From 7786680e489fa1e786060944e9de17a36bb985b7 Mon Sep 17 00:00:00 2001 From: meaz Date: Sat, 2 Apr 2022 23:20:54 +0200 Subject: [PATCH] better match with latest change on prosody.cfg.lua.dist in trunk --- defaults/main.yml | 4 +- defaults/mod.yml | 25 ++----- .../conf.d/custom_component.cfg.lua.j2 | 5 ++ templates/etc/prosody/prosody.cfg.lua.j2 | 74 ++++++++++++------- 4 files changed, 62 insertions(+), 46 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index ae33b09..09a64e5 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -8,13 +8,12 @@ prosody_contact_info: "'support@example.org'" prosody_abuse_info: "'abuse@example.org'" prosody_core_modules_path: "/usr/lib/prosody/modules/" prosody_community_modules_path: "/usr/lib/prosody-modules" -prosody_custom_script_path: '/etc/prosody/custom_scripts' +prosody_installer_plugin_path: '/etc/prosody/custom_scripts' prosody_statistics: '' prosody_direct_tls_ports: 5223 prosody_c2s_direct_tls_ports: 5223 prosody_s2s_direct_tls_ports: 5269 - firewall_module_enabled: 'true' ## Firewall: list here what you want to block @@ -42,6 +41,7 @@ prosody_storage: 'internal' prosody_network_backend: "epoll" prosody_http_host: "example.org" prosody_http_external_url: "https://example.org" +prosody_archive_expires_after: '1w' #If using sql storage prosody_sql_driver: 'sqlite3' # postgresql sqlite3 or mysql diff --git a/defaults/mod.yml b/defaults/mod.yml index 16f5210..9779ef7 100644 --- a/defaults/mod.yml +++ b/defaults/mod.yml @@ -127,18 +127,7 @@ prosody_modules: - name: 'limits' description: 'Enable bandwidth limiting for XMPP connections.' - module_enabled: 'false' - extra_options: - - 'limits = {' - - 'c2s = {' - - 'rate = "10kb/s";' - - 'burst = "2s";' - - '};' - - 's2sin = {' - - 'rate = "30kb/s";' - - 'burst = "2s";' - - '};' - - '}' + module_enabled: 'true' - name: 'groups' description: 'Shared roster support.' @@ -180,7 +169,6 @@ prosody_modules: module_enabled: 'true' extra_options: - 'max_archive_query_results = 50;' - - 'archive_expires_after = "6m"; -- six months' - 'default_archive_policy = true; -- default' - 'archive_cleanup_interval = 3600*24 -- how often it checks if there are messages older than archive_expires_after. In seconds.' @@ -238,14 +226,13 @@ prosody_modules: - 'support = { "mailto:{{ prosody_contact_info }}", "xmpp:{{ prosody_contact_info }}" };' - '};' - - name: 'turncredentials' - description: 'Setup turnserver for viop' + - name: 'turn_external' + description: 'Audio/video call relay (STUN/TURN)' module_enabled: 'false' extra_options: - - 'turncredentials_secret = mysecret' - - 'turncredentials_host = turn.example.com' - - 'turncredentials_port = 3478' - - 'turncredentials_ttl = 86400;' + - 'turn_external_host = mysecret' + - 'turn_external_host = turn.example.com' + - 'turn_external_port = 3478' - name: 'firewall' description: 'Can efficiently block, bounce, drop, forward, copy, redirect stanzas and more.' diff --git a/templates/etc/prosody/conf.d/custom_component.cfg.lua.j2 b/templates/etc/prosody/conf.d/custom_component.cfg.lua.j2 index 30250e7..7d78079 100644 --- a/templates/etc/prosody/conf.d/custom_component.cfg.lua.j2 +++ b/templates/etc/prosody/conf.d/custom_component.cfg.lua.j2 @@ -1,5 +1,10 @@ -- {{ ansible_managed }} +------ Components ------ +-- You can specify components to add hosts that provide special services, +-- like multi-user conferences, and transports. +-- For more information on components, see https://prosody.im/doc/components + Component "{{ item.name }}" component_secret = "{{ item.secret }}" diff --git a/templates/etc/prosody/prosody.cfg.lua.j2 b/templates/etc/prosody/prosody.cfg.lua.j2 index 8414dcf..40a8916 100644 --- a/templates/etc/prosody/prosody.cfg.lua.j2 +++ b/templates/etc/prosody/prosody.cfg.lua.j2 @@ -3,7 +3,7 @@ -- Prosody Example Configuration File -- -- Information on configuring Prosody can be found on our --- website at http://prosody.im/doc/configure +-- website at https://prosody.im/doc/configure -- -- Tip: You can check that the syntax of this file is correct -- when you have finished by running this command: @@ -21,7 +21,7 @@ -- This is a (by default, empty) list of accounts that are admins -- for the server. Note that you must create the accounts separately --- (see http://prosody.im/doc/creating_accounts for info) +-- (see https://prosody.im/doc/creating_accounts for info) -- Example: admins = { "user1@example.com", "user2@example.net" } admins = { {{ prosody_admins }} } @@ -35,24 +35,27 @@ contact_info = { {{ prosody_contact_info }} } http_host = "{{ prosody_http_host }}" http_external_url = "{{ prosody_http_external_url }}" + +-- See https://prosody.im/doc/configure c2s_direct_tls_ports = { {{ prosody_c2s_direct_tls_ports }} } s2s_direct_tls_ports = { {{ prosody_s2s_direct_tls_ports }} } -- Enable use of libevent for better performance under high load --- For more information see: http://prosody.im/doc/libevent +-- For more information see: https://prosody.im/doc/libevent network_backend = "{{ prosody_network_backend }}" --- Prosody will always look in its source directory for modules, but --- this option allows you to specify additional locations where Prosody --- will look for modules first. For community modules, see https://modules.prosody.im/ +-- These paths are searched in the order specified, and before the default path plugin_paths = { "{{ prosody_core_modules_path }}","{{ prosody_community_modules_path }}" } --- Single directory for custom prosody plugins and/or Lua libraries installation --- This path takes priority over plugin_paths, when prosody is searching for modules -installer_plugin_path = "{{ prosody_custom_script_path }}" +-- Prosody Plugin Installer +-- CHeck https://prosody.im/doc/plugin_installer +-- By default plugins are installed into a directory custom_plugins under the data path. It can be customized by setting +plugin_server = "https://modules.prosody.im/rocks/" +installer_plugin_path = "{{ prosody_installer_plugin_path }}" +-- This path MUST be readable by the user Prosody runs as, and should be writable for prosodyctl install to work. +-- The installer path does not need to be added to plugin_paths. -- This is the list of modules Prosody will load on startup. --- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too. -- Documentation for bundled modules can be found at: https://prosody.im/doc/modules modules_enabled = { @@ -61,7 +64,7 @@ modules_enabled = { "{{ item.name }}"; -- {{ item.description }} {% endif %} {% endfor %} -}; +} -- These modules are auto-loaded, but should you want -- to disable them then uncomment them here: @@ -75,9 +78,22 @@ modules_disabled = { }; -- Disable account creation by default, for security --- For more information see http://prosody.im/doc/creating_accounts +-- For more information see https://prosody.im/doc/creating_accounts allow_registration = {{ prosody_allow_registration }}; +-- Rate limits +-- Enable rate limits for incoming client and server connections. These help +-- protect from excessive resource consumption and denial-of-service attacks. + +limits = { + c2s = { + rate = "10kb/s"; + }; + s2sin = { + rate = "30kb/s"; + }; +} + -- Debian: -- Please, don't change this option since /var/run/prosody/ -- is one of the few directories Prosody is allowed to write to @@ -89,6 +105,7 @@ pidfile = "/var/run/prosody/prosody.pid"; c2s_require_encryption = {{ prosody_c2s_encryption }} +-- See https://prosody.im/doc/modules/mod_c2s c2s_stanza_size_limit = {{ prosody_c2s_stanza_size_limit }} -- 256 * 1024 -- 256kb -- Force servers to use encrypted connections? This option will @@ -96,33 +113,35 @@ c2s_stanza_size_limit = {{ prosody_c2s_stanza_size_limit }} -- 256 * 1024 -- 256 s2s_require_encryption = {{ prosody_s2s_encryption }} --- Force certificate authentication for server-to-server connections? +-- Server-to-server authentication +-- Require valid certificates for server-to-server connections? +-- If false, other methods such as dialback (DNS) may be used instead. s2s_secure_auth = {{ prosody_s2s_auth }} -- Some servers have invalid or self-signed certificates. You can list -- remote domains here that will not be required to authenticate using --- certificates. They will be authenticated using DNS instead, even --- when s2s_secure_auth is enabled. +-- certificates. They will be authenticated using other methods instead, +-- even when s2s_secure_auth is enabled. {% if prosody_insecure_domains is defined %} s2s_insecure_domains = { "{{ prosody_insecure_domains }}" } {% endif %} --- Even if you leave s2s_secure_auth disabled, you can still require valid +-- Even if you disable s2s_secure_auth, you can still require valid -- certificates for some domains by specifying a list here. --s2s_secure_domains = { "{{ prosody_secure_domains }}" } +-- See https://prosody.im/doc/s2s s2s_stanza_size_limit = {{ prosody_s2s_stanza_size_limit }} -- 512 * 1000 -- 512kb - +-- Storage -- Select the storage backend to use. By default Prosody uses flat files -- in its configured data directory, but it also supports more backends -- through modules. An "sql" backend is included by default, but requires --- additional dependencies. See http://prosody.im/doc/storage for more info. +-- additional dependencies. See https://prosody.im/doc/storage for more info. ---storage = "sql" -- Default is "internal" (Debian: "sql" requires one of the --- lua-dbi-sqlite3, lua-dbi-mysql or lua-dbi-postgresql packages to work) +--storage = "sql" -- Default is "internal" storage = "{{ prosody_storage }}" {% if prosody_storage == 'sql' %} @@ -138,13 +157,21 @@ sql = { driver = "{{ prosody_sql_driver }}", database = "{{ prosody_sql_database {% endif %} {% endif %} +-- Archiving configuration +-- If mod_mam is enabled, Prosody will store a copy of every message. This +-- is used to synchronize conversations between multiple clients, even if +-- they are offline. This setting controls how long Prosody will keep +-- messages in the archive before removing them. + +archive_expires_after = "{{ prosody_archive_expires_after }}" -- Remove archived messages after X weeks or months + -- You can also configure messages to be stored in-memory only. For more -- archiving options, see https://prosody.im/doc/modules/mod_mam -- Logging configuration --- For advanced logging see http://prosody.im/doc/logging +-- For advanced logging see https://prosody.im/doc/logging log = { - -- Log files (change 'info' to 'debug' for debug logs): + -- Log files: {{ prosody_loglevel }} = "{{ prosody_log_path }}"; -- Change 'info' to 'debug' for verbose logging error = "{{ prosody_err_log }}"; -- "*syslog"; -- Uncomment this for logging to syslog @@ -169,9 +196,6 @@ statistics = "{{ prosody_statistics }}" -- Location of directory to find certificates in (relative to main config file): certificates = "{{ prosody_certificates }}" --- HTTPS currently only supports a single certificate, specify it here: ---https_certificate = "certs/localhost.crt" - {% if prosody_component_interface is defined %} {% for item in prosody_component_interface %} -- Prosody external component ports