diff options
author | lassulus <lassulus@lassul.us> | 2022-10-19 00:30:26 +0200 |
---|---|---|
committer | lassulus <lassulus@lassul.us> | 2022-10-19 00:30:26 +0200 |
commit | c68da76ea1ffab8e012527383047bb3dc718b20f (patch) | |
tree | c4a8895d98446822fbd3a6f58215490092005b96 /tv/3modules/ejabberd | |
parent | fbec9a17fe6a012ce6f794e5a2d73c6dcec19463 (diff) | |
parent | b5f7882fcada26d968b643765f32fd1ac23613ff (diff) |
Merge remote-tracking branch 'ni/master'
Diffstat (limited to 'tv/3modules/ejabberd')
-rw-r--r-- | tv/3modules/ejabberd/config.nix | 129 | ||||
-rw-r--r-- | tv/3modules/ejabberd/default.nix | 240 |
2 files changed, 204 insertions, 165 deletions
diff --git a/tv/3modules/ejabberd/config.nix b/tv/3modules/ejabberd/config.nix deleted file mode 100644 index a022bc448..000000000 --- a/tv/3modules/ejabberd/config.nix +++ /dev/null @@ -1,129 +0,0 @@ -with import <stockholm/lib>; -{ config, ... }: let - - # See https://github.com/processone/ejabberd/blob/master/ejabberd.yml.example - - ciphers = concatStringsSep ":" [ - "ECDHE-ECDSA-AES256-GCM-SHA384" - "ECDHE-RSA-AES256-GCM-SHA384" - "ECDHE-ECDSA-CHACHA20-POLY1305" - "ECDHE-RSA-CHACHA20-POLY1305" - "ECDHE-ECDSA-AES128-GCM-SHA256" - "ECDHE-RSA-AES128-GCM-SHA256" - "ECDHE-ECDSA-AES256-SHA384" - "ECDHE-RSA-AES256-SHA384" - "ECDHE-ECDSA-AES128-SHA256" - "ECDHE-RSA-AES128-SHA256" - ]; - - protocol_options = [ - "no_sslv2" - "no_sslv3" - "no_tlsv1" - "no_tlsv1_10" - ]; - -in /* yaml */ '' - - access_rules: - announce: - - allow: admin - local: - - allow: local - configure: - - allow: admin - register: - - allow - s2s: - - allow - trusted_network: - - allow: loopback - - acl: - local: - user_regexp: "" - loopback: - ip: - - "127.0.0.0/8" - - "::1/128" - - "::FFFF:127.0.0.1/128" - - certfiles: - - /tmp/credentials/certfile - - hosts: ${toJSON config.hosts} - - language: "en" - - listen: - - - port: 5222 - ip: "::" - module: ejabberd_c2s - shaper: c2s_shaper - ciphers: ${toJSON ciphers} - dhfile: /var/lib/ejabberd/dhfile - protocol_options: ${toJSON protocol_options} - starttls: true - starttls_required: true - tls: false - tls_compression: false - max_stanza_size: 65536 - - - port: 5269 - ip: "::" - module: ejabberd_s2s_in - shaper: s2s_shaper - max_stanza_size: 131072 - - loglevel: 4 - - modules: - mod_adhoc: {} - mod_admin_extra: {} - mod_announce: - access: announce - mod_caps: {} - mod_carboncopy: {} - mod_client_state: {} - mod_configure: {} - mod_disco: {} - mod_echo: {} - mod_bosh: {} - mod_last: {} - mod_offline: - access_max_user_messages: max_user_offline_messages - mod_ping: {} - mod_privacy: {} - mod_private: {} - mod_register: - access_from: deny - access: register - ip_access: trusted_network - registration_watchers: ${toJSON config.registration_watchers} - mod_roster: {} - mod_shared_roster: {} - mod_stats: {} - mod_time: {} - mod_vcard: - search: false - mod_version: {} - mod_http_api: {} - - s2s_access: s2s - s2s_ciphers: ${toJSON ciphers} - s2s_dhfile: /var/lib/ejabberd/dhfile - s2s_protocol_options: ${toJSON protocol_options} - s2s_tls_compression: false - s2s_use_starttls: required - - shaper_rules: - max_user_offline_messages: - - 5000: admin - - 100 - max_user_sessions: 10 - c2s_shaper: - - none: admin - - normal - s2s_shaper: fast -'' diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 935df9a9c..edc5296b0 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -12,12 +12,43 @@ fi ''; + settingsFormat = pkgs.formats.json {}; + in { options.tv.ejabberd = { enable = mkEnableOption "tv.ejabberd"; - certfile = mkOption { - type = types.absolute-pathname; - default = toString <secrets> + "/ejabberd.pem"; + certfiles = mkOption { + type = types.listOf types.absolute-pathname; + default = [ + (toString <secrets> + "/ejabberd.pem") + ]; + }; + configFile = mkOption { + type = types.either types.package types.absolute-pathname; + default = settingsFormat.generate "ejabberd.yaml" cfg.settings; + }; + ciphers = mkOption { + type = types.listOf types.str; + default = [ + "ECDHE-ECDSA-AES256-GCM-SHA384" + "ECDHE-RSA-AES256-GCM-SHA384" + "ECDHE-ECDSA-CHACHA20-POLY1305" + "ECDHE-RSA-CHACHA20-POLY1305" + "ECDHE-ECDSA-AES128-GCM-SHA256" + "ECDHE-RSA-AES128-GCM-SHA256" + "ECDHE-ECDSA-AES256-SHA384" + "ECDHE-RSA-AES256-SHA384" + "ECDHE-ECDSA-AES128-SHA256" + "ECDHE-RSA-AES128-SHA256" + ]; + }; + credentials.certfiles = mkOption { + internal = true; + readOnly = true; + default = + imap + (i: const "/tmp/credentials/certfile${toJSON i}") + cfg.certfiles; }; hosts = mkOption { type = with types; listOf str; @@ -29,42 +60,66 @@ in { paths = [ (pkgs.writeDashBin "ejabberdctl" '' exec ${pkgs.ejabberd}/bin/ejabberdctl \ - --config ${toFile "ejabberd.yaml" (import ./config.nix { - inherit pkgs; - config = cfg; - })} \ - --logs ${shell.escape cfg.user.home} \ - --spool ${shell.escape cfg.user.home} \ + --config /etc/ejabberd/ejabberd.yaml \ + --ctl-config /etc/ejabberd/ejabberdctl.cfg \ + --logs ${cfg.stateDir} \ + --spool ${cfg.stateDir} \ "$@" '') pkgs.ejabberd ]; }; }; + protocol_options = mkOption { + type = types.listOf types.str; + default = [ + "no_sslv2" + "no_sslv3" + "no_tlsv1" + "no_tlsv1_10" + ]; + }; registration_watchers = mkOption { type = types.listOf types.str; default = [ config.krebs.users.tv.mail ]; }; - user = mkOption { - type = types.user; - default = { - name = "ejabberd"; - home = "/var/lib/ejabberd"; - }; + settings = mkOption { + type = settingsFormat.type; + default = {}; + }; + stateDir = mkOption { + type = + types.addCheck + types.absolute-pathname + (path: + hasPrefix "/var/lib/" path && + types.filename.check (removePrefix "/var/lib/" path) + ); + default = "/var/lib/ejabberd"; }; }; config = lib.mkIf cfg.enable { + + environment.etc."ejabberd/ejabberd.yaml".source = cfg.configFile; + environment.etc."ejabberd/ejabberdctl.cfg".source = + builtins.toFile "ejabberdctl.cfg" /* sh */ '' + ERL_OPTIONS='-setcookie ${cfg.stateDir}/.erlang.cookie' + ''; + environment.systemPackages = [ (pkgs.symlinkJoin { name = "ejabberd-sudo-wrapper"; paths = [ (pkgs.writeDashBin "ejabberdctl" '' - set -efu - cd ${shell.escape cfg.user.home} - exec /run/wrappers/bin/sudo \ - -u ${shell.escape cfg.user.name} \ + exec ${pkgs.systemd}/bin/systemd-run \ + --unit=ejabberdctl \ + --property=StateDirectory=ejabberd \ + --property=User=ejabberd \ + --collect \ + --pipe \ + --quiet \ ${cfg.pkgs.ejabberd}/bin/ejabberdctl "$@" '') cfg.pkgs.ejabberd @@ -77,31 +132,144 @@ in { systemd.services.ejabberd = { wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; + reloadTriggers = [ + config.environment.etc."ejabberd/ejabberd.yaml".source + config.environment.etc."ejabberd/ejabberdctl.cfg".source + ]; serviceConfig = { - ExecStart = pkgs.writeDash "ejabberd" '' - ${pkgs.coreutils}/bin/ln -s "$CREDENTIALS_DIRECTORY" /tmp/credentials - ${gen-dhparam} /var/lib/ejabberd/dhfile - exec ${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground - ''; - LoadCredential = [ - "certfile:${cfg.certfile}" + ExecStartPre = [ + "${pkgs.coreutils}/bin/ln -s \${CREDENTIALS_DIRECTORY} /tmp/credentials" + "${gen-dhparam} ${cfg.stateDir}/dhfile" + ]; + ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground"; + ExecStop = [ + "${cfg.pkgs.ejabberd}/bin/ejabberdctl stop" + "${cfg.pkgs.ejabberd}/bin/ejabberdctl stopped" ]; - PermissionsStartOnly = true; + ExecReload = "${cfg.pkgs.ejabberd}/bin/ejabberdctl reload_config"; + LoadCredential = + zipListsWith + (dst: src: "${baseNameOf dst}:${src}") + cfg.credentials.certfiles + cfg.certfiles; + LimitNOFILE = 65536; + PrivateDevices = true; PrivateTmp = true; SyslogIdentifier = "ejabberd"; StateDirectory = "ejabberd"; - User = cfg.user.name; - TimeoutStartSec = 60; + User = "ejabberd"; + DynamicUser = true; + TimeoutSec = 60; + RestartSec = 5; + Restart = "on-failure"; + Type = "notify"; + NotifyAccess = "all"; + WatchdogSec = 30; }; }; - users.users.${cfg.user.name} = { - inherit (cfg.user) home name uid; - createHome = true; - group = cfg.user.name; - isSystemUser = true; - }; + # preset config values + tv.ejabberd.settings = { + access_rules = { + announce = mkDefault [{ allow = "admin"; }]; + local = mkDefault [{ allow = "local"; }]; + configure = mkDefault [{ allow = "admin"; }]; + register = mkDefault ["allow"]; + s2s = mkDefault ["allow"]; + trusted_network = mkDefault [{ allow = "loopback"; }]; + }; + + acl = { + local.user_regexp = mkDefault ""; + loopback.ip = mkDefault [ + "127.0.0.0/8" + "::1/128" + "::FFFF:127.0.0.1/128" + ]; + }; + + certfiles = mkDefault cfg.credentials.certfiles; + + hosts = mkDefault cfg.hosts; + + language = mkDefault "en"; + + listen = mkDefault [ + { + port = 5222; + ip = "::"; + module = "ejabberd_c2s"; + shaper = "c2s_shaper"; + ciphers = concatStringsSep ":" cfg.ciphers; + protocol_options = cfg.protocol_options; + starttls = true; + starttls_required = true; + tls = false; + tls_compression = false; + max_stanza_size = 65536; + } + { + port = 5269; + ip = "::"; + module = "ejabberd_s2s_in"; + shaper = "s2s_shaper"; + dhfile = "${cfg.stateDir}/dhfile"; + max_stanza_size = 131072; + } + ]; + + loglevel = mkDefault "4"; + + modules = { + mod_adhoc = mkDefault {}; + mod_admin_extra = mkDefault {}; + mod_announce.access = mkDefault "announce"; + mod_caps = mkDefault {}; + mod_carboncopy = mkDefault {}; + mod_client_state = mkDefault {}; + mod_configure = mkDefault {}; + mod_disco = mkDefault {}; + mod_echo = mkDefault {}; + mod_bosh = mkDefault {}; + mod_last = mkDefault {}; + mod_offline.access_max_user_messages = mkDefault "max_user_offline_messages"; + mod_ping = mkDefault {}; + mod_privacy = mkDefault {}; + mod_private = mkDefault {}; + mod_register = { + access_from = mkDefault "deny"; + access = mkDefault "register"; + ip_access = mkDefault "trusted_network"; + registration_watchers = mkDefault cfg.registration_watchers; + }; + mod_roster = mkDefault {}; + mod_shared_roster = mkDefault {}; + mod_stats = mkDefault {}; + mod_time = mkDefault {}; + mod_vcard.search = mkDefault false; + mod_version = mkDefault {}; + mod_http_api = mkDefault {}; + }; + + s2s_access = mkDefault "s2s"; + s2s_ciphers = concatStringsSep ":" cfg.ciphers; + s2s_dhfile = mkDefault "${cfg.stateDir}/dhfile"; + s2s_protocol_options = mkDefault cfg.protocol_options; + s2s_tls_compression = mkDefault false; + s2s_use_starttls = mkDefault "required"; - users.groups.${cfg.user.name} = {}; + shaper_rules = { + max_user_offline_messages = mkDefault [ + { "5000" = "admin"; } + 100 + ]; + max_user_sessions = mkDefault 10; + c2s_shaper = mkDefault [ + { "none" = "admin"; } + "normal" + ]; + s2s_shaper = mkDefault "fast"; + }; + }; }; } |