summaryrefslogtreecommitdiffstats
path: root/lass/3modules/ejabberd/config.nix
blob: e7288313af680252ad566b8d81aea071d43141b5 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
with import <stockholm/lib>;
{ config, ... }: let

  # See https://github.com/processone/ejabberd/blob/master/ejabberd.yml.example

  ciphers = concatStringsSep ":" [
    "ECDHE-ECDSA-AES256-GCM-SHA384"
    "ECDHE-RSA-AES256-GCM-SHA384"
    "ECDHE-ECDSA-CHACHA20-POLY1305"
    "ECDHE-RSA-CHACHA20-POLY1305"
    "ECDHE-ECDSA-AES128-GCM-SHA256"
    "ECDHE-RSA-AES128-GCM-SHA256"
    "ECDHE-ECDSA-AES256-SHA384"
    "ECDHE-RSA-AES256-SHA384"
    "ECDHE-ECDSA-AES128-SHA256"
    "ECDHE-RSA-AES128-SHA256"
  ];

  protocol_options = [
    "no_sslv2"
    "no_sslv3"
    "no_tlsv1"
    "no_tlsv1_10"
  ];

in /* yaml */ ''

  access_rules:
    announce:
      - allow: admin
    local:
      - allow: local
    configure:
      - allow: admin
    register:
      - allow
    s2s:
      - allow
    trusted_network:
      - allow: loopback

  acl:
    local:
      user_regexp: ""
    loopback:
      ip:
        - "127.0.0.0/8"
        - "::1/128"
        - "::FFFF:127.0.0.1/128"

  hosts: ${toJSON config.hosts}

  language: "en"

  listen:
    -
      port: 5222
      ip: "::"
      module: ejabberd_c2s
      shaper: c2s_shaper
      certfile: ${toJSON config.certfile.path}
      ciphers: ${toJSON ciphers}
      dhfile: ${toJSON config.dhfile.path}
      protocol_options: ${toJSON protocol_options}
      starttls: true
      starttls_required: true
      tls: false
      tls_compression: false
      max_stanza_size: 65536
    -
      port: 5269
      ip: "::"
      module: ejabberd_s2s_in
      shaper: s2s_shaper
      max_stanza_size: 131072

  loglevel: 4

  modules:
    mod_adhoc: {}
    mod_admin_extra: {}
    mod_announce:
      access: announce
    mod_caps: {}
    mod_carboncopy: {}
    mod_client_state: {}
    mod_configure: {}
    mod_disco: {}
    mod_echo: {}
    mod_irc: {}
    mod_bosh: {}
    mod_last: {}
    mod_offline:
      access_max_user_messages: max_user_offline_messages
    mod_ping: {}
    mod_privacy: {}
    mod_private: {}
    mod_register:
      access_from: allow
      access: register
      # ip_access: trusted_network
      registration_watchers: ${toJSON config.registration_watchers}
    mod_roster: {}
    mod_shared_roster: {}
    mod_stats: {}
    mod_time: {}
    mod_vcard:
      search: false
    mod_version: {}
    mod_http_api: {}

  s2s_access: s2s
  s2s_certfile: ${toJSON config.s2s_certfile.path}
  s2s_ciphers: ${toJSON ciphers}
  s2s_dhfile: ${toJSON config.dhfile.path}
  s2s_protocol_options: ${toJSON protocol_options}
  s2s_tls_compression: false
  s2s_use_starttls: required

  shaper_rules:
    max_user_offline_messages:
      - 5000: admin
      - 100
    max_user_sessions: 10
    c2s_shaper:
      - none: admin
      - normal
    s2s_shaper: fast
''