall = {
|
|
allowedTCPPorts = [
|
|
# Prosody
|
|
5222
|
|
5223
|
|
5269
|
|
80
|
|
5280
|
|
443
|
|
5281
|
|
# Coturn
|
|
3478
|
|
3479
|
|
];
|
|
allowedUDPPorts = [
|
|
# Coturn
|
|
3478
|
|
3479
|
|
];
|
|
# TODO: allowedSCTPPorts
|
|
};
|
|
};
|
|
|
|
security.acme.certs."${domain}" = {
|
|
extraDomainNames = [
|
|
"chat.c3d2.de"
|
|
"*.${domain}"
|
|
];
|
|
# DynDNS method
|
|
dnsProvider = "rfc2136";
|
|
credentialsFile = config.sops.secrets."acme/credentials-file".path;
|
|
reloadServices = [ "prosody" ];
|
|
# Make keys accessible by putting them in prosody's group
|
|
inherit (config.services.prosody) group;
|
|
};
|
|
|
|
services = {
|
|
backup.paths = [ "/var/lib/prosody/" ];
|
|
|
|
collectd.plugins.exec = ''
|
|
Exec "${config.services.collectd.user}" "${pkgs.ruby}/bin/ruby" "${./prosody-stats.rb}"
|
|
'';
|
|
|
|
coturn = {
|
|
enable = true;
|
|
realm = "turn.${domain}";
|
|
lt-cred-mech = true;
|
|
extraConfig = with zentralwerk.lib.config.site; ''
|
|
external-ip=${hosts.upstream4.interfaces.up4-pppoe.upstream.staticIpv4Address}/${net.serv.hosts4.jabber}
|
|
|
|
user=${coturnUser}:${coturnPassword}
|
|
'';
|
|
};
|
|
|
|
postgresql = {
|
|
enable = true;
|
|
ensureDatabases = [
|
|
"prosody"
|
|
];
|
|
ensureUsers = [{
|
|
name = "prosody";
|
|
ensurePermissions = {
|
|
"DATABASE prosody" = "ALL PRIVILEGES";
|
|
};
|
|
}];
|
|
package = pkgs.postgresql_15;
|
|
upgrade.stopServices = [ "prosody" ];
|
|
};
|
|
#TODO: txt records?
|
|
prosody = {
|
|
enable = true;
|
|
allowRegistration = false;
|
|
admins = [ "astro@spaceboyz.net" "0@jabber.c3d2.de" "nek0@c3d2.de" ];
|
|
package = pkgs.prosody.override {
|
|
withCommunityModules = [ "smacks" "csi" "cloud_notify" "extdisco" "firewall" ];
|
|
withExtraLuaPackages = luaPackages: with luaPackages; [
|
|
luadbi-postgresql
|
|
];
|
|
};
|
|
|
|
modules = {
|
|
# HTTP stuff
|
|
bosh = true;
|
|
websocket = true;
|
|
http_files = true;
|
|
|
|
admin_telnet = true;
|
|
announce = true;
|
|
mam = true;
|
|
carbons = true;
|
|
proxy65 = false;
|
|
};
|
|
|
|
ssl = {
|
|
key = "/var/lib/acme/${domain}/key.pem";
|
|
cert = "/var/lib/acme/${domain}/fullchain.pem";
|
|
# Some TLS hardening we've had on the old setup, probably to
|
|
# defend against downgrading attacks.
|
|
extraOptions.options = [
|
|
"no_sslv2"
|
|
"no_sslv3"
|
|
"no_ticket"
|
|
"no_compression"
|
|
"cipher_server_preference"
|
|
"single_dh_use"
|
|
"single_ecdh_use"
|
|
];
|
|
};
|
|
|
|
c2sRequireEncryption = true;
|
|
s2sRequireEncryption = true;
|
|
|
|
virtualHosts = {
|
|
"${domain}" = {
|
|
enabled = true;
|
|
inherit domain;
|
|
};
|
|
"anon.${domain}" = {
|
|
enabled = true;
|
|
domain = "anon.${domain}";
|
|
extraConfig = ''
|
|
authentication = "anonymous"
|
|
'';
|
|
};
|
|
};
|
|
muc = [{
|
|
domain = "chat.c3d2.de";
|
|
name = "Group chats";
|
|
}];
|
|
|
|
httpPorts = [ 80 5280 ];
|
|
httpsPorts = [ 443 5281 ];
|
|
uploadHttp = {
|
|
domain = "upload.${domain}";
|
|
uploadFileSizeLimit = "10 * 1024 * 1024";
|
|
userQuota = 512 * 1024 * 1024;
|
|
uploadExpireAfter = "2 * 60 * 60";
|
|
};
|
|
|
|
extraConfig =
|
|
let
|
|
prosodyFirewall = pkgs.writeText "antispam.pfw" ''
|
|
%ZONE spam: creep.im, default.rs, sj.ms, anonym.im, xmpp.jp, safetyjabber.com, im.hot-chilli.net, jabb3r.org, draugr.de, laba.im, xmpp.sh, jabber.bitactive.com, 404.city, jabber.cd, jabber.jc-otto.de, jabster.pl, jabber.no, anoxinon.me, ubuntu-jabber.net, anonarchy.im, jabber.freenet.de, exploit.im, 616.pub, omemo.im, rsocks.net, chatwith.xyz, jabber.cz, jabbim.cz, blabber.im, jabber.root.cz, jabb.im, jabber.infos.ru, jabbim.pl, jabbim.com, linuxlovers.at, jabbim.ru, jabber.sk, njs.netlab.cz, jabba.biz, chatterboxtown.us, crime.io, 0nl1ne.at, verdammung.org, im.apinc.org, 0day.la, 0day.im, xabber.de, conversations.im, jabber.de, chinwag.im, jabber.ccc.de, thesecure.biz, shad0w.ru, yourdata.forsale, linux.monster, xmpp.international, paranoid.network, og.im, 4ept.net, darknet.im, ubuntu-jabber.de, deshalbfrei.org, nixnet.services, marxist.club, dw.live, 01337.io, sqli.io, breached.im, pwned.life, jabber.fr, chatterboxtown.us, xmpp.xxx, ybgood.de, ejabber.co, jabbers.one
|
|
|
|
IN ROSTER?
|
|
PASS.
|
|
|
|
LEAVING: spam
|
|
BOUNCE=policy-violation (Your domain has been blacklisted due to spam.)
|
|
'';
|
|
in
|
|
''
|
|
legacy_ssl_ports = { 5223 }
|
|
legacy_ssl_ssl = {
|
|
key = "/var/lib/acme/${domain}/key.pem",
|
|
certificate = "/var/lib/acme/${domain}/fullchain.pem",
|
|
}
|
|
certificates = "/var/lib/acme"
|
|
|
|
storage = "sql"
|
|
sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "" }
|
|
log = { info = "*syslog"; }
|
|
|
|
firewall_scripts = { "${prosodyFirewall}" }
|
|
|
|
trusted_proxies = { "127.0.0.1", "::1", "${hostRegistry.public-access-proxy.ip4}", "${hostRegistry.public-access-proxy.ip4}", }
|
|
http_default_host = "${domain}"
|
|
http_host = "${domain}"
|
|
http_external_url = "https://${domain}/"
|
|
http_upload_file_size_limit = 10 * 1024 * 1024
|
|
http_upload_expire_after = 60 * 60 * 24 * 7 -- a week in seconds
|
|
cross_domain_bosh = true -- Allow access from scripts on any site with no proxy (requires a modern browser)
|
|
|
|
external_services = {
|
|
["turn.${domain}"] = {
|
|
username = "${coturnUser}";
|
|
password = "${coturnPassword}";
|
|
port = "3478";
|
|
transport = "udp";
|
|
type = "turn";
|
|
};
|
|
["${zentralwerk.lib.config.site.hosts.upstream4.interfaces.up4-pppoe.upstream.staticIpv4Address}"] = {
|
|
username = "${coturnUser}";
|
|
password = "${coturnPassword}";
|
|
port = "3478";
|
|
transport = "udp";
|
|
type = "turn";
|
|
};
|
|
}
|
|
|
|
-- -- File-transfer proxies are an outdated technology
|
|
-- Component "proxy65.${domain}" "proxy65"
|
|
-- proxy65_address = "proxy.${domain}"
|
|
-- proxy65_acl = { "${domain}" }
|
|
-- proxy65_interfaces = { "*", "::" }
|
|
-- proxy65_ports = { 5000 }
|
|
'';
|
|
};
|
|
};
|
|
|
|
sops = {
|
|
defaultSopsFile = ./secrets.yaml;
|
|
secrets = {
|
|
"acme/credentials-file".owner = "root";
|
|
"restic/password".owner = "root";
|
|
"restic/repository/server8".owner = "root";
|
|
};
|
|
};
|
|
|
|
systemd.services = {
|
|
collectd.requires = [ "prosody.service" ];
|
|
|
|
prosody.serviceConfig = {
|
|
# Allow binding ports <1024
|
|
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
|
|
|
|
Restart = "always";
|
|
RestartSec = "3";
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "21.05";
|
|
}
|