+1 -70

modules/services/caddy/xmpp.nix

reviewed

··· 1 1 - { config, ... }: 1 1 + { ... }: 2 2 { 3 3 - networking.firewall.allowedTCPPorts = [ 4 4 - 5222 5 5 - 5223 6 6 - 5269 7 7 - 5270 8 8 - 5443 9 9 - 7777 10 10 - ]; 11 11 - 12 12 - garden.caddy.layer4 = '' 13 13 - [::]:5222 { 14 14 - route { 15 15 - proxy { 16 16 - proxy_protocol v2 17 17 - upstream ${config.garden.info.network.lily.netbird-ip}:5222 18 18 - } 19 19 - } 20 20 - } 21 21 - [::]:5223 { 22 22 - route { 23 23 - tls { 24 24 - connection_policy { 25 25 - alpn xmpp-client 26 26 - default_sni butwho.org 27 27 - } 28 28 - } 29 29 - proxy { 30 30 - proxy_protocol v2 31 31 - upstream ${config.garden.info.network.lily.netbird-ip}:5223 32 32 - } 33 33 - } 34 34 - } 35 35 - [::]:5269 { 36 36 - route { 37 37 - proxy { 38 38 - proxy_protocol v2 39 39 - upstream ${config.garden.info.network.lily.netbird-ip}:5269 40 40 - } 41 41 - } 42 42 - } 43 43 - [::]:5270 { 44 44 - route { 45 45 - tls { 46 46 - connection_policy { 47 47 - alpn xmpp-server 48 48 - default_sni butwho.org 49 49 - } 50 50 - } 51 51 - proxy { 52 52 - proxy_protocol v2 53 53 - upstream ${config.garden.info.network.lily.netbird-ip}:5270 54 54 - } 55 55 - } 56 56 - } 57 57 - [::]:7777 { 58 58 - route { 59 59 - proxy ${config.garden.info.network.lily.netbird-ip}:7777 60 60 - } 61 61 - } 62 62 - ''; 63 63 - 64 3 services.caddy.virtualHosts = { 65 65 - # TODO: I may need to use the proxy protocol (For http connections) in order for ejabberd's logs to show the 66 66 - # correct IP address. 67 67 - # It may not actually matter, it seems like ejabberd supports X-Forwarded-For which caddy sends, its just 68 68 - # that the logs don't reflect this. 69 69 - "butwho.org:5443".extraConfig = '' 70 70 - encode 71 71 - reverse_proxy ${config.garden.info.network.lily.netbird-ip}:5280 72 72 - ''; 73 4 "butwho.org".extraConfig = '' 74 5 header /.well-known/host-meta Access-Control-Allow-Origin * 75 6 header /.well-known/host-meta Content-Type text/xml

+136 -111

modules/services/ejabberd.nix

reviewed

··· 16 16 } 17 17 ]; 18 18 19 19 - sops = { 20 20 - secrets."eturnal/secret".sopsFile = ../../secrets/dali.yaml; 21 21 - templates.ejabberd-mod_stun_disco = { 22 22 - owner = "ejabberd"; 23 23 - group = "ejabberd"; 24 24 - content = lib.generators.toYAML { } { 25 25 - modules = { 26 26 - mod_stun_disco = { 27 27 - secret = config.sops.placeholder."eturnal/secret"; 28 28 - services = [ 29 29 - { 30 30 - host = config.garden.info.network.dandelion.ipv4; 31 31 - port = 3478; 32 32 - type = "stun"; 33 33 - transport = "udp"; 34 34 - restricted = false; 35 35 - } 36 36 - { 37 37 - host = config.garden.info.network.dandelion.ipv4; 38 38 - port = 3478; 39 39 - type = "turn"; 40 40 - transport = "udp"; 41 41 - restricted = true; 42 42 - } 43 43 - { 44 44 - host = config.garden.info.network.dandelion.ipv6; 45 45 - port = 3478; 46 46 - type = "stun"; 47 47 - transport = "udp"; 48 48 - restricted = false; 49 49 - } 50 50 - { 51 51 - host = config.garden.info.network.dandelion.ipv6; 52 52 - port = 3478; 53 53 - type = "turn"; 54 54 - transport = "udp"; 55 55 - restricted = true; 56 56 - } 57 57 - { 58 58 - host = config.garden.info.network.dandelion.ipv4; 59 59 - port = 3478; 60 60 - type = "stun"; 61 61 - transport = "tcp"; 62 62 - restricted = false; 63 63 - } 64 64 - { 65 65 - host = config.garden.info.network.dandelion.ipv4; 66 66 - port = 3478; 67 67 - type = "turn"; 68 68 - transport = "tcp"; 69 69 - restricted = true; 70 70 - } 71 71 - { 72 72 - host = config.garden.info.network.dandelion.ipv6; 73 73 - port = 3478; 74 74 - type = "stun"; 75 75 - transport = "tcp"; 76 76 - restricted = false; 77 77 - } 78 78 - { 79 79 - host = config.garden.info.network.dandelion.ipv6; 80 80 - port = 3478; 81 81 - type = "turn"; 82 82 - transport = "tcp"; 83 83 - restricted = true; 84 84 - } 85 85 - { 86 86 - host = "butwho.org"; 87 87 - port = 5349; 88 88 - type = "stuns"; 89 89 - transport = "tcp"; 90 90 - restricted = false; 91 91 - } 92 92 - { 93 93 - host = "butwho.org"; 94 94 - port = 5349; 95 95 - type = "turns"; 96 96 - transport = "tcp"; 97 97 - restricted = true; 98 98 - } 99 99 - ]; 100 100 - }; 101 101 - }; 102 102 - }; 103 103 - }; 19 19 + networking.firewall = { 20 20 + allowedTCPPorts = [ 21 21 + # 1883 # MQTT 22 22 + 5222 # Jabberd/XMPP client connections 23 23 + 5223 # Jabberd client SSL 24 24 + 5269 # Jabber/XMPP incoming server connections 25 25 + 5270 # Jabberd server SSL 26 26 + # 5280 # HTTP for Web Admin 27 27 + # NOTE: ejabberd doesn't support either HTTP/2 or HTTP/3, consider running caddy infront of ejabberd 28 28 + 5349 # STUN/TURN 29 29 + 5443 # HTTPS for Web Admin and File Upload 30 30 + 7777 # mod_proxy65 31 31 + ]; 32 32 + allowedUDPPorts = [ 33 33 + 3478 # STUN/TURN 34 34 + ]; 35 35 + allowedUDPPortRanges = [ 36 36 + { 37 37 + from = 49152; 38 38 + to = 65535; 39 39 + } 40 40 + ]; 104 41 }; 105 42 106 106 - networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = [ 107 107 - # 1883 # MQTT 108 108 - 5222 # Jabberd/XMPP client connections 109 109 - 5223 # Jabberd client SSL 110 110 - 5269 # Jabber/XMPP incoming server connections 111 111 - 5270 # Jabberd server SSL 112 112 - 5280 # HTTP for Web Admin 113 113 - # 5443 # HTTPS for Web Admin and File Upload (terminated by caddy) 114 114 - 7777 # mod_proxy65 115 115 - ]; 116 116 - 117 43 services.postgresql = { 118 44 ensureDatabases = [ "ejabberd" ]; 119 45 ensureUsers = [ ··· 135 61 lib.generators.toYAML { } { 136 62 hosts = [ "butwho.org" ]; 137 63 include_config_file = [ 138 138 - config.sops.templates.ejabberd-mod_stun_disco.path 139 64 # NOTE: When using the yaml generators provided by nixos, the numeric keys are strings (nix doesn't support 140 65 # numeric keys). ejabberd doesn't attempt to convert the string to an integer so it doesn't recognize the 141 66 # numeric key causing a configuration error. ··· 158 83 acme.auto = false; 159 84 certfiles = [ 160 85 # butwho.org 161 161 - "/mnt/certs/butwho.org/butwho.org.crt" 162 162 - "/mnt/certs/butwho.org/butwho.org.key" 86 86 + "/var/ssl/butwho.org/butwho.org.crt" 87 87 + "/var/ssl/butwho.org/butwho.org.key" 163 88 164 89 # muc.butwho.org 165 165 - "/mnt/certs/muc.butwho.org/muc.butwho.org.crt" 166 166 - "/mnt/certs/muc.butwho.org/muc.butwho.org.key" 90 90 + "/var/ssl/muc.butwho.org/muc.butwho.org.crt" 91 91 + "/var/ssl/muc.butwho.org/muc.butwho.org.key" 167 92 168 93 # proxy.butwho.org 169 169 - "/mnt/certs/proxy.butwho.org/proxy.butwho.org.crt" 170 170 - "/mnt/certs/proxy.butwho.org/proxy.butwho.org.key" 94 94 + "/var/ssl/proxy.butwho.org/proxy.butwho.org.crt" 95 95 + "/var/ssl/proxy.butwho.org/proxy.butwho.org.key" 171 96 172 97 # pubsub.butwho.org 173 173 - "/mnt/certs/pubsub.butwho.org/pubsub.butwho.org.crt" 174 174 - "/mnt/certs/pubsub.butwho.org/pubsub.butwho.org.key" 98 98 + "/var/ssl/pubsub.butwho.org/pubsub.butwho.org.crt" 99 99 + "/var/ssl/pubsub.butwho.org/pubsub.butwho.org.key" 175 100 176 101 # upload.butwho.org 177 177 - "/mnt/certs/upload.butwho.org/upload.butwho.org.crt" 178 178 - "/mnt/certs/upload.butwho.org/upload.butwho.org.key" 102 102 + "/var/ssl/upload.butwho.org/upload.butwho.org.crt" 103 103 + "/var/ssl/upload.butwho.org/upload.butwho.org.key" 179 104 ]; 180 105 trusted_proxies = [ config.garden.info.network.dandelion.netbird-ip ]; 181 106 listen = [ ··· 187 112 shaper = "c2s_shaper"; 188 113 access = "c2s"; 189 114 starttls_required = true; 190 190 - use_proxy_protocol = true; 191 115 } 192 116 { 193 117 port = 5223; ··· 197 121 shaper = "c2s_shaper"; 198 122 access = "c2s"; 199 123 allow_unencrypted_sasl2 = true; 200 200 - use_proxy_protocol = true; 201 124 } 202 125 { 203 126 port = 5269; ··· 205 128 module = "ejabberd_s2s_in"; 206 129 max_stanza_size = 524288; 207 130 shaper = "s2s_shaper"; 208 208 - use_proxy_protocol = true; 209 131 } 210 132 { 211 133 port = 5270; ··· 213 135 module = "ejabberd_s2s_in"; 214 136 max_stanza_size = 524288; 215 137 shaper = "s2s_shaper"; 216 216 - use_proxy_protocol = true; 217 138 } 218 139 { 219 140 port = 5280; 220 141 ip = "::"; 221 142 module = "ejabberd_http"; 143 143 + request_handlers = { 144 144 + "/admin" = "ejabberd_web_admin"; 145 145 + }; 146 146 + } 147 147 + { 148 148 + port = 5443; 149 149 + ip = "::"; 150 150 + module = "ejabberd_http"; 151 151 + tls = true; 222 152 request_handlers = { 223 153 "/admin" = "ejabberd_web_admin"; 224 154 "/api" = "mod_http_api"; ··· 227 157 "/upload" = "mod_http_upload"; 228 158 "/ws" = "ejabberd_http_ws"; 229 159 }; 160 160 + } 161 161 + { 162 162 + port = 3478; 163 163 + transport = "udp"; 164 164 + module = "ejabberd_stun"; 165 165 + use_turn = true; 166 166 + turn_min_port = 49152; 167 167 + turn_max_port = 65535; 168 168 + turn_ipv4_address = config.garden.info.network.lily.ipv4; 169 169 + turn_ipv6_address = config.garden.info.network.lily.ipv6; 170 170 + } 171 171 + { 172 172 + port = 5349; 173 173 + transport = "tcp"; 174 174 + module = "ejabberd_stun"; 175 175 + use_turn = true; 176 176 + tls = true; 177 177 + turn_min_port = 49152; 178 178 + turn_max_port = 65535; 179 179 + turn_ipv4_address = config.garden.info.network.lily.ipv4; 180 180 + turn_ipv6_address = config.garden.info.network.lily.ipv6; 230 181 } 231 182 # NOTE: This (mqtt) may be more useful when I do more IoT stuff but it doesn't seem to have much use for 232 183 # internet messaging at the moment ··· 477 428 # NOTE: I cannot setup mod_sip since it doesn't support SCRAM passwords 478 429 # mod_sip = { }; 479 430 mod_stream_mgmt.resend_on_timeout = "if_offline"; 431 431 + mod_stun_disco = { 432 432 + services = [ 433 433 + { 434 434 + host = config.garden.info.network.lily.ipv4; 435 435 + port = 3478; 436 436 + type = "stun"; 437 437 + transport = "udp"; 438 438 + restricted = false; 439 439 + } 440 440 + { 441 441 + host = config.garden.info.network.lily.ipv4; 442 442 + port = 3478; 443 443 + type = "turn"; 444 444 + transport = "udp"; 445 445 + restricted = true; 446 446 + } 447 447 + { 448 448 + host = config.garden.info.network.lily.ipv6; 449 449 + port = 3478; 450 450 + type = "stun"; 451 451 + transport = "udp"; 452 452 + restricted = false; 453 453 + } 454 454 + { 455 455 + host = config.garden.info.network.lily.ipv6; 456 456 + port = 3478; 457 457 + type = "turn"; 458 458 + transport = "udp"; 459 459 + restricted = true; 460 460 + } 461 461 + { 462 462 + host = config.garden.info.network.lily.ipv4; 463 463 + port = 3478; 464 464 + type = "stun"; 465 465 + transport = "tcp"; 466 466 + restricted = false; 467 467 + } 468 468 + { 469 469 + host = config.garden.info.network.lily.ipv4; 470 470 + port = 3478; 471 471 + type = "turn"; 472 472 + transport = "tcp"; 473 473 + restricted = true; 474 474 + } 475 475 + { 476 476 + host = config.garden.info.network.lily.ipv6; 477 477 + port = 3478; 478 478 + type = "stun"; 479 479 + transport = "tcp"; 480 480 + restricted = false; 481 481 + } 482 482 + { 483 483 + host = config.garden.info.network.lily.ipv6; 484 484 + port = 3478; 485 485 + type = "turn"; 486 486 + transport = "tcp"; 487 487 + restricted = true; 488 488 + } 489 489 + { 490 490 + host = "butwho.org"; 491 491 + port = 5349; 492 492 + type = "stuns"; 493 493 + transport = "tcp"; 494 494 + restricted = false; 495 495 + } 496 496 + { 497 497 + host = "butwho.org"; 498 498 + port = 5349; 499 499 + type = "turns"; 500 500 + transport = "tcp"; 501 501 + restricted = true; 502 502 + } 503 503 + ]; 504 504 + }; 480 505 mod_time = { }; 481 506 mod_vcard = { }; 482 507 mod_vcard_xupdate = { };