summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--ejabberd/ejabberd.yml344
1 files changed, 344 insertions, 0 deletions
diff --git a/ejabberd/ejabberd.yml b/ejabberd/ejabberd.yml
new file mode 100644
index 0000000..7ef001c
--- /dev/null
+++ b/ejabberd/ejabberd.yml
@@ -0,0 +1,344 @@
+###
+###' ejabberd configuration file
+### for
+### https://liberta.casa
+### by georg@lysergic.dev
+###
+### The parameters used in this configuration file are explained at
+###
+### https://docs.ejabberd.im/admin/configuration
+###
+### The configuration file is written in YAML.
+### *******************************************************
+### ******* !!! WARNING !!! *******
+### ******* YAML IS INDENTATION SENSITIVE *******
+### ******* MAKE SURE YOU INDENT SECTIONS CORRECTLY *******
+### *******************************************************
+### Refer to http://en.wikipedia.org/wiki/YAML for the brief description.
+###
+
+hosts:
+ - liberta.casa
+ - lib.casa
+
+loglevel: debug
+
+certfiles:
+ - "/etc/ssl/xmpp/xmpp.liberta.casa.crt"
+ - "/etc/ssl/xmpp/private/xmpp.liberta.casa.key"
+
+# ca_file: "/opt/ejabberd/conf/cacert.pem"
+
+listen:
+ -
+ port: 5222
+ ip: "::"
+ module: ejabberd_c2s
+ max_stanza_size: 262144
+ shaper: c2s_shaper
+ access: c2s
+ starttls_required: true
+ -
+ port: 5269
+ ip: "::"
+ module: ejabberd_s2s_in
+ max_stanza_size: 524288
+ -
+ port: 5443
+ ip: "127.0.0.2"
+ module: ejabberd_http
+ tls: true
+ request_handlers:
+ "/admin": ejabberd_web_admin
+ "/api": mod_http_api
+ "/bosh": mod_bosh
+ "/captcha": ejabberd_captcha
+ "/upload": mod_http_upload
+ "/ws": ejabberd_http_ws
+ # "/oauth": ejabberd_oauth
+ -
+ port: 5280
+ ip: "127.0.0.2"
+ module: ejabberd_http
+ request_handlers:
+ "/admin": ejabberd_web_admin
+ -
+ port: 1883
+ ip: "::"
+ module: mod_mqtt
+ backlog: 1000
+
+ -
+ port: 5347
+ ip: 127.0.0.2
+ module: ejabberd_service
+ access: all
+ hosts:
+ "biboumi.xyz":
+ password: $biboumisec
+
+s2s_use_starttls: required
+
+acl:
+ local:
+ user_regexp: ""
+ loopback:
+ ip:
+ - 127.0.0.0/8
+ - ::1/128
+ - ::FFFF:127.0.0.1/128
+ admin:
+ user:
+ - georg@liberta.casa
+ - acidsys@liberta.casa
+ - mogad0n@liberta.casa
+
+access_rules:
+ local:
+ allow: local
+ c2s:
+ deny: blocked
+ allow: all
+ announce:
+ allow: admin
+ configure:
+ allow: admin
+ muc_create:
+ allow: local
+ pubsub_createnode:
+ allow: local
+ trusted_network:
+ allow: loopback
+
+api_permissions:
+ "console commands":
+ from:
+ - ejabberd_ctl
+ who: all
+ what: "*"
+ "admin access":
+ who:
+ access:
+ allow:
+ acl: loopback
+ acl: admin
+ oauth:
+ scope: "ejabberd:admin"
+ access:
+ allow:
+ acl: loopback
+ acl: admin
+ what:
+ - "*"
+ - "!stop"
+ - "!start"
+ "public commands":
+ who:
+ ip: 127.0.0.1/8
+ what:
+ - status
+ - connected_users_number
+
+shaper:
+ normal: 1000
+ fast: 50000
+
+shaper_rules:
+ max_user_sessions: 10
+ max_user_offline_messages:
+ 5000: admin
+ 100: all
+ c2s_shaper:
+ none: admin
+ normal: all
+ s2s_shaper: fast
+
+max_fsm_queue: 10000
+
+acme:
+ auto: false
+
+modules:
+ mod_adhoc: {}
+ mod_admin_extra: {}
+ mod_announce:
+ access: announce
+ mod_avatar: {}
+ mod_blocking: {}
+ mod_bosh: {}
+ mod_caps: {}
+ mod_carboncopy: {}
+ mod_client_state: {}
+ mod_configure: {}
+ mod_disco:
+ extra_domains: [biboumi.xyz]
+ name: "LibertaCasa"
+ server_info:
+ -
+ modules: all
+ name: admin-addresses
+ urls:
+ - mailto:hello@liberta.casa
+ - xmpp:acidsys@liberta.casa
+ - xmpp:mogad0n@liberta.casa
+ -
+ modules: all
+ name: security-addresses
+ urls: ["mailto:system@lysergic.dev"]
+ -
+ modules: all
+ name: abuse-addresses
+ urls: ["mailto:abuse@liberta.casa"]
+ -
+ modules: all
+ name: status-addresses
+ urls: ["https://status.liberta.casa"]
+ mod_stun_disco:
+ credentials_lifetime: 12h
+ offer_local_services: false
+ secret: "$stunstaticsec"
+ services:
+ -
+ host: stun.lysergic.dev
+ port: 3478
+ type: stun
+ transport: udp
+ restricted: false
+ -
+ host: turn.lysergic.dev
+ port: 3478
+ type: turn
+ transport: udp
+ restricted: true
+ -
+ host: stuns.lysergic.dev
+ port: 3478
+ type: stuns
+ transport: tcp
+ restricted: false
+ -
+ host: turns.lysergic.dev
+ port: 3478
+ type: turns
+ transport: tcp
+ restricted: true
+ #mod_fail2ban: {}
+ mod_http_api: {}
+ mod_http_upload:
+ put_url: https://up.xmpp.@HOST@
+ external_secret: "$upsec"
+ max_size: 26214400
+ access: all
+ dir_mode: "0750"
+ # thumbnail: true -- not built into the packaged version
+ vcard:
+ fn: "LibertaCasa Uploader"
+ adr:
+ -
+ work: true
+ street: "Data Highway 420"
+ mod_last: {}
+ mod_mam:
+ ## Mnesia is limited to 2GB, better to use an SQL backend
+ ## For small servers SQLite is a good fit and is very easy
+ ## to configure. Uncomment this when you have SQL configured:
+ db_type: sql
+ assume_mam_usage: true
+ default: never
+ mod_mqtt: {}
+ mod_muc:
+ access:
+ - allow
+ access_admin:
+ - allow: admin
+ access_create: muc_create
+ access_persistent: muc_create
+ access_mam:
+ - allow
+ default_room_options:
+ allow_subscription: true # enable MucSub
+ mam: false
+ allow_user_invites: true
+ hosts: [conference.@HOST@, muc.@HOST@]
+ mod_muc_admin: {}
+ mod_offline:
+ access_max_user_messages: max_user_offline_messages
+ mod_ping: {}
+ mod_privacy: {}
+ mod_private: {}
+ mod_proxy65:
+ access: local
+ max_connections: 5
+ mod_pubsub:
+ access_createnode: pubsub_createnode
+ plugins:
+ - flat
+ - pep
+ force_node_config:
+ ## Avoid buggy clients to make their bookmarks public
+ storage:bookmarks:
+ access_model: whitelist
+ mod_push: {}
+ mod_push_keepalive: {}
+ mod_register:
+ redirect_url: https://sso.casa/
+ mod_roster:
+ versioning: true
+ mod_s2s_dialback: {}
+ mod_shared_roster: {}
+ mod_stream_mgmt:
+ resend_on_timeout: if_offline
+ mod_vcard:
+ db_type: ldap
+ ldap_rootdn: "cn=ejabberd_vcard,ou=syscid-system,dc=syscid,dc=com"
+ ldap_password: "$ldapvcardbindsec"
+ ldap_base: "ou=libertacasa-users,dc=syscid,dc=com"
+ ldap_vcard_map:
+ NICKNAME: {"%u": []}
+ GIVEN: {"%s": [givenName]}
+ FAMILY: {"%s": [sn]}
+ FN: {"%s": [displayName]}
+ EMAIL: {"%s": [mail]}
+ ID: {"%s": [entryid]}
+ ldap_search_fields:
+ User: "%u"
+ Name: givenName
+ "Family Name": sn
+ Email: mail
+ ID: entryid
+ ldap_search_reported:
+ Name: GIVEN
+ Nickname: NICKNAME
+ Email: EMAIL
+ mod_vcard_xupdate: {}
+ mod_version:
+ show_os: false
+
+# custom entries
+sql_type: mysql
+sql_server: "$dbhost"
+sql_database: "$db"
+sql_username: "$dbuser"
+sql_password: "$dbsec"
+
+auth_method:
+ - ldap
+ - anonymous
+anonymous_protocol: sasl_anon
+disable_sasl_mechanisms: ["X-OAUTH2"]
+ldap_servers:
+ - orpheus.syscid.com
+ - gaia.syscid.com
+ldap_encrypt: tls
+ldap_tls_cacertfile: /etc/pki/trust/anchors/syscid-ca.crt
+ldap_tls_verify: hard
+ldap_password: "$ldapbindsec"
+ldap_rootdn: "cn=ejabberd,ou=syscid-system,dc=syscid,dc=com"
+ldap_filter: "(objectClass=inetOrgPerson)"
+
+#append_host_config:
+
+### Local Variables:
+### mode: yaml
+### End:
+### vim: set filetype=yaml tabstop=8