From 8a7e4b95c23c45b9d341f38b7bb96c3acfecff8a Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 21 Feb 2016 06:05:49 +0100 Subject: tv.ejabberd: refactor --- tv/3modules/ejabberd/config.nix | 93 ++++++++++++++++++++++++++++++++++++++++ tv/3modules/ejabberd/default.nix | 76 ++++++++++++++++++++++++++++++++ 2 files changed, 169 insertions(+) create mode 100644 tv/3modules/ejabberd/config.nix create mode 100644 tv/3modules/ejabberd/default.nix (limited to 'tv/3modules/ejabberd') diff --git a/tv/3modules/ejabberd/config.nix b/tv/3modules/ejabberd/config.nix new file mode 100644 index 000000000..49bded855 --- /dev/null +++ b/tv/3modules/ejabberd/config.nix @@ -0,0 +1,93 @@ +{ config, ... }: with config.krebs.lib; let + cfg = config.tv.ejabberd; + + # XXX this is a placeholder that happens to work the default strings. + toErlang = builtins.toJSON; +in toFile "ejabberd.conf" '' + {loglevel, 3}. + {hosts, ${toErlang cfg.hosts}}. + {listen, + [ + {5222, ejabberd_c2s, [ + starttls, + {certfile, ${toErlang cfg.certfile.path}}, + {access, c2s}, + {shaper, c2s_shaper}, + {max_stanza_size, 65536} + ]}, + {5269, ejabberd_s2s_in, [ + {shaper, s2s_shaper}, + {max_stanza_size, 131072} + ]}, + {5280, ejabberd_http, [ + captcha, + http_bind, + http_poll, + web_admin + ]} + ]}. + {s2s_use_starttls, required}. + {s2s_certfile, ${toErlang cfg.s2s_certfile.path}}. + {auth_method, internal}. + {shaper, normal, {maxrate, 1000}}. + {shaper, fast, {maxrate, 50000}}. + {max_fsm_queue, 1000}. + {acl, local, {user_regexp, ""}}. + {access, max_user_sessions, [{10, all}]}. + {access, max_user_offline_messages, [{5000, admin}, {100, all}]}. + {access, local, [{allow, local}]}. + {access, c2s, [{deny, blocked}, + {allow, all}]}. + {access, c2s_shaper, [{none, admin}, + {normal, all}]}. + {access, s2s_shaper, [{fast, all}]}. + {access, announce, [{allow, admin}]}. + {access, configure, [{allow, admin}]}. + {access, muc_admin, [{allow, admin}]}. + {access, muc_create, [{allow, local}]}. + {access, muc, [{allow, all}]}. + {access, pubsub_createnode, [{allow, local}]}. + {access, register, [{allow, all}]}. + {language, "en"}. + {modules, + [ + {mod_adhoc, []}, + {mod_announce, [{access, announce}]}, + {mod_blocking,[]}, + {mod_caps, []}, + {mod_configure,[]}, + {mod_disco, []}, + {mod_irc, []}, + {mod_http_bind, []}, + {mod_last, []}, + {mod_muc, [ + {access, muc}, + {access_create, muc_create}, + {access_persistent, muc_create}, + {access_admin, muc_admin} + ]}, + {mod_offline, [{access_max_user_messages, max_user_offline_messages}]}, + {mod_ping, []}, + {mod_privacy, []}, + {mod_private, []}, + {mod_pubsub, [ + {access_createnode, pubsub_createnode}, + {ignore_pep_from_offline, true}, + {last_item_cache, false}, + {plugins, ["flat", "hometree", "pep"]} + ]}, + {mod_register, [ + {welcome_message, {"Welcome!", + "Hi.\nWelcome to this XMPP server."}}, + {ip_access, [{allow, "127.0.0.0/8"}, + {deny, "0.0.0.0/0"}]}, + {access, register} + ]}, + {mod_roster, []}, + {mod_shared_roster,[]}, + {mod_stats, []}, + {mod_time, []}, + {mod_vcard, []}, + {mod_version, []} + ]}. +'' diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix new file mode 100644 index 000000000..51a3060fd --- /dev/null +++ b/tv/3modules/ejabberd/default.nix @@ -0,0 +1,76 @@ +{ config, lib, pkgs, ... }@args: with config.krebs.lib; let + cfg = config.tv.ejabberd; +in { + options.tv.ejabberd = { + enable = mkEnableOption "tv.ejabberd"; + certfile = mkOption { + type = types.secret-file; + default = { + path = "${cfg.user.home}/ejabberd.pem"; + owner-name = "ejabberd"; + source-path = toString + "/ejabberd.pem"; + }; + }; + hosts = mkOption { + type = with types; listOf str; + }; + pkgs.ejabberdctl = mkOption { + type = types.package; + default = pkgs.writeDashBin "ejabberdctl" '' + set -efu + export SPOOLDIR=${shell.escape cfg.user.home} + export EJABBERD_CONFIG_PATH=${shell.escape (import ./config.nix args)} + exec ${pkgs.ejabberd}/bin/ejabberdctl \ + --logs ${shell.escape cfg.user.home} \ + "$@" + ''; + }; + s2s_certfile = mkOption { + type = types.secret-file; + default = cfg.certfile; + }; + user = mkOption { + type = types.submodule { + options = { + name = mkOption { + type = types.str; + default = "ejabberd"; + }; + home = mkOption { + type = types.str; + default = "/var/ejabberd"; + }; + }; + }; + default = {}; + }; + }; + config = lib.mkIf cfg.enable { + environment.systemPackages = [ cfg.pkgs.ejabberdctl ]; + + krebs.secret.files = { + ejabberd-certfile = cfg.certfile; + ejabberd-s2s_certfile = cfg.s2s_certfile; + }; + + systemd.services.ejabberd = { + wantedBy = [ "multi-user.target" ]; + requires = [ "secret.service" ]; + after = [ "network.target" "secret.service" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = "yes"; + PermissionsStartOnly = "true"; + SyslogIdentifier = "ejabberd"; + User = cfg.user.name; + ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl start"; + }; + }; + + users.users.${cfg.user.name} = { + inherit (cfg.user) home name; + createHome = true; + uid = genid cfg.user.name; + }; + }; +} -- cgit v1.2.3 From c5f18dfdfe9874ba48834447c8d3259b115c1357 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 21 Feb 2016 06:39:12 +0100 Subject: tv.{charybdis,ejabberd}.user :: user --- tv/3modules/ejabberd/default.nix | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) (limited to 'tv/3modules/ejabberd') diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 51a3060fd..4077da286 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -30,19 +30,11 @@ in { default = cfg.certfile; }; user = mkOption { - type = types.submodule { - options = { - name = mkOption { - type = types.str; - default = "ejabberd"; - }; - home = mkOption { - type = types.str; - default = "/var/ejabberd"; - }; - }; + type = types.user; + default = { + name = "ejabberd"; + home = "/var/ejabberd"; }; - default = {}; }; }; config = lib.mkIf cfg.enable { -- cgit v1.2.3 From 05be525be6d0896b155da7305b2cee950fb3530e Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 21 Feb 2016 06:56:57 +0100 Subject: krebs.types.user: add uid :: int --- tv/3modules/ejabberd/default.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'tv/3modules/ejabberd') diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 4077da286..da108eb52 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -60,9 +60,8 @@ in { }; users.users.${cfg.user.name} = { - inherit (cfg.user) home name; + inherit (cfg.user) home name uid; createHome = true; - uid = genid cfg.user.name; }; }; } -- cgit v1.2.3 From e3ddf995e92985ee14dab5735ac55045c166aaaf Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 21 Feb 2016 07:18:13 +0100 Subject: krebs types.secret-file: owner-name -> owner :: user --- tv/3modules/ejabberd/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tv/3modules/ejabberd') diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index da108eb52..95ea24be1 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -7,7 +7,7 @@ in { type = types.secret-file; default = { path = "${cfg.user.home}/ejabberd.pem"; - owner-name = "ejabberd"; + owner = cfg.user; source-path = toString + "/ejabberd.pem"; }; }; -- cgit v1.2.3