diff options
Diffstat (limited to 'services/ejabberd.nix')
| -rw-r--r-- | services/ejabberd.nix | 243 |
1 files changed, 243 insertions, 0 deletions
diff --git a/services/ejabberd.nix b/services/ejabberd.nix new file mode 100644 index 0000000..f18cfe6 --- /dev/null +++ b/services/ejabberd.nix @@ -0,0 +1,243 @@ +{ fqdn }: { config, lib, pkgs, ... }: +let + inherit (builtins) toJSON; + inherit (pkgs) writeText; + inherit (pkgs.lib.lists) foldl'; + inherit (pkgs.lib.attrsets) mapAttrs' nameValuePair; + inherit (config.networking) domain; + + certs = config.security.acme.certs; + certDirectory = certs.${fqdn}.directory; +in { + services.ejabberd = { + enable = true; + imagemagick = true; + configFile = let + toPaths = s: mapAttrs' (n: v: nameValuePair "/${n}" v) s; + dhfile = config.security.dhparams.params.nginx.path; + toACLs = map (x: { acl = x; }); + in writeText "ejabberd.yml" (toJSON { + hosts = [ fqdn ]; + loglevel = 4; + s2s_cafile = "/etc/ssl/certs/ca-certificates.crt"; + ca_file = "/etc/ssl/certs/ca-certificates.crt"; + certfiles = [ "${certDirectory}/*.pem" ]; + listen = map (x: x // { ip = "10.0.1.30"; }) [ + { + inherit dhfile; + port = 5222; + module = "ejabberd_c2s"; + max_stanza_size = 262144; + shaper = "c2s_shaper"; + access = "c2s"; + starttls_required = true; + } + { + inherit dhfile; + port = 5223; + tls = true; + module = "ejabberd_c2s"; + max_stanza_size = 262144; + shaper = "c2s_shaper"; + access = "c2s"; + starttls_required = true; + } + { + inherit dhfile; + port = 5269; + module = "ejabberd_s2s_in"; + max_stanza_size = 524288; + } + { + inherit dhfile; + port = 5443; + module = "ejabberd_http"; + tls = true; + request_handlers = toPaths { + admin = "ejabberd_web_admin"; + api = "mod_http_api"; + bosh = "mod_bosh"; + captcha = "ejabberd_captcha"; + upload = "mod_http_upload"; + ws = "ejabberd_http_ws"; + }; + } + { + inherit dhfile; + port = 5280; + module = "ejabberd_http"; + request_handlers = toPaths { + admin = "ejabberd_web_admin"; + ".well-known/acme-challenge" = "ejabberd_acme"; + }; + } + { + port = 3478; + transport = "udp"; + module = "ejabberd_stun"; + use_turn = true; + turn_ipv4_address = "193.16.42.36"; + } + { + port = 1883; + module = "mod_mqtt"; + backlog = 1000; + } + ]; + s2s_use_starttls = "required"; + acl = { + local.user_regexp = ""; + loopback.ip = [ + "127.0.0.1/8" + "::1/128" + ]; + admin.user = [ "crash@${fqdn}" ]; + }; + access_rules = { + c2s = { + deny = "blocked"; + allow = "all"; + }; + } // mapAttrs' (n: v: nameValuePair n { allow = v; }) { + local = "local"; + announce = "admin"; + configure = "admin"; + muc_create = "local"; + pubsub_createnode = "local"; + trusted_network = "loopback"; + }; + api_permissions = { + "console commands" = { + from = [ "ejabberd_ctl" ]; + who = "all"; + what = "*"; + }; + "admin access" = { + who = { + access.allow = toACLs [ + "local" + "admin" + ]; + oauth = { + scope = "ejabberd:admin"; + access.allow = toACLs [ + "loopback" + "admin" + ]; + }; + }; + what = [ + "*" + "!stop" + "!start" + ]; + }; + "public commands" = { + who.ip = "127.0.0.1/8"; + what = [ + "status" + "connected_users_number" + ]; + }; + }; + shaper = { + normal = { + rate = 3000; + burst_size = 20000; + }; + fast = 100000; + }; + shaper_rules = { + max_user_sessions = 10; + max_user_offline_messages = { + "5000" = "admin"; + "100" = "all"; + }; + c2s_shaper = { + none = "admin"; + normal = "all"; + }; + s2s_shaper = "fast"; + }; + modules = mapAttrs' (n: v: nameValuePair "mod_${n}" v) ({ + announce.access = "announce"; + http_upload = { + put_url = "https://@HOST@:5443/upload"; + custom_headers = { + Access-Control-Allow-Origin = "https://@HOST@"; + Access-Control-Allow-Methods = "GET,HEAD,PUT,OPTIONS"; + Access-Control-Allow-Headers = "Content-Type"; + }; + }; + mam = { + assume_mam_usage = true; + default = "always"; + }; + muc = { + access = [ "allow" ]; + access_admin = [ { allow = "admin"; } ]; + access_create = "muc_create"; + access_persistent = "muc_create"; + access_mam = [ "allow" ]; + default_room_options.mam = true; + }; + offline.access_max_user_messages = "max_user_offline_messages"; + proxy65 = { + access = "local"; + max_connections = 5; + }; + pubsub = { + access_createnode = "pubsub_createnode"; + plugins = [ + "flat" + "pep" + ]; + force_node_config."storage:bookmarks".access_model = "whitelist"; + }; + register.ip_access = "trusted_network"; + roster.versioning = true; + stream_mgmt.resend_on_timeout = "if_offline"; + version.show_os = false; + } // foldl' (a: x: a // { ${x} = {}; }) {} [ + "adhoc" "admin_extra" "avatar" + "blocking" "bosh" + "caps" "carboncopy" "client_state" "configure" + "disco" + "fail2ban" + "http_api" + "last" + "mqtt" "muc_admin" + "ping" "privacy" "private" "push" "push_keepalive" + "s2s_dialback" "shared_roster" "stun_disco" + "vcard" "vcard_xupdate" + ]); + }); + package = pkgs.ejabberd.override { + withZlib = true; + withTools = true; + }; + }; + security.acme.certs.${fqdn} = { + extraDomainNames = map (x: "${x}.${fqdn}") [ + "pubsub" + "proxy" + "upload" + "conference" + ]; + group = "ejabberd-cert"; + postRun = "systemctl restart ejabberd.service"; + }; + users.groups.ejabberd-cert.members = [ "ejabberd" "nginx" ]; + security.dhparams = { + enable = true; + params.nginx = {}; + }; + networking.firewall.allowedTCPPorts = [ + 5222 # xmpp-client + 5223 # xmpp-client + 5269 # xmpp-server + 5280 # xmpp-bosh + 5443 # https + 3478 # xmpp-stun + ]; +} |