summaryrefslogtreecommitdiffstats
path: root/tv/3modules/ejabberd/config.nix
blob: a022bc44893711171a0bd263988044a1c5a4a28a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
with import <stockholm/lib>;
{ config, ... }: let

  # See https://github.com/processone/ejabberd/blob/master/ejabberd.yml.example

  ciphers = concatStringsSep ":" [
    "ECDHE-ECDSA-AES256-GCM-SHA384"
    "ECDHE-RSA-AES256-GCM-SHA384"
    "ECDHE-ECDSA-CHACHA20-POLY1305"
    "ECDHE-RSA-CHACHA20-POLY1305"
    "ECDHE-ECDSA-AES128-GCM-SHA256"
    "ECDHE-RSA-AES128-GCM-SHA256"
    "ECDHE-ECDSA-AES256-SHA384"
    "ECDHE-RSA-AES256-SHA384"
    "ECDHE-ECDSA-AES128-SHA256"
    "ECDHE-RSA-AES128-SHA256"
  ];

  protocol_options = [
    "no_sslv2"
    "no_sslv3"
    "no_tlsv1"
    "no_tlsv1_10"
  ];

in /* yaml */ ''

  access_rules:
    announce:
      - allow: admin
    local:
      - allow: local
    configure:
      - allow: admin
    register:
      - allow
    s2s:
      - allow
    trusted_network:
      - allow: loopback

  acl:
    local:
      user_regexp: ""
    loopback:
      ip:
        - "127.0.0.0/8"
        - "::1/128"
        - "::FFFF:127.0.0.1/128"

  certfiles:
    - /tmp/credentials/certfile

  hosts: ${toJSON config.hosts}

  language: "en"

  listen:
    -
      port: 5222
      ip: "::"
      module: ejabberd_c2s
      shaper: c2s_shaper
      ciphers: ${toJSON ciphers}
      dhfile: /var/lib/ejabberd/dhfile
      protocol_options: ${toJSON protocol_options}
      starttls: true
      starttls_required: true
      tls: false
      tls_compression: false
      max_stanza_size: 65536
    -
      port: 5269
      ip: "::"
      module: ejabberd_s2s_in
      shaper: s2s_shaper
      max_stanza_size: 131072

  loglevel: 4

  modules:
    mod_adhoc: {}
    mod_admin_extra: {}
    mod_announce:
      access: announce
    mod_caps: {}
    mod_carboncopy: {}
    mod_client_state: {}
    mod_configure: {}
    mod_disco: {}
    mod_echo: {}
    mod_bosh: {}
    mod_last: {}
    mod_offline:
      access_max_user_messages: max_user_offline_messages
    mod_ping: {}
    mod_privacy: {}
    mod_private: {}
    mod_register:
      access_from: deny
      access: register
      ip_access: trusted_network
      registration_watchers: ${toJSON config.registration_watchers}
    mod_roster: {}
    mod_shared_roster: {}
    mod_stats: {}
    mod_time: {}
    mod_vcard:
      search: false
    mod_version: {}
    mod_http_api: {}

  s2s_access: s2s
  s2s_ciphers: ${toJSON ciphers}
  s2s_dhfile: /var/lib/ejabberd/dhfile
  s2s_protocol_options: ${toJSON protocol_options}
  s2s_tls_compression: false
  s2s_use_starttls: required

  shaper_rules:
    max_user_offline_messages:
      - 5000: admin
      - 100
    max_user_sessions: 10
    c2s_shaper:
      - none: admin
      - normal
    s2s_shaper: fast
''