Create an XMPP server with Prosody compatible with Conversations and Movim -- Luévano's Blog

ssl = required ssl_cert = <{yourcertdir}/fullchain.pem ssl_key = <{yourcertdir}/privkey.pem @@ -434,11 +434,35 @@ systemctl enable spamassassin.service Finally, that’s actually it for this entry, if you have any problem whatsoever you can contact me. + + + + + Next + + + + + + + Index + + + + + + + Previous + + + + +

By David Luévano Created: Sun, Mar 21, 2021 @ 04:05 UTC - Modified: Tue, Jun 08, 2021 @ 06:27 UTC + Modified: Tue, Jun 08, 2021 @ 07:29 UTC

Tags: english, server, tools, tutorial diff --git a/blog/dst/a/new_blogging_system.html b/blog/dst/a/new_blogging_system.html index c52ba09..210f15e 100644 --- a/blog/dst/a/new_blogging_system.html +++ b/blog/dst/a/new_blogging_system.html @@ -85,6 +85,30 @@ It might sound convoluted, but it works pretty well, with of course room to improve; I’m open to suggestions, issue reporting or direct contributions here. BTW, it only works on Linux for now (and don’t think on making it work on windows, but feel free to do PR for the compatibility). That’s it for now, the new RSS feed is available here: https://blog.luevano.xyz/rss.xml. + + + + + Next + + + + + + + Index + + + + + + + Previous + + + + +

By David Luévano diff --git a/blog/dst/a/website_with_nginx.html b/blog/dst/a/website_with_nginx.html index caf756f..dea1fba 100644 --- a/blog/dst/a/website_with_nginx.html +++ b/blog/dst/a/website_with_nginx.html @@ -198,11 +198,35 @@ systemctl restart nginx And a file will be opened where you need to add a new rule for Certbot, just append the line: 1 1 1 * * certbot renew (renew on the first day of every month) and you’re good. Alternatively use systemd timers as stated in the Arch Linux Wiki. That’s it, you now have a website with SSL certificate. + + + + + Next + + + + + + + Index + + + + + + + Previous + + + + +

By David Luévano Created: Fri, Mar 19, 2021 @ 02:58 UTC - Modified: Tue, Jun 08, 2021 @ 06:11 UTC + Modified: Tue, Jun 08, 2021 @ 07:27 UTC

Tags: english, server, tools, tutorial diff --git a/blog/dst/a/xmpp_server_with_prosody.html b/blog/dst/a/xmpp_server_with_prosody.html new file mode 100644 index 0000000..d25de3f --- /dev/null +++ b/blog/dst/a/xmpp_server_with_prosody.html @@ -0,0 +1,636 @@ + + + + + + + Create an XMPP server with Prosody compatible with Conversations and Movim -- Luévano's Blog + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Home + + + + Blog + + + + Art + + + Git + + + + + + + + + + Stuff + + Gameboy + + + + + + + + + + Create an XMPP server with Prosody compatible with Conversations and Movim + + Recently I set up an XMPP server (and a Matrix one, too) for my personal use and for friends if they want one; made one for EL ELE EME, for example. So, here are the notes on how I set up the server that is compatible with the Conversations app and the Movim social network. You can see my addresses in contact and the XMPP compliance/score of the server. +One of the best resources I found that helped me a lot was Installing and Configuring Prosody XMPP Server on Debian 9, and of course the Arch Wiki and the oficial documentation. +As with my other entries, this is under a server running Arch Linux, with the Nginx web server and Certbot certificates. And all commands here are executed as root (unless specified otherwise) +Prerequisites +Same as with my other entries (website, mail and git) plus: + +A and (optionally) AAA DNS records for: +xmpp: the actual XMPP server and the file upload service. +muc (or conference): for multi-user chats. +pubsub: the publish-subscribe service. +proxy: a proxy in case one of the users needs it. +vjud: user directory. + + +(Optionally, but recommended) the following SRV DNS records; make sure it is pointing to an A or AAA record (matching the records from the last point, for example): +_xmpp-client._tcp.**your.domain**. for port 5222 pointing to xmpp.**your.domain**. +_xmpp-server._tcp.**your.domain**. for port 5269 pointing to xmpp.**your.domain**. +_xmpp-server._tcp.muc.**your.domain**. for port 5269 pointing to xmpp.**your.domain**. + + +SSL certificates for the previous subdomains; similar that with my other entries just create the appropriate prosody.conf (where server_name will be all the subdomains defined above) file and run certbot --nginx. You can find the example configuration file almost at the end of this entry. +Email addresses for admin, abuse, contact, security, etc. Or use your own email for all of them, doesn’t really matter much as long as you define them in the configuration and are valid, I have aliases so those emails are forwarded to me. +Allow ports 5000, 5222, 5269, 5280 and 5281 for Prosody and, 3478 and 5349 for Turnserver which are the defaults for coturn. + +Prosody +Prosody is an implementation of the XMPP protocol that is flexible and extensible. +Install the prosody package (with optional dependencies) and the mercurial package: +pacman -S prosody, mercurial, lua52-sec, lua52-dbi, lua52-zlib + +We need mercurial to be able to download and update the extra modules needed to make the server compliant with conversations.im and mov.im. Go to /var/lib/prosody, clone the latest Prosody modules repository and prepare the directories: +cd /var/lib/prosody +hg clone https://hg.prosody.im/prosody-modules modules-available +mkdir modules-enabled + +You can see that I follow a similar approach that I used with Nginx and the server configuration, where I have all the modules available in a directory, and make a symlink to another to keep track of what is being used. You can update the repository by running hg pull --update while inside the modules-available directory (similar to Git). +Make symbolic links to the following modules: +ln -s /var/lib/prosody/modules-available/MODULE_NAME /var/lib/prosody/modules-enabled/ +... + + +Modules: +mod_bookmarks +mod_cache_c2s_caps +mod_checkcerts +mod_cloud_notify +mod_csi_battery_saver +mod_default_bookmarks +mod_external_services +mod_http_avatar +mod_http_pep_avatar +mod_http_upload +mod_http_upload_external +mod_idlecompat +mod_muc_limits +mod_muc_mam_hints +mod_muc_mention_notifications +mod_presence_cache +mod_pubsub_feeds +mod_pubsub_text_interface +mod_smacks +mod_strict_https +mod_vcard_muc +mod_vjud +mod_watchuntrusted + + + +And add other modules if needed, but these work for the apps that I mentioned. You should also change the permissions for these files: +chown -R prosody:prosody /var/lib/prosody + +Now, configure the server by editing the /etc/prosody/prosody.cfg.lua file. It’s a bit tricky to configure, so here is my configuration file (lines starting with -- are comments). Make sure to change according to your domain, and maybe preferences. Read each line and each comment to know what’s going on, It’s easier to explain it with comments in the file itself than strip it in a lot of pieces. +And also, note that the configuration file has a “global” section and a per “virtual server”/”component” section, basically everything above all the VirtualServer/Component sections are global, and bellow each VirtualServer/Component, corresponds to that section. +-- important for systemd +daemonize = true +pidfile = "/run/prosody/prosody.pid" + +-- or your account, not that this is an xmpp jid, not email +admins = { "admin@your.domain" } + +contact_info = { + abuse = { "mailto:abuse@your.domain", "xmpp:abuse@your.domain" }; + admin = { "mailto:admin@your.domain", "xmpp:admin@your.domain" }; + admin = { "mailto:feedback@your.domain", "xmpp:feedback@your.domain" }; + security = { "mailto:security@your.domain" }; + support = { "mailto:support@your.domain", "xmpp:support@muc.your.domain" }; +} + +-- so prosody look up the plugins we added +plugin_paths = { "/var/lib/prosody/modules-enabled" } + +modules_enabled = { + -- Generally required + "roster"; -- Allow users to have a roster. Recommended ;) + "saslauth"; -- Authentication for clients and servers. Recommended if you want to log in. + "tls"; -- Add support for secure TLS on c2s/s2s connections + "dialback"; -- s2s dialback support + "disco"; -- Service discovery + -- Not essential, but recommended + "carbons"; -- Keep multiple clients in sync + "pep"; -- Enables users to publish their avatar, mood, activity, playing music and more + "private"; -- Private XML storage (for room bookmarks, etc.) + "blocklist"; -- Allow users to block communications with other users + "vcard4"; -- User profiles (stored in PEP) + "vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard + "limits"; -- Enable bandwidth limiting for XMPP connections + -- Nice to have + "version"; -- Replies to server version requests + "uptime"; -- Report how long server has been running + "time"; -- Let others know the time here on this server + "ping"; -- Replies to XMPP pings with pongs + "register"; -- Allow users to register on this server using a client and change passwords + "mam"; -- Store messages in an archive and allow users to access it + "csi_simple"; -- Simple Mobile optimizations + -- Admin interfaces + "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands + --"admin_telnet"; -- Opens telnet console interface on localhost port 5582 + -- HTTP modules + "http"; -- Explicitly enable http server. + "bosh"; -- Enable BOSH clients, aka "Jabber over HTTP" + "websocket"; -- XMPP over WebSockets + "http_files"; -- Serve static files from a directory over HTTP + -- Other specific functionality + "groups"; -- Shared roster support + "server_contact_info"; -- Publish contact information for this service + "announce"; -- Send announcement to all online users + "welcome"; -- Welcome users who register accounts + "watchregistrations"; -- Alert admins of registrations + "motd"; -- Send a message to users when they log in + --"legacyauth"; -- Legacy authentication. Only used by some old clients and bots. + --"s2s_bidi"; -- not yet implemented, have to wait for v0.12 + "bookmarks"; + "checkcerts"; + "cloud_notify"; + "csi_battery_saver"; + "default_bookmarks"; + "http_avatar"; + "idlecompat"; + "presence_cache"; + "smacks"; + "strict_https"; + --"pep_vcard_avatar"; -- not compatible with this version of pep, wait for v0.12 + "watchuntrusted"; + "webpresence"; + "external_services"; + } + +-- only if you want to disable some modules +modules_disabled = { + -- "offline"; -- Store offline messages + -- "c2s"; -- Handle client connections + -- "s2s"; -- Handle server-to-server connections + -- "posix"; -- POSIX functionality, sends server to background, enables syslog, etc. +} + +external_services = { + { + type = "stun", + transport = "udp", + host = "proxy.your.domain", + port = 3478 + }, { + type = "turn", + transport = "udp", + host = "proxy.your.domain", + port = 3478, + -- you could decide this now or come back later when you install coturn + secret = "YOUR SUPER SECRET TURN PASSWORD" + } +} + +--- general global configuration +http_ports = { 5280 } +http_interfaces = { "*", "::" } + +https_ports = { 5281 } +https_interfaces = { "*", "::" } + +proxy65_ports = { 5000 } +proxy65_interfaces = { "*", "::" } + +http_default_host = "xmpp.your.domain" +http_external_url = "https://xmpp.your.domain/" +-- or if you want to have it somewhere else, change this +https_certificate = "/etc/prosody/certs/xmpp.your.domain.crt" + +hsts_header = "max-age=31556952" + +cross_domain_bosh = true +--consider_bosh_secure = true +cross_domain_websocket = true +--consider_websocket_secure = true + +trusted_proxies = { "127.0.0.1", "::1", "192.169.1.1" } + +pep_max_items = 10000 + +-- this is disabled by default, and I keep it like this, depends on you +--allow_registration = true + +-- you might want this options as they are +c2s_require_encryption = true +s2s_require_encryption = true +s2s_secure_auth = false +--s2s_insecure_domains = { "insecure.example" } +--s2s_secure_domains = { "jabber.org" } + +-- where the certificates are stored (/etc/prosody/certs by default) +certificates = "certs" +checkcerts_notify = 7 -- ( in days ) + +-- rate limits on connections to the server, these are my personal settings, because by default they were limited to something like 30kb/s +limits = { + c2s = { + rate = "2000kb/s"; + }; + s2sin = { + rate = "5000kb/s"; + }; + s2sout = { + rate = "5000kb/s"; + }; +} + +-- again, this could be yourself, it is a jid +unlimited_jids = { "admin@your.domain" } + +authentication = "internal_hashed" + +-- if you don't want to use sql, change it to internal and comment the second line +-- since this is optional, i won't describe how to setup mysql or setup the user/database, that would be out of the scope for this entry +storage = "sql" +sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "PROSODY USER SECRET PASSWORD", host = "localhost" } + +archive_expires_after = "4w" -- configure message archive +max_archive_query_results = 20; +mam_smart_enable = true +default_archive_policy = "roster" -- archive only messages from users who are in your roster + +-- normally you would like at least one log file of certain level, but I keep all of them, the default is only the info = "*syslog" one +log = { + info = "*syslog"; + warn = "prosody.warn"; + error = "prosody.err"; + debug = "prosody.debug"; + -- "*console"; -- Needs daemonize=false +} + +-- cloud_notify +push_notification_with_body = false -- Whether or not to send the message body to remote pubsub node +push_notification_with_sender = false -- Whether or not to send the message sender to remote pubsub node +push_max_errors = 5 -- persistent push errors are tolerated before notifications for the identifier in question are disabled +push_max_devices = 5 -- number of allowed devices per user + +-- by default every user on this server will join these muc rooms +default_bookmarks = { + { jid = "room@muc.your.domain", name = "The Room" }; + { jid = "support@muc.your.domain", name = "Support Room" }; +} + +-- could be your jid +untrusted_fail_watchers = { "admin@your.domain" } +untrusted_fail_notification = "Establishing a secure connection from $from_host to $to_host failed. Certificate hash: $sha1. $errors" + +----------- Virtual hosts ----------- +VirtualHost "your.domain" + name = "Prosody" + http_host = "xmpp.your.domain" + +disco_items = { + { "your.domain", "Prosody" }; + { "muc.your.domain", "MUC Service" }; + { "pubsub.your.domain", "Pubsub Service" }; + { "proxy.your.domain", "SOCKS5 Bytestreams Service" }; + { "vjud.your.domain", "User Directory" }; +} + + +-- Multi-user chat +Component "muc.your.domain" "muc" + name = "MUC Service" + modules_enabled = { + --"bob"; -- not compatible with this version of Prosody + "muc_limits"; + "muc_mam"; -- message archive in muc, again, a placeholder + "muc_mam_hints"; + "muc_mention_notifications"; + "vcard_muc"; + } + + restrict_room_creation = false + + muc_log_by_default = true + muc_log_presences = false + log_all_rooms = false + muc_log_expires_after = "1w" + muc_log_cleanup_interval = 4 * 60 * 60 + + +-- Upload +Component "xmpp.your.domain" "http_upload" + name = "Upload Service" + http_host= "xmpp.your.domain" + -- you might want to change this, these are numbers in bytes, so 10MB and 100MB respectively + http_upload_file_size_limit = 1024*1024*10 + http_upload_quota = 1024*1024*100 + + +-- Pubsub +Component "pubsub.your.domain" "pubsub" + name = "Pubsub Service" + pubsub_max_items = 10000 + modules_enabled = { + "pubsub_feeds"; + "pubsub_text_interface"; + } + + -- personally i don't have any feeds configured + feeds = { + -- The part before = is used as PubSub node + --planet_jabber = "http://planet.jabber.org/atom.xml"; + --prosody_blog = "http://blog.prosody.im/feed/atom.xml"; + } + + +-- Proxy +Component "proxy.your.domain" "proxy65" + name = "SOCKS5 Bytestreams Service" + proxy65_address = "proxy.your.domain" + + +-- Vjud, user directory +Component "vjud.your.domain" "vjud" + name = "User Directory" + vjud_mode = "opt-in" + +You HAVE to read all of the configuration file, because there are a lot of things that you need to change to make it work with your server/domain. Test the configuration file with: +luac5.2 -p /etc/prosody/prosody.cfg.lua + +Notice that by default prosody will look up certificates that look like sub.your.domain, but if you get the certificates as myself, you’ll have a single certificate for all subdomains, and by default it is in /etc/letsencrypt/live, which has some strict permissions. So, to import them you can run: +prosodyctl --root cert import /etc/letsencrypt/live + +Ignore the complaining about not finding the subdomain certificates and note that you will have to run that command on each certificate renewal, to automate this, add the --deploy-hook flag to your automated Certbot renewal system; for me it’s a systemd timer with the following certbot.service: +[Unit] +Description=Let's Encrypt renewal + +[Service] +Type=oneshot +ExecStart=/usr/bin/certbot renew --quiet --agree-tos --deploy-hook "systemctl reload nginx.service && prosodyctl --root cert import /etc/letsencrypt/live" + +And if you don’t have it already, the certbot.timer: +[Unit] +Description=Twice daily renewal of Let's Encrypt's certificates + +[Timer] +OnCalendar=0/12:00:00 +RandomizedDelaySec=1h +Persistent=true + +[Install] +WantedBy=timers.target + +Also, go to the certs directory and make the appropriate symbolic links: +cd /etc/prosody/certs +ln -s your.domain.crt SUBDOMAIN.your.domain.crt +ln -s your.domain.key SUBDOMAIN.your.domain.key +... + +That’s basically all the configuration that needs Prosody itself, but we still have to configure Nginx and Coturn before starting/enabling the prosody service. +Nginx configuration file +Since this is not an ordinary configuration file I’m going to describe this too. Your prosody.conf file should have the following location blocks under the main server block (the one that listens to HTTPS): +# HTTPS server block +server { + root /var/www/prosody/; + server_name xmpp.luevano.xyz muc.luevano.xyz pubsub.luevano.xyz vjud.luevano.xyz proxy.luevano.xyz; + index index.html; + + # for extra https discovery (XEP-0256) + location /.well-known/acme-challenge { + allow all; + } + + # bosh specific + location /http-bind { + proxy_pass https://localhost:5281/http-bind; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_buffering off; + tcp_nodelay on; + } + + # websocket specific + location /xmpp-websocket { + proxy_pass https://localhost:5281/xmpp-websocket; + + proxy_http_version 1.1; + proxy_set_header Connection "Upgrade"; + proxy_set_header Upgrade $http_upgrade; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 900s; + } + + # general proxy + location / { + proxy_pass https://localhost:5281; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + ... + # Certbot stuff +} +# HTTP server block (the one that certbot creates) +server { + ... +} + +Also, you need to add the following to your actual your.domain (this cannot be a subdomain) configuration file: +server { + ... + location /.well-known/host-meta { + default_type 'application/xrd+xml'; + add_header Access-Control-Allow-Origin '*' always; + } + + location /.well-known/host-meta.json { + default_type 'application/jrd+json'; + add_header Access-Control-Allow-Origin '*' always; + } + ... +} + +And you will need the following host-meta and host-meta.json files inside the .well-known/acme-challenge directory for your.domain (following my nomenclature: /var/www/yourdomaindir/.well-known/acme-challenge/). +For host-meta file: +<?xml version='1.0' encoding='utf-8'?> +<XRD xmlns='http://docs.oasis-open.org/ns/xri/xrd-1.0'> + <Link rel="urn:xmpp:alt-connections:xbosh" + href="https://xmpp.your.domain:5281/http-bind" /> + <Link rel="urn:xmpp:alt-connections:websocket" + href="wss://xmpp.your.domain:5281/xmpp-websocket" /> +</XRD> + +And host-meta.json file: +{ + "links": [ + { + "rel": "urn:xmpp:alt-connections:xbosh", + "href": "https://xmpp.your.domain:5281/http-bind" + }, + { + "rel": "urn:xmpp:alt-connections:websocket", + "href": "wss://xmpp.your.domain:5281/xmpp-websocket" + } + ] +} + +Remember to have your prosody.conf file symlinked (or discoverable by Nginx) to the sites-enabled directory. You can now restart your nginx service (and test the configuration, optionally): +nginx -t +systemctl restart nginx.service + +Coturn +Coturn is the implementation of TURN and STUN server, which in general is for (at least in the XMPP world) voice support and external service discovery. +Install the coturn package: +pacman -S coturn + +You can modify the configuration file (located at /etc/turnserver/turnserver.conf) as desired, but at least you need to make the following changes (uncomment or edit): +use-auth-secret +realm=proxy.your.domain +static-auth-secret=YOUR SUPER SECRET TURN PASSWORD + +I’m sure there is more configuration to be made, like using SQL to store data and whatnot, but for now this is enough for me. Note that you may not have some functionality that’s needed to create dynamic users to use the TURN server, and to be honest I haven’t tested this since I don’t use this feature in my XMPP clients, but if it doesn’t work, or you know of an error or missing configuration don’t hesitate to contact me. +Start/enable the turnserver service: +systemctl start turnserver.service +systemctl enable turnserver.service + +You can test if your TURN server works at Trickle ICE. You may need to add a user in the turnserver.conf to test this. +Wrapping up +At this point you should have a working XMPP server, start/enable the prosody service now: +systemctl start prosody.service +systemctl enable prosody.service + +And you can add your first user with the prosodyctl command (it will prompt you to add a password): +prosodyctl adduser user@your.domain + +You may want to add a compliance user, so you can check if your server is set up correctly. To do so, go to XMPP Compliance Tester and enter the compliance user credentials. It should have similar compliance score to mine: + +Additionally, you can test the security of your server in IM Observatory, here you only need to specify your domain.name (not xmpp.domain.name, if you set up the SRV DNS records correctly). Again, it should have a similar score to mine: + +You can now log in into your XMPP client of choice, if it asks for the server it should be xmpp.your.domain (or your.domain for some clients) and your login credentials you@your.domain and the password you chose (which you can change in most clients). +That’s it, send me a message david@luevano.xyz if you were able to set up the server successfully. + + + + + + + Index + + + + + + + Previous + + + + + + + + By David Luévano + Created: Wed, Jun 09, 2021 @ 05:24 UTC + + Tags: +english, server, tools, tutorial + + + + + + + + + Contact + + + + + Donate + + + + + RSS + + + + + + Created with pyssg + + + + + Copyright 2021 David Luévano Alvarado + + + + \ No newline at end of file diff --git a/blog/dst/index.html b/blog/dst/index.html index d6507e1..adad582 100644 --- a/blog/dst/index.html +++ b/blog/dst/index.html @@ -95,6 +95,7 @@ Articles

June 2021 + Jun 09 - Create an XMPP server with Prosody compatible with Conversations and Movim Jun 06 - Al fin ya me acomodé la página pa' los dibujos Jun 04 - Así nomás está quedando el página May 2021 diff --git a/blog/dst/rss.xml b/blog/dst/rss.xml index 94e819c..dd2556d 100644 --- a/blog/dst/rss.xml +++ b/blog/dst/rss.xml @@ -13,8 +13,8 @@ Copyright 2021 David Luévano Alvarado david@luevano.xyz (David Luévano Alvarado) david@luevano.xyz (David Luévano Alvarado) - Tue, 08 Jun 2021 06:57:28 GMT - Tue, 08 Jun 2021 06:57:28 GMT + Wed, 09 Jun 2021 05:24:56 GMT + Wed, 09 Jun 2021 05:24:56 GMT pyssg v0.5.9 https://validator.w3.org/feed/docs/rss2.html 30 @@ -23,6 +23,513 @@ Luévano's Blog https://blog.luevano.xyz + + Create an XMPP server with Prosody compatible with Conversations and Movim + https://blog.luevano.xyz/a/xmpp_server_with_prosody.html + https://blog.luevano.xyz/a/xmpp_server_with_prosody.html + Wed, 09 Jun 2021 05:24:30 GMT + English + Server + Tools + Tutorial + How to create an XMPP server using Prosody on a server running Nginx. This server will be compatible with at least Conversations and Movim. + Recently I set up an XMPP server (and a Matrix one, too) for my personal use and for friends if they want one; made one for EL ELE EME, for example. So, here are the notes on how I set up the server that is compatible with the Conversations app and the Movim social network. You can see my addresses in contact and the XMPP compliance/score of the server. +One of the best resources I found that helped me a lot was Installing and Configuring Prosody XMPP Server on Debian 9, and of course the Arch Wiki and the oficial documentation. +As with my other entries, this is under a server running Arch Linux, with the Nginx web server and Certbot certificates. And all commands here are executed as root (unless specified otherwise) +Prerequisites +Same as with my other entries (website, mail and git) plus: + +A and (optionally) AAA DNS records for: +xmpp: the actual XMPP server and the file upload service. +muc (or conference): for multi-user chats. +pubsub: the publish-subscribe service. +proxy: a proxy in case one of the users needs it. +vjud: user directory. + + +(Optionally, but recommended) the following SRV DNS records; make sure it is pointing to an A or AAA record (matching the records from the last point, for example): +_xmpp-client._tcp.**your.domain**. for port 5222 pointing to xmpp.**your.domain**. +_xmpp-server._tcp.**your.domain**. for port 5269 pointing to xmpp.**your.domain**. +_xmpp-server._tcp.muc.**your.domain**. for port 5269 pointing to xmpp.**your.domain**. + + +SSL certificates for the previous subdomains; similar that with my other entries just create the appropriate prosody.conf (where server_name will be all the subdomains defined above) file and run certbot --nginx. You can find the example configuration file almost at the end of this entry. +Email addresses for admin, abuse, contact, security, etc. Or use your own email for all of them, doesn’t really matter much as long as you define them in the configuration and are valid, I have aliases so those emails are forwarded to me. +Allow ports 5000, 5222, 5269, 5280 and 5281 for Prosody and, 3478 and 5349 for Turnserver which are the defaults for coturn. + +Prosody +Prosody is an implementation of the XMPP protocol that is flexible and extensible. +Install the prosody package (with optional dependencies) and the mercurial package: +pacman -S prosody, mercurial, lua52-sec, lua52-dbi, lua52-zlib + +We need mercurial to be able to download and update the extra modules needed to make the server compliant with conversations.im and mov.im. Go to /var/lib/prosody, clone the latest Prosody modules repository and prepare the directories: +cd /var/lib/prosody +hg clone https://hg.prosody.im/prosody-modules modules-available +mkdir modules-enabled + +You can see that I follow a similar approach that I used with Nginx and the server configuration, where I have all the modules available in a directory, and make a symlink to another to keep track of what is being used. You can update the repository by running hg pull --update while inside the modules-available directory (similar to Git). +Make symbolic links to the following modules: +ln -s /var/lib/prosody/modules-available/MODULE_NAME /var/lib/prosody/modules-enabled/ +... + + +Modules: +mod_bookmarks +mod_cache_c2s_caps +mod_checkcerts +mod_cloud_notify +mod_csi_battery_saver +mod_default_bookmarks +mod_external_services +mod_http_avatar +mod_http_pep_avatar +mod_http_upload +mod_http_upload_external +mod_idlecompat +mod_muc_limits +mod_muc_mam_hints +mod_muc_mention_notifications +mod_presence_cache +mod_pubsub_feeds +mod_pubsub_text_interface +mod_smacks +mod_strict_https +mod_vcard_muc +mod_vjud +mod_watchuntrusted + + + +And add other modules if needed, but these work for the apps that I mentioned. You should also change the permissions for these files: +chown -R prosody:prosody /var/lib/prosody + +Now, configure the server by editing the /etc/prosody/prosody.cfg.lua file. It’s a bit tricky to configure, so here is my configuration file (lines starting with -- are comments). Make sure to change according to your domain, and maybe preferences. Read each line and each comment to know what’s going on, It’s easier to explain it with comments in the file itself than strip it in a lot of pieces. +And also, note that the configuration file has a “global” section and a per “virtual server”/”component” section, basically everything above all the VirtualServer/Component sections are global, and bellow each VirtualServer/Component, corresponds to that section. +-- important for systemd +daemonize = true +pidfile = "/run/prosody/prosody.pid" + +-- or your account, not that this is an xmpp jid, not email +admins = { "admin@your.domain" } + +contact_info = { + abuse = { "mailto:abuse@your.domain", "xmpp:abuse@your.domain" }; + admin = { "mailto:admin@your.domain", "xmpp:admin@your.domain" }; + admin = { "mailto:feedback@your.domain", "xmpp:feedback@your.domain" }; + security = { "mailto:security@your.domain" }; + support = { "mailto:support@your.domain", "xmpp:support@muc.your.domain" }; +} + +-- so prosody look up the plugins we added +plugin_paths = { "/var/lib/prosody/modules-enabled" } + +modules_enabled = { + -- Generally required + "roster"; -- Allow users to have a roster. Recommended ;) + "saslauth"; -- Authentication for clients and servers. Recommended if you want to log in. + "tls"; -- Add support for secure TLS on c2s/s2s connections + "dialback"; -- s2s dialback support + "disco"; -- Service discovery + -- Not essential, but recommended + "carbons"; -- Keep multiple clients in sync + "pep"; -- Enables users to publish their avatar, mood, activity, playing music and more + "private"; -- Private XML storage (for room bookmarks, etc.) + "blocklist"; -- Allow users to block communications with other users + "vcard4"; -- User profiles (stored in PEP) + "vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard + "limits"; -- Enable bandwidth limiting for XMPP connections + -- Nice to have + "version"; -- Replies to server version requests + "uptime"; -- Report how long server has been running + "time"; -- Let others know the time here on this server + "ping"; -- Replies to XMPP pings with pongs + "register"; -- Allow users to register on this server using a client and change passwords + "mam"; -- Store messages in an archive and allow users to access it + "csi_simple"; -- Simple Mobile optimizations + -- Admin interfaces + "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands + --"admin_telnet"; -- Opens telnet console interface on localhost port 5582 + -- HTTP modules + "http"; -- Explicitly enable http server. + "bosh"; -- Enable BOSH clients, aka "Jabber over HTTP" + "websocket"; -- XMPP over WebSockets + "http_files"; -- Serve static files from a directory over HTTP + -- Other specific functionality + "groups"; -- Shared roster support + "server_contact_info"; -- Publish contact information for this service + "announce"; -- Send announcement to all online users + "welcome"; -- Welcome users who register accounts + "watchregistrations"; -- Alert admins of registrations + "motd"; -- Send a message to users when they log in + --"legacyauth"; -- Legacy authentication. Only used by some old clients and bots. + --"s2s_bidi"; -- not yet implemented, have to wait for v0.12 + "bookmarks"; + "checkcerts"; + "cloud_notify"; + "csi_battery_saver"; + "default_bookmarks"; + "http_avatar"; + "idlecompat"; + "presence_cache"; + "smacks"; + "strict_https"; + --"pep_vcard_avatar"; -- not compatible with this version of pep, wait for v0.12 + "watchuntrusted"; + "webpresence"; + "external_services"; + } + +-- only if you want to disable some modules +modules_disabled = { + -- "offline"; -- Store offline messages + -- "c2s"; -- Handle client connections + -- "s2s"; -- Handle server-to-server connections + -- "posix"; -- POSIX functionality, sends server to background, enables syslog, etc. +} + +external_services = { + { + type = "stun", + transport = "udp", + host = "proxy.your.domain", + port = 3478 + }, { + type = "turn", + transport = "udp", + host = "proxy.your.domain", + port = 3478, + -- you could decide this now or come back later when you install coturn + secret = "YOUR SUPER SECRET TURN PASSWORD" + } +} + +--- general global configuration +http_ports = { 5280 } +http_interfaces = { "*", "::" } + +https_ports = { 5281 } +https_interfaces = { "*", "::" } + +proxy65_ports = { 5000 } +proxy65_interfaces = { "*", "::" } + +http_default_host = "xmpp.your.domain" +http_external_url = "https://xmpp.your.domain/" +-- or if you want to have it somewhere else, change this +https_certificate = "/etc/prosody/certs/xmpp.your.domain.crt" + +hsts_header = "max-age=31556952" + +cross_domain_bosh = true +--consider_bosh_secure = true +cross_domain_websocket = true +--consider_websocket_secure = true + +trusted_proxies = { "127.0.0.1", "::1", "192.169.1.1" } + +pep_max_items = 10000 + +-- this is disabled by default, and I keep it like this, depends on you +--allow_registration = true + +-- you might want this options as they are +c2s_require_encryption = true +s2s_require_encryption = true +s2s_secure_auth = false +--s2s_insecure_domains = { "insecure.example" } +--s2s_secure_domains = { "jabber.org" } + +-- where the certificates are stored (/etc/prosody/certs by default) +certificates = "certs" +checkcerts_notify = 7 -- ( in days ) + +-- rate limits on connections to the server, these are my personal settings, because by default they were limited to something like 30kb/s +limits = { + c2s = { + rate = "2000kb/s"; + }; + s2sin = { + rate = "5000kb/s"; + }; + s2sout = { + rate = "5000kb/s"; + }; +} + +-- again, this could be yourself, it is a jid +unlimited_jids = { "admin@your.domain" } + +authentication = "internal_hashed" + +-- if you don't want to use sql, change it to internal and comment the second line +-- since this is optional, i won't describe how to setup mysql or setup the user/database, that would be out of the scope for this entry +storage = "sql" +sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "PROSODY USER SECRET PASSWORD", host = "localhost" } + +archive_expires_after = "4w" -- configure message archive +max_archive_query_results = 20; +mam_smart_enable = true +default_archive_policy = "roster" -- archive only messages from users who are in your roster + +-- normally you would like at least one log file of certain level, but I keep all of them, the default is only the info = "*syslog" one +log = { + info = "*syslog"; + warn = "prosody.warn"; + error = "prosody.err"; + debug = "prosody.debug"; + -- "*console"; -- Needs daemonize=false +} + +-- cloud_notify +push_notification_with_body = false -- Whether or not to send the message body to remote pubsub node +push_notification_with_sender = false -- Whether or not to send the message sender to remote pubsub node +push_max_errors = 5 -- persistent push errors are tolerated before notifications for the identifier in question are disabled +push_max_devices = 5 -- number of allowed devices per user + +-- by default every user on this server will join these muc rooms +default_bookmarks = { + { jid = "room@muc.your.domain", name = "The Room" }; + { jid = "support@muc.your.domain", name = "Support Room" }; +} + +-- could be your jid +untrusted_fail_watchers = { "admin@your.domain" } +untrusted_fail_notification = "Establishing a secure connection from $from_host to $to_host failed. Certificate hash: $sha1. $errors" + +----------- Virtual hosts ----------- +VirtualHost "your.domain" + name = "Prosody" + http_host = "xmpp.your.domain" + +disco_items = { + { "your.domain", "Prosody" }; + { "muc.your.domain", "MUC Service" }; + { "pubsub.your.domain", "Pubsub Service" }; + { "proxy.your.domain", "SOCKS5 Bytestreams Service" }; + { "vjud.your.domain", "User Directory" }; +} + + +-- Multi-user chat +Component "muc.your.domain" "muc" + name = "MUC Service" + modules_enabled = { + --"bob"; -- not compatible with this version of Prosody + "muc_limits"; + "muc_mam"; -- message archive in muc, again, a placeholder + "muc_mam_hints"; + "muc_mention_notifications"; + "vcard_muc"; + } + + restrict_room_creation = false + + muc_log_by_default = true + muc_log_presences = false + log_all_rooms = false + muc_log_expires_after = "1w" + muc_log_cleanup_interval = 4 * 60 * 60 + + +-- Upload +Component "xmpp.your.domain" "http_upload" + name = "Upload Service" + http_host= "xmpp.your.domain" + -- you might want to change this, these are numbers in bytes, so 10MB and 100MB respectively + http_upload_file_size_limit = 1024*1024*10 + http_upload_quota = 1024*1024*100 + + +-- Pubsub +Component "pubsub.your.domain" "pubsub" + name = "Pubsub Service" + pubsub_max_items = 10000 + modules_enabled = { + "pubsub_feeds"; + "pubsub_text_interface"; + } + + -- personally i don't have any feeds configured + feeds = { + -- The part before = is used as PubSub node + --planet_jabber = "http://planet.jabber.org/atom.xml"; + --prosody_blog = "http://blog.prosody.im/feed/atom.xml"; + } + + +-- Proxy +Component "proxy.your.domain" "proxy65" + name = "SOCKS5 Bytestreams Service" + proxy65_address = "proxy.your.domain" + + +-- Vjud, user directory +Component "vjud.your.domain" "vjud" + name = "User Directory" + vjud_mode = "opt-in" + +You HAVE to read all of the configuration file, because there are a lot of things that you need to change to make it work with your server/domain. Test the configuration file with: +luac5.2 -p /etc/prosody/prosody.cfg.lua + +Notice that by default prosody will look up certificates that look like sub.your.domain, but if you get the certificates as myself, you’ll have a single certificate for all subdomains, and by default it is in /etc/letsencrypt/live, which has some strict permissions. So, to import them you can run: +prosodyctl --root cert import /etc/letsencrypt/live + +Ignore the complaining about not finding the subdomain certificates and note that you will have to run that command on each certificate renewal, to automate this, add the --deploy-hook flag to your automated Certbot renewal system; for me it’s a systemd timer with the following certbot.service: +[Unit] +Description=Let's Encrypt renewal + +[Service] +Type=oneshot +ExecStart=/usr/bin/certbot renew --quiet --agree-tos --deploy-hook "systemctl reload nginx.service && prosodyctl --root cert import /etc/letsencrypt/live" + +And if you don’t have it already, the certbot.timer: +[Unit] +Description=Twice daily renewal of Let's Encrypt's certificates + +[Timer] +OnCalendar=0/12:00:00 +RandomizedDelaySec=1h +Persistent=true + +[Install] +WantedBy=timers.target + +Also, go to the certs directory and make the appropriate symbolic links: +cd /etc/prosody/certs +ln -s your.domain.crt SUBDOMAIN.your.domain.crt +ln -s your.domain.key SUBDOMAIN.your.domain.key +... + +That’s basically all the configuration that needs Prosody itself, but we still have to configure Nginx and Coturn before starting/enabling the prosody service. +Nginx configuration file +Since this is not an ordinary configuration file I’m going to describe this too. Your prosody.conf file should have the following location blocks under the main server block (the one that listens to HTTPS): +# HTTPS server block +server { + root /var/www/prosody/; + server_name xmpp.luevano.xyz muc.luevano.xyz pubsub.luevano.xyz vjud.luevano.xyz proxy.luevano.xyz; + index index.html; + + # for extra https discovery (XEP-0256) + location /.well-known/acme-challenge { + allow all; + } + + # bosh specific + location /http-bind { + proxy_pass https://localhost:5281/http-bind; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_buffering off; + tcp_nodelay on; + } + + # websocket specific + location /xmpp-websocket { + proxy_pass https://localhost:5281/xmpp-websocket; + + proxy_http_version 1.1; + proxy_set_header Connection "Upgrade"; + proxy_set_header Upgrade $http_upgrade; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 900s; + } + + # general proxy + location / { + proxy_pass https://localhost:5281; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + ... + # Certbot stuff +} +# HTTP server block (the one that certbot creates) +server { + ... +} + +Also, you need to add the following to your actual your.domain (this cannot be a subdomain) configuration file: +server { + ... + location /.well-known/host-meta { + default_type 'application/xrd+xml'; + add_header Access-Control-Allow-Origin '*' always; + } + + location /.well-known/host-meta.json { + default_type 'application/jrd+json'; + add_header Access-Control-Allow-Origin '*' always; + } + ... +} + +And you will need the following host-meta and host-meta.json files inside the .well-known/acme-challenge directory for your.domain (following my nomenclature: /var/www/yourdomaindir/.well-known/acme-challenge/). +For host-meta file: +<?xml version='1.0' encoding='utf-8'?> +<XRD xmlns='http://docs.oasis-open.org/ns/xri/xrd-1.0'> + <Link rel="urn:xmpp:alt-connections:xbosh" + href="https://xmpp.your.domain:5281/http-bind" /> + <Link rel="urn:xmpp:alt-connections:websocket" + href="wss://xmpp.your.domain:5281/xmpp-websocket" /> +</XRD> + +And host-meta.json file: +{ + "links": [ + { + "rel": "urn:xmpp:alt-connections:xbosh", + "href": "https://xmpp.your.domain:5281/http-bind" + }, + { + "rel": "urn:xmpp:alt-connections:websocket", + "href": "wss://xmpp.your.domain:5281/xmpp-websocket" + } + ] +} + +Remember to have your prosody.conf file symlinked (or discoverable by Nginx) to the sites-enabled directory. You can now restart your nginx service (and test the configuration, optionally): +nginx -t +systemctl restart nginx.service + +Coturn +Coturn is the implementation of TURN and STUN server, which in general is for (at least in the XMPP world) voice support and external service discovery. +Install the coturn package: +pacman -S coturn + +You can modify the configuration file (located at /etc/turnserver/turnserver.conf) as desired, but at least you need to make the following changes (uncomment or edit): +use-auth-secret +realm=proxy.your.domain +static-auth-secret=YOUR SUPER SECRET TURN PASSWORD + +I’m sure there is more configuration to be made, like using SQL to store data and whatnot, but for now this is enough for me. Note that you may not have some functionality that’s needed to create dynamic users to use the TURN server, and to be honest I haven’t tested this since I don’t use this feature in my XMPP clients, but if it doesn’t work, or you know of an error or missing configuration don’t hesitate to contact me. +Start/enable the turnserver service: +systemctl start turnserver.service +systemctl enable turnserver.service + +You can test if your TURN server works at Trickle ICE. You may need to add a user in the turnserver.conf to test this. +Wrapping up +At this point you should have a working XMPP server, start/enable the prosody service now: +systemctl start prosody.service +systemctl enable prosody.service + +And you can add your first user with the prosodyctl command (it will prompt you to add a password): +prosodyctl adduser user@your.domain + +You may want to add a compliance user, so you can check if your server is set up correctly. To do so, go to XMPP Compliance Tester and enter the compliance user credentials. It should have similar compliance score to mine: + +Additionally, you can test the security of your server in IM Observatory, here you only need to specify your domain.name (not xmpp.domain.name, if you set up the SRV DNS records correctly). Again, it should have a similar score to mine: + +You can now log in into your XMPP client of choice, if it asks for the server it should be xmpp.your.domain (or your.domain for some clients) and your login credentials you@your.domain and the password you chose (which you can change in most clients). +That’s it, send me a message david@luevano.xyz if you were able to set up the server successfully. ]]> + Al fin ya me acomodé la página pa' los dibujos https://blog.luevano.xyz/a/acomodada_la_pagina_de_arte.html @@ -316,7 +823,7 @@ cp /usr/share/doc/dovecot/example-config/dovecot.conf /etc/dovecot/dovecot.conf cp -r /usr/share/doc/dovecot/example-config/conf.d /etc/dovecot

ssl = required ssl_cert = <{yourcertdir}/fullchain.pem ssl_key = <{yourcertdir}/privkey.pem diff --git a/blog/dst/sitemap.xml b/blog/dst/sitemap.xml index 40b3af4..13213e7 100644 --- a/blog/dst/sitemap.xml +++ b/blog/dst/sitemap.xml @@ -2,6 +2,12 @@ + + https://blog.luevano.xyz/a/xmpp_server_with_prosody.html + 2021-06-09 + weekly + 1.0 + https://blog.luevano.xyz/a/acomodada_la_pagina_de_arte.html 2021-06-06 @@ -53,43 +59,43 @@ https://blog.luevano.xyz/tag/@english.html - 2021-06-08 + 2021-06-09 daily 0.5 https://blog.luevano.xyz/tag/@server.html - 2021-06-08 + 2021-06-09 daily 0.5 https://blog.luevano.xyz/tag/@short.html - 2021-06-08 + 2021-06-09 daily 0.5 https://blog.luevano.xyz/tag/@spanish.html - 2021-06-08 + 2021-06-09 daily 0.5 https://blog.luevano.xyz/tag/@tools.html - 2021-06-08 + 2021-06-09 daily 0.5 https://blog.luevano.xyz/tag/@tutorial.html - 2021-06-08 + 2021-06-09 daily 0.5 https://blog.luevano.xyz/tag/@update.html - 2021-06-08 + 2021-06-09 daily 0.5 diff --git a/blog/dst/tag/@english.html b/blog/dst/tag/@english.html index 5cfce87..121609a 100644 --- a/blog/dst/tag/@english.html +++ b/blog/dst/tag/@english.html @@ -80,7 +80,9 @@ Articles - May 2021 + June 2021 + Jun 09 - Create an XMPP server with Prosody compatible with Conversations and Movim + May 2021 May 28 - I'm using a new blogging system March 2021 Mar 21 - Create a git server and setup cgit web app (on Nginx) diff --git a/blog/dst/tag/@server.html b/blog/dst/tag/@server.html index 623706c..18fbf43 100644 --- a/blog/dst/tag/@server.html +++ b/blog/dst/tag/@server.html @@ -80,7 +80,9 @@ Articles - March 2021 + June 2021 + Jun 09 - Create an XMPP server with Prosody compatible with Conversations and Movim + March 2021 Mar 21 - Create a git server and setup cgit web app (on Nginx) Mar 21 - Create a mail server with Postfix, Dovecot, SpamAssassin and OpenDKIM Mar 19 - Create a website with Nginx and Certbot diff --git a/blog/dst/tag/@tools.html b/blog/dst/tag/@tools.html index e8236ac..c1daced 100644 --- a/blog/dst/tag/@tools.html +++ b/blog/dst/tag/@tools.html @@ -80,7 +80,9 @@ Articles - May 2021 + June 2021 + Jun 09 - Create an XMPP server with Prosody compatible with Conversations and Movim + May 2021 May 28 - I'm using a new blogging system March 2021 Mar 21 - Create a git server and setup cgit web app (on Nginx) diff --git a/blog/dst/tag/@tutorial.html b/blog/dst/tag/@tutorial.html index d086475..f979ad2 100644 --- a/blog/dst/tag/@tutorial.html +++ b/blog/dst/tag/@tutorial.html @@ -80,7 +80,9 @@ Articles - March 2021 + June 2021 + Jun 09 - Create an XMPP server with Prosody compatible with Conversations and Movim + March 2021 Mar 21 - Create a git server and setup cgit web app (on Nginx) Mar 21 - Create a mail server with Postfix, Dovecot, SpamAssassin and OpenDKIM Mar 19 - Create a website with Nginx and Certbot diff --git a/blog/plt/page.html b/blog/plt/page.html index dbb2734..1b0afd9 100644 --- a/blog/plt/page.html +++ b/blog/plt/page.html @@ -16,6 +16,9 @@ {{page.content}} + {%import "page_nav.html" as page_nav%} + {{page_nav.print(page, config)}} + By {{page.author}} diff --git a/blog/plt/page_nav.html b/blog/plt/page_nav.html new file mode 100644 index 0000000..b15b9eb --- /dev/null +++ b/blog/plt/page_nav.html @@ -0,0 +1,28 @@ +{%macro print(page, config)%} + + {%if page.next is not none%} + + + + Next + + + {%endif%} + + + + + Index + + + + {%if page.previous is not none%} + + + + Previous + + + {%endif%} + +{%endmacro%} diff --git a/blog/src/.files b/blog/src/.files index cc15f1c..979a2f6 100644 --- a/blog/src/.files +++ b/blog/src/.files @@ -1,11 +1,12 @@ -a/website_with_nginx.md 1616122695.085315 1623132678.0349047 english,server,tools,tutorial -a/git_server_with_cgit.md 1616353229.8983006 1623135227.874393 english,server,tools,tutorial +a/website_with_nginx.md 1616122695.085315 1623137232.645304 english,server,tools,tutorial +a/git_server_with_cgit.md 1616353229.8983006 1623137257.0257351 english,server,tools,tutorial a/el_blog_ya_tiene_timestamps.md 1615862784.9032707 1621284818.4731243 short,spanish,tools,update a/shell_scripting_video_notes.md 1615701454.6499224 1622793622.0414143 english,notes a/sql_video_notes.md 1614695711.6048582 1622950879.0081563 english,notes a/first_blog_post.md 1614431313.2090824 1621284833.6700118 english,short,tools,update a/linux_video_notes.md 1615701443.6397786 1622793573.704325 english,notes -a/mail_server_with_postfix.md 1616299559.6570284 1623133655.6586692 english,server,tools,tutorial +a/mail_server_with_postfix.md 1616299559.6570284 1623137344.8639452 english,server,tools,tutorial a/new_blogging_system.md 1622172099.117893 1622173322.4337702 english,short,tools,update a/asi_nomas_esta_quedando.md 1622795043.0874712 0.0 short,spanish,update a/acomodada_la_pagina_de_arte.md 1623006369.6071973 1623006525.2665823 short,spanish,update +a/xmpp_server_with_prosody.md 1623216270.0372887 0.0 english,server,tools,tutorial diff --git a/blog/src/a/git_server_with_cgit.md b/blog/src/a/git_server_with_cgit.md index 9d7ab44..4eb440c 100644 --- a/blog/src/a/git_server_with_cgit.md +++ b/blog/src/a/git_server_with_cgit.md @@ -15,8 +15,8 @@ Note that this is mostly for personal use, so there's no user/authentication con I might get tired of saying this (it's just copy paste, basically)... but you will need the same prerequisites as before (check my [website](https://blog.luevano.xyz/a/website_with_nginx.html) and [mail](https://blog.luevano.xyz/a/mail_server_with_postfix.html) entries), with the extras: -* (Optional, if you want a "front-end") A **CNAME** for "git" and (optionally) "www.git", or some other name for your sub-domains. -* An SSL certificate, if you're following the other entries, add a `git.conf` and run `certbot --nginx` to extend the certificate. +- (Optional, if you want a "front-end") A **CNAME** for "git" and (optionally) "www.git", or some other name for your sub-domains. +- An SSL certificate, if you're following the other entries, add a `git.conf` and run `certbot --nginx` to extend the certificate. ## Git diff --git a/blog/src/a/mail_server_with_postfix.md b/blog/src/a/mail_server_with_postfix.md index e254416..63bf564 100644 --- a/blog/src/a/mail_server_with_postfix.md +++ b/blog/src/a/mail_server_with_postfix.md @@ -169,7 +169,7 @@ cp -r /usr/share/doc/dovecot/example-config/conf.d /etc/dovecot As Luke stated, `dovecot` comes with a lot of "modules" (under `/etc/dovecot/conf.d/` if you copied that folder) for all sorts of configurations that you can include, but I do as he does and just edit/create the whole `dovecot.conf` file; although, I would like to check each of the separate configuration files `dovecot` provides I think the options Luke provides are more than good enough. -I'm working with an empty `dovecot.conf` file. Add the following lines for SSL and login configuration (also replace `{yourcertdir}` with the same certificate directory described in the [Postfix](#postfix) section above, note that the `<` is required): +I'm working with an empty `dovecot.conf` file. Add the following lines for SSL and login configuration (also replace `{yourcertdir}` with the same certificate directory described in the Postfix section above, note that the `<` is required): ```apache ssl = required @@ -500,15 +500,15 @@ Now, to actually use the mail service: first of all, you need a *normal* account Next, to actually login into a mail app/program/whateveryouwanttocallit, you will use the following settings, at least for `thunderdbird`(I tested in windows default mail app and you don't need a lot of settings): -* \* server: subdomain.domain (mail.luevano.xyz in my case) -* **SMTP** port: 587 -* **SMTPS** port: 465 (I use this one) -* **IMAP** port: 143 -* **IMAPS** port: 993 (again, I use this one) -* Connection/security: SSL/TLS -* Authentication method: Normal password -* Username: just your `user`, not the whole email (`david` in my case) -* Password: your `user` password (as in the password you use to login to the server with that user) +- \* server: subdomain.domain (mail.luevano.xyz in my case) +- **SMTP** port: 587 +- **SMTPS** port: 465 (I use this one) +- **IMAP** port: 143 +- **IMAPS** port: 993 (again, I use this one) +- Connection/security: SSL/TLS +- Authentication method: Normal password +- Username: just your `user`, not the whole email (`david` in my case) +- Password: your `user` password (as in the password you use to login to the server with that user) All that's left to do is test your mail server for spoofing, and to see if everything is setup correctly. Go to [DKIM Test](https://www.appmaildev.com/en/dkim) and follow the instructions (basically click next, and send an email with whatever content to the email that they provide). After you send the email, you should see something like: diff --git a/blog/src/a/website_with_nginx.md b/blog/src/a/website_with_nginx.md index 09a7781..7e4624a 100644 --- a/blog/src/a/website_with_nginx.md +++ b/blog/src/a/website_with_nginx.md @@ -97,12 +97,12 @@ That could serve as a template if you intend to add more domains. Note some things: -* `listen`: we're telling Nginx which port to listen to (IPv4 and IPv6, respectively). -* `root`: the root directory of where the website files (`.html`, `.css`, `.js`, etc. files) are located. I followed Luke's directory path `/var/www/some_folder`. -* `server_name`: the actual domain to "listen" to (for my website it is: `server_name luevano.xyz www.luevano.xyz;` and for this blog is: `server_name blog.luevano.xyz www.blog.luevano.xyz;`). -* `index`: what file to serve as the index (could be any `.html`, `.htm`, `.php`, etc. file) when just entering the website. -* `location`: what goes after `domain.name`, used in case of different configurations depending on the URL paths (deny access on `/private`, make a proxy on `/proxy`, etc). - * `try_files`: tells what files to look for. +- `listen`: we're telling Nginx which port to listen to (IPv4 and IPv6, respectively). +- `root`: the root directory of where the website files (`.html`, `.css`, `.js`, etc. files) are located. I followed Luke's directory path `/var/www/some_folder`. +- `server_name`: the actual domain to "listen" to (for my website it is: `server_name luevano.xyz www.luevano.xyz;` and for this blog is: `server_name blog.luevano.xyz www.blog.luevano.xyz;`). +- `index`: what file to serve as the index (could be any `.html`, `.htm`, `.php`, etc. file) when just entering the website. +- `location`: what goes after `domain.name`, used in case of different configurations depending on the URL paths (deny access on `/private`, make a proxy on `/proxy`, etc). + - `try_files`: tells what files to look for. Then, make a symbolic link from this configuration file to the `sites-enabled` directory: diff --git a/blog/src/a/xmpp_server_with_prosody.md b/blog/src/a/xmpp_server_with_prosody.md new file mode 100644 index 0000000..be3d610 --- /dev/null +++ b/blog/src/a/xmpp_server_with_prosody.md @@ -0,0 +1,579 @@ +title: Create an XMPP server with Prosody compatible with Conversations and Movim +author: David Luévano +lang: en +summary: How to create an XMPP server using Prosody on a server running Nginx. This server will be compatible with at least Conversations and Movim. +tags: server + tools + tutorial + english + +Recently I set up an XMPP server (and a Matrix one, too) for my personal use and for friends if they want one; made one for ???[EL ELE EME](https://lmcj.xyz)???, for example. So, here are the notes on how I set up the server that is compatible with the [Conversations](https://conversations.im/) app and the [Movim](https://movim.eu/) social network. You can see my addresses in [contact](https://luevano.xyz/contact.html) and the XMPP compliance/score of the server. + +One of the best resources I found that helped me a lot was [Installing and Configuring Prosody XMPP Server on Debian 9](https://community.hetzner.com/tutorials/prosody-debian9), and of course the [Arch Wiki](https://wiki.archlinux.org/title/Prosody) and the [oficial documentation](https://prosody.im/). + +As with my other entries, this is under a server running Arch Linux, with the Nginx web server and Certbot certificates. And all commands here are executed as root (unless specified otherwise) + +## Prerequisites + +Same as with my other entries ([website](https://luevano.xyz/a/website_with_nginx.html), [mail](https://blog.luevano.xyz/a/mail_server_with_postfix.html) and [git](https://blog.luevano.xyz/a/git_server_with_cgit.html)) plus: + +- **A** and (optionally) **AAA** DNS records for: + - `xmpp`: the actual XMPP server and the file upload service. + - `muc` (or `conference`): for multi-user chats. + - `pubsub`: the publish-subscribe service. + - `proxy`: a proxy in case one of the users needs it. + - `vjud`: user directory. +- (Optionally, but recommended) the following **SRV** DNS records; make sure it is pointing to an **A** or **AAA** record (matching the records from the last point, for example): + - `_xmpp-client._tcp.**your.domain**.` for port `5222` pointing to `xmpp.**your.domain**.` + - `_xmpp-server._tcp.**your.domain**.` for port `5269` pointing to `xmpp.**your.domain**.` + - `_xmpp-server._tcp.muc.**your.domain**.` for port `5269` pointing to `xmpp.**your.domain**.` +* SSL certificates for the previous subdomains; similar that with my other entries just create the appropriate `prosody.conf` (where `server_name` will be all the subdomains defined above) file and run `certbot --nginx`. You can find the example configuration file almost at the end of this entry. +- Email addresses for `admin`, `abuse`, `contact`, `security`, etc. Or use your own email for all of them, doesn't really matter much as long as you define them in the configuration and are valid, I have aliases so those emails are forwarded to me. +- Allow ports 5000, 5222, 5269, 5280 and 5281 for [Prosody](https://prosody.im/doc/ports) and, 3478 and 5349 for [Turnserver](https://webrtc.org/getting-started/turn-server) which are the defaults for `coturn`. + +## Prosody + +[Prosody](https://wiki.archlinux.org/title/Prosody) is an implementation of the XMPP protocol that is flexible and extensible. + +Install the `prosody` package (with optional dependencies) and the `mercurial` package: + +```sh +pacman -S prosody, mercurial, lua52-sec, lua52-dbi, lua52-zlib +``` + +We need mercurial to be able to download and update the extra modules needed to make the server compliant with `conversations.im` and `mov.im`. Go to `/var/lib/prosody`, clone the latest Prosody modules repository and prepare the directories: + +```sh +cd /var/lib/prosody +hg clone https://hg.prosody.im/prosody-modules modules-available +mkdir modules-enabled +``` + +You can see that I follow a similar approach that I used with Nginx and the server configuration, where I have all the modules available in a directory, and make a symlink to another to keep track of what is being used. You can update the repository by running `hg pull --update` while inside the `modules-available` directory (similar to Git). + +Make symbolic links to the following modules: + +``` +ln -s /var/lib/prosody/modules-available/MODULE_NAME /var/lib/prosody/modules-enabled/ +... +``` + +- Modules: + - `mod_bookmarks` + - `mod_cache_c2s_caps` + - `mod_checkcerts` + - `mod_cloud_notify` + - `mod_csi_battery_saver` + - `mod_default_bookmarks` + - `mod_external_services` + - `mod_http_avatar` + - `mod_http_pep_avatar` + - `mod_http_upload` + - `mod_http_upload_external` + - `mod_idlecompat` + - `mod_muc_limits` + - `mod_muc_mam_hints` + - `mod_muc_mention_notifications` + - `mod_presence_cache` + - `mod_pubsub_feeds` + - `mod_pubsub_text_interface` + - `mod_smacks` + - `mod_strict_https` + - `mod_vcard_muc` + - `mod_vjud` + - `mod_watchuntrusted` + +And add other modules if needed, but these work for the apps that I mentioned. You should also change the permissions for these files: + +```sh +chown -R prosody:prosody /var/lib/prosody +``` + +Now, configure the server by editing the `/etc/prosody/prosody.cfg.lua` file. It's a bit tricky to configure, so here is my configuration file (lines starting with `--` are comments). Make sure to change according to your domain, and maybe preferences. Read each line and each comment to know what's going on, It's easier to explain it with comments in the file itself than strip it in a lot of pieces. + +And also, note that the configuration file has a "global" section and a per "virtual server"/"component" section, basically everything above all the VirtualServer/Component sections are global, and bellow each VirtualServer/Component, corresponds to that section. + +``` +-- important for systemd +daemonize = true +pidfile = "/run/prosody/prosody.pid" + +-- or your account, not that this is an xmpp jid, not email +admins = { "admin@your.domain" } + +contact_info = { + abuse = { "mailto:abuse@your.domain", "xmpp:abuse@your.domain" }; + admin = { "mailto:admin@your.domain", "xmpp:admin@your.domain" }; + admin = { "mailto:feedback@your.domain", "xmpp:feedback@your.domain" }; + security = { "mailto:security@your.domain" }; + support = { "mailto:support@your.domain", "xmpp:support@muc.your.domain" }; +} + +-- so prosody look up the plugins we added +plugin_paths = { "/var/lib/prosody/modules-enabled" } + +modules_enabled = { + -- Generally required + "roster"; -- Allow users to have a roster. Recommended ;) + "saslauth"; -- Authentication for clients and servers. Recommended if you want to log in. + "tls"; -- Add support for secure TLS on c2s/s2s connections + "dialback"; -- s2s dialback support + "disco"; -- Service discovery + -- Not essential, but recommended + "carbons"; -- Keep multiple clients in sync + "pep"; -- Enables users to publish their avatar, mood, activity, playing music and more + "private"; -- Private XML storage (for room bookmarks, etc.) + "blocklist"; -- Allow users to block communications with other users + "vcard4"; -- User profiles (stored in PEP) + "vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard + "limits"; -- Enable bandwidth limiting for XMPP connections + -- Nice to have + "version"; -- Replies to server version requests + "uptime"; -- Report how long server has been running + "time"; -- Let others know the time here on this server + "ping"; -- Replies to XMPP pings with pongs + "register"; -- Allow users to register on this server using a client and change passwords + "mam"; -- Store messages in an archive and allow users to access it + "csi_simple"; -- Simple Mobile optimizations + -- Admin interfaces + "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands + --"admin_telnet"; -- Opens telnet console interface on localhost port 5582 + -- HTTP modules + "http"; -- Explicitly enable http server. + "bosh"; -- Enable BOSH clients, aka "Jabber over HTTP" + "websocket"; -- XMPP over WebSockets + "http_files"; -- Serve static files from a directory over HTTP + -- Other specific functionality + "groups"; -- Shared roster support + "server_contact_info"; -- Publish contact information for this service + "announce"; -- Send announcement to all online users + "welcome"; -- Welcome users who register accounts + "watchregistrations"; -- Alert admins of registrations + "motd"; -- Send a message to users when they log in + --"legacyauth"; -- Legacy authentication. Only used by some old clients and bots. + --"s2s_bidi"; -- not yet implemented, have to wait for v0.12 + "bookmarks"; + "checkcerts"; + "cloud_notify"; + "csi_battery_saver"; + "default_bookmarks"; + "http_avatar"; + "idlecompat"; + "presence_cache"; + "smacks"; + "strict_https"; + --"pep_vcard_avatar"; -- not compatible with this version of pep, wait for v0.12 + "watchuntrusted"; + "webpresence"; + "external_services"; + } + +-- only if you want to disable some modules +modules_disabled = { + -- "offline"; -- Store offline messages + -- "c2s"; -- Handle client connections + -- "s2s"; -- Handle server-to-server connections + -- "posix"; -- POSIX functionality, sends server to background, enables syslog, etc. +} + +external_services = { + { + type = "stun", + transport = "udp", + host = "proxy.your.domain", + port = 3478 + }, { + type = "turn", + transport = "udp", + host = "proxy.your.domain", + port = 3478, + -- you could decide this now or come back later when you install coturn + secret = "YOUR SUPER SECRET TURN PASSWORD" + } +} + +--- general global configuration +http_ports = { 5280 } +http_interfaces = { "*", "::" } + +https_ports = { 5281 } +https_interfaces = { "*", "::" } + +proxy65_ports = { 5000 } +proxy65_interfaces = { "*", "::" } + +http_default_host = "xmpp.your.domain" +http_external_url = "https://xmpp.your.domain/" +-- or if you want to have it somewhere else, change this +https_certificate = "/etc/prosody/certs/xmpp.your.domain.crt" + +hsts_header = "max-age=31556952" + +cross_domain_bosh = true +--consider_bosh_secure = true +cross_domain_websocket = true +--consider_websocket_secure = true + +trusted_proxies = { "127.0.0.1", "::1", "192.169.1.1" } + +pep_max_items = 10000 + +-- this is disabled by default, and I keep it like this, depends on you +--allow_registration = true + +-- you might want this options as they are +c2s_require_encryption = true +s2s_require_encryption = true +s2s_secure_auth = false +--s2s_insecure_domains = { "insecure.example" } +--s2s_secure_domains = { "jabber.org" } + +-- where the certificates are stored (/etc/prosody/certs by default) +certificates = "certs" +checkcerts_notify = 7 -- ( in days ) + +-- rate limits on connections to the server, these are my personal settings, because by default they were limited to something like 30kb/s +limits = { + c2s = { + rate = "2000kb/s"; + }; + s2sin = { + rate = "5000kb/s"; + }; + s2sout = { + rate = "5000kb/s"; + }; +} + +-- again, this could be yourself, it is a jid +unlimited_jids = { "admin@your.domain" } + +authentication = "internal_hashed" + +-- if you don't want to use sql, change it to internal and comment the second line +-- since this is optional, i won't describe how to setup mysql or setup the user/database, that would be out of the scope for this entry +storage = "sql" +sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "PROSODY USER SECRET PASSWORD", host = "localhost" } + +archive_expires_after = "4w" -- configure message archive +max_archive_query_results = 20; +mam_smart_enable = true +default_archive_policy = "roster" -- archive only messages from users who are in your roster + +-- normally you would like at least one log file of certain level, but I keep all of them, the default is only the info = "*syslog" one +log = { + info = "*syslog"; + warn = "prosody.warn"; + error = "prosody.err"; + debug = "prosody.debug"; + -- "*console"; -- Needs daemonize=false +} + +-- cloud_notify +push_notification_with_body = false -- Whether or not to send the message body to remote pubsub node +push_notification_with_sender = false -- Whether or not to send the message sender to remote pubsub node +push_max_errors = 5 -- persistent push errors are tolerated before notifications for the identifier in question are disabled +push_max_devices = 5 -- number of allowed devices per user + +-- by default every user on this server will join these muc rooms +default_bookmarks = { + { jid = "room@muc.your.domain", name = "The Room" }; + { jid = "support@muc.your.domain", name = "Support Room" }; +} + +-- could be your jid +untrusted_fail_watchers = { "admin@your.domain" } +untrusted_fail_notification = "Establishing a secure connection from $from_host to $to_host failed. Certificate hash: $sha1. $errors" + +----------- Virtual hosts ----------- +VirtualHost "your.domain" + name = "Prosody" + http_host = "xmpp.your.domain" + +disco_items = { + { "your.domain", "Prosody" }; + { "muc.your.domain", "MUC Service" }; + { "pubsub.your.domain", "Pubsub Service" }; + { "proxy.your.domain", "SOCKS5 Bytestreams Service" }; + { "vjud.your.domain", "User Directory" }; +} + + +-- Multi-user chat +Component "muc.your.domain" "muc" + name = "MUC Service" + modules_enabled = { + --"bob"; -- not compatible with this version of Prosody + "muc_limits"; + "muc_mam"; -- message archive in muc, again, a placeholder + "muc_mam_hints"; + "muc_mention_notifications"; + "vcard_muc"; + } + + restrict_room_creation = false + + muc_log_by_default = true + muc_log_presences = false + log_all_rooms = false + muc_log_expires_after = "1w" + muc_log_cleanup_interval = 4 * 60 * 60 + + +-- Upload +Component "xmpp.your.domain" "http_upload" + name = "Upload Service" + http_host= "xmpp.your.domain" + -- you might want to change this, these are numbers in bytes, so 10MB and 100MB respectively + http_upload_file_size_limit = 1024*1024*10 + http_upload_quota = 1024*1024*100 + + +-- Pubsub +Component "pubsub.your.domain" "pubsub" + name = "Pubsub Service" + pubsub_max_items = 10000 + modules_enabled = { + "pubsub_feeds"; + "pubsub_text_interface"; + } + + -- personally i don't have any feeds configured + feeds = { + -- The part before = is used as PubSub node + --planet_jabber = "http://planet.jabber.org/atom.xml"; + --prosody_blog = "http://blog.prosody.im/feed/atom.xml"; + } + + +-- Proxy +Component "proxy.your.domain" "proxy65" + name = "SOCKS5 Bytestreams Service" + proxy65_address = "proxy.your.domain" + + +-- Vjud, user directory +Component "vjud.your.domain" "vjud" + name = "User Directory" + vjud_mode = "opt-in" +``` + +You ???HAVE??? to read all of the configuration file, because there are a lot of things that you need to change to make it work with your server/domain. Test the configuration file with: + +```sh +luac5.2 -p /etc/prosody/prosody.cfg.lua +``` + +Notice that by default `prosody` will look up certificates that look like `sub.your.domain`, but if you get the certificates as myself, you'll have a single certificate for all subdomains, and by default it is in `/etc/letsencrypt/live`, which has some strict permissions. So, to import them you can run: + +```sh +prosodyctl --root cert import /etc/letsencrypt/live +``` + +Ignore the complaining about not finding the subdomain certificates and note that you will have to run that command on each certificate renewal, to automate this, add the `--deploy-hook` flag to your automated Certbot renewal system; for me it's a `systemd` timer with the following `certbot.service`: + +```ini +[Unit] +Description=Let's Encrypt renewal + +[Service] +Type=oneshot +ExecStart=/usr/bin/certbot renew --quiet --agree-tos --deploy-hook "systemctl reload nginx.service && prosodyctl --root cert import /etc/letsencrypt/live" +``` + +And if you don't have it already, the `certbot.timer`: + +```ini +[Unit] +Description=Twice daily renewal of Let's Encrypt's certificates + +[Timer] +OnCalendar=0/12:00:00 +RandomizedDelaySec=1h +Persistent=true + +[Install] +WantedBy=timers.target +``` + +Also, go to the `certs` directory and make the appropriate symbolic links: + +```sh +cd /etc/prosody/certs +ln -s your.domain.crt SUBDOMAIN.your.domain.crt +ln -s your.domain.key SUBDOMAIN.your.domain.key +... +``` + +That's basically all the configuration that needs Prosody itself, but we still have to configure Nginx and Coturn before starting/enabling the `prosody` service. + +## Nginx configuration file + +Since this is not an ordinary configuration file I'm going to describe this too. Your `prosody.conf` file should have the following location blocks under the main server block (the one that listens to HTTPS): + +```nginx +# HTTPS server block +server { + root /var/www/prosody/; + server_name xmpp.luevano.xyz muc.luevano.xyz pubsub.luevano.xyz vjud.luevano.xyz proxy.luevano.xyz; + index index.html; + + # for extra https discovery (XEP-0256) + location /.well-known/acme-challenge { + allow all; + } + + # bosh specific + location /http-bind { + proxy_pass https://localhost:5281/http-bind; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_buffering off; + tcp_nodelay on; + } + + # websocket specific + location /xmpp-websocket { + proxy_pass https://localhost:5281/xmpp-websocket; + + proxy_http_version 1.1; + proxy_set_header Connection "Upgrade"; + proxy_set_header Upgrade $http_upgrade; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 900s; + } + + # general proxy + location / { + proxy_pass https://localhost:5281; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + ... + # Certbot stuff +} +# HTTP server block (the one that certbot creates) +server { + ... +} +``` + +Also, you need to add the following to your actual `your.domain` (this cannot be a subdomain) configuration file: + +```nginx +server { + ... + location /.well-known/host-meta { + default_type 'application/xrd+xml'; + add_header Access-Control-Allow-Origin '*' always; + } + + location /.well-known/host-meta.json { + default_type 'application/jrd+json'; + add_header Access-Control-Allow-Origin '*' always; + } + ... +} +``` + +And you will need the following `host-meta` and `host-meta.json` files inside the `.well-known/acme-challenge` directory for `your.domain` (following my nomenclature: `/var/www/yourdomaindir/.well-known/acme-challenge/`). + +For `host-meta` file: + +```xml + + + + + +``` + +And `host-meta.json` file: + +```json +{ + "links": [ + { + "rel": "urn:xmpp:alt-connections:xbosh", + "href": "https://xmpp.your.domain:5281/http-bind" + }, + { + "rel": "urn:xmpp:alt-connections:websocket", + "href": "wss://xmpp.your.domain:5281/xmpp-websocket" + } + ] +} +``` + +Remember to have your `prosody.conf` file symlinked (or discoverable by Nginx) to the `sites-enabled` directory. You can now restart your `nginx` service (and test the configuration, optionally): + +```sh +nginx -t +systemctl restart nginx.service +``` + +## Coturn + +[Coturn](https://github.com/coturn/coturn) is the implementation of TURN and STUN server, which in general is for (at least in the XMPP world) voice support and external service discovery. + +Install the `coturn` package: + +```sh +pacman -S coturn +``` + +You can modify the configuration file (located at `/etc/turnserver/turnserver.conf`) as desired, but at least you need to make the following changes (uncomment or edit): + +``` +use-auth-secret +realm=proxy.your.domain +static-auth-secret=YOUR SUPER SECRET TURN PASSWORD +``` + +I'm sure there is more configuration to be made, like using SQL to store data and whatnot, but for now this is enough for me. Note that you may not have some functionality that's needed to create dynamic users to use the TURN server, and to be honest I haven't tested this since I don't use this feature in my XMPP clients, but if it doesn't work, or you know of an error or missing configuration don't hesitate to [contact me](https://luevano.xyz/contact.html). + +Start/enable the `turnserver` service: + +```sh +systemctl start turnserver.service +systemctl enable turnserver.service +``` + +You can test if your TURN server works at [Trickle ICE](https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/). You may need to add a user in the `turnserver.conf` to test this. + +## Wrapping up + +At this point you should have a working XMPP server, start/enable the `prosody` service now: + +``` +systemctl start prosody.service +systemctl enable prosody.service +``` + +And you can add your first user with the `prosodyctl` command (it will prompt you to add a password): + +``` +prosodyctl adduser user@your.domain +``` + +You may want to add a `compliance` user, so you can check if your server is set up correctly. To do so, go to [XMPP Compliance Tester](https://compliance.conversations.im/add/) and enter the `compliance` user credentials. It should have similar compliance score to mine: + + + +Additionally, you can test the security of your server in [IM Observatory](https://xmpp.net/index.php), here you only need to specify your `domain.name` (not `xmpp.domain.name`, if you set up the **SRV** DNS records correctly). Again, it should have a similar score to mine: + + + +You can now log in into your XMPP client of choice, if it asks for the server it should be `xmpp.your.domain` (or `your.domain` for some clients) and your login credentials `you@your.domain` and the password you chose (which you can change in most clients). + +That's it, send me a message david@luevano.xyz if you were able to set up the server successfully. diff --git a/blog/xmpp_server_with_prosody.md b/blog/xmpp_server_with_prosody.md deleted file mode 100644 index 60f459b..0000000 --- a/blog/xmpp_server_with_prosody.md +++ /dev/null @@ -1,189 +0,0 @@ -title: Create an XMPP server with Prosody compatible with Conversations and Movim -author: David Luévano -lang: en -summary: How to create an XMPP server using Prosody on a server running Nginx. This server will be compatible with at least Conversations and Movim. -tags: server - tools - tutorial - english - -My git server is all I need to setup to actually *kill* my other server (I've been moving from servers on these last 2-3 blog entries), that's why I'm already doing this entry. I'm basically following [git's guide on setting up a server](https://git-scm.com/book/en/v2/Git-on-the-Server-Setting-Up-the-Server) plus some specific stuff for (btw i use) Arch Linux ([Arch Linux Wiki: Git server](https://wiki.archlinux.org/index.php/Git_server#Web_interfaces) and [Step by step guide on setting up git server in arch linux (pushable)](https://miracoin.wordpress.com/2014/11/25/step-by-step-guide-on-setting-up-git-server-in-arch-linux-pushable/)). - -Note that this is mostly for personal use, so there's no user/authentication control other than that of SSH. Also, most if not all commands here are run as root. - -## Prerequisites - -I might get tired of saying this (it's just copy paste, basically)... but you will need the same prerequisites as before (check my [website](https://blog.luevano.xyz/a/website_with_nginx.html) and [mail](https://blog.luevano.xyz/a/mail_server_with_postfix.html) entries), with the extras: - -* (Optional, if you want a "front-end") A **CNAME** for "git" and (optionally) "www.git", or some other name for your sub-domains. -* An SSL certificate, if you're following the other entries, add a `git.conf` and run `certbot --nginx` to extend the certificate. - -## Git - -[Git](https://wiki.archlinux.org/title/git) is a version control system. - -If not installed already, install the `git` package: - -```sh -pacman -S git -``` - -On Arch Linux, when you install the `git` package, a `git` user is automatically created, so all you have to do is decide where you want to store the repositories, for me, I like them to be on `/home/git` like if `git` was a "normal" user. So, create the `git` folder (with corresponding permissions) under `/home` and set the `git` user's home to `/home/git`: - -```sh -mkdir /home/git -chown git:git /home/git -usermod -d /home/git git -``` - -Also, the `git` user is "expired" by default and will be locked (needs a password), change that with: - -```sh -chage -E -1 git -passwd git -``` - -Give it a strong one and remember to use `PasswordAuthentication no` for `ssh` (as you should). Create the `.ssh/authorized_keys` for the `git` user and set the permissions accordingly: - -```sh -mkdir /home/git/.ssh -chmod 700 /home/git/.ssh -touch /home/git/.ssh/authorized_keys -chmod 600 /home/git/.ssh/authorized_keys -chown -R git:git /home/git -``` - -Now is a good idea to copy over your local SSH public keys to this file, to be able to push/pull to the repositories. Do it by either manually copying it or using `ssh`'s built in `ssh-copy-id` (for that you may want to check your `ssh` configuration in case you don't let people access your server with user/password). - -Next, and almost finally, we need to edit the `git-daemon` service, located at `/usr/lib/systemd/system/` (called `git-daemon@.service`): - -```ini -... -ExecStart=-/usr/lib/git-core/git-daemon --inetd --export-all --base-path=/home/git --enable=receive-pack -... -``` - -I just appended `--enable=receive-pack` and note that I also changed the `--base-path` to reflect where I want to serve my repositories from (has to match what you set when changing `git` user's home). - -Now, go ahead and start and enable the `git-daemon` socket: - -```sh -systemctl start git-daemon.socket -systemctl enable git-daemon.socket -``` - -You're basically done. Now you should be able to push/pull repositories to your server... except, you haven't created any repository in your server, that's right, they're not created automatically when trying to push. To do so, you have to run (while inside `/home/git`): - -```sh -git init --bare {repo_name}.git -chown -R git:git repo_name.git -``` - -Those two lines above will need to be run each time you want to add a new repository to your server (yeah, kinda lame... although there are options to "automate" this, I like it this way). - -After that you can already push/pull to your repository. I have my repositories (locally) set up so I can push to more than one remote at the same time (my server, GitHub, GitLab, etc.); to do so, check [this gist](https://gist.github.com/rvl/c3f156e117e22a25f242). - -## Cgit - -[Cgit](https://wiki.archlinux.org/title/Cgit) is a fast web interface for git. - -This is optionally since it's only for the web application. - -Install the `cgit` and `fcgiwrap` packages: - -```sh -pacman -S cgit fcgiwrap -``` - -Now, just start and enable the `fcgiwrap` socket: - -```sh -systemctl start fcgiwrap.socket -systemctl enable fcgiwrap.socket -``` - -Next, create the `git.conf` as stated in my [nginx setup entry](https://blog.luevano.xyz/a/website_with_nginx.html). Add the following lines to your `git.conf` file: - -```nginx -server { - listen 80; - listen [::]:80; - root /usr/share/webapps/cgit; - server_name {yoursubdomain}.{yourdomain}; - try_files $uri @cgit; - - location @cgit { - include fastcgi_params; - fastcgi_param SCRIPT_FILENAME $document_root/cgit.cgi; - fastcgi_param PATH_INFO $uri; - fastcgi_param QUERY_STRING $args; - fastcgi_param HTTP_HOST $server_name; - fastcgi_pass unix:/run/fcgiwrap.sock; - } -} -``` - -Where the `server_name` line depends on you, I have mine setup to `git.luevano.xyz` and `www.git.luevano.xyz`. Optionally run `certbot --nginx` to get a certificate for those domains if you don't have already. - -Now, all that's left is to configure `cgit`. Create the configuration file `/etc/cgitrc` with the following content (my personal options, pretty much the default): - -```apache -css=/cgit.css -logo=/cgit.png - -enable-http-clone=1 -# robots=noindex, nofollow -virtual-root=/ - -repo.url={url} -repo.path={dir_path} -repo.owner={owner} -repo.desc={short_description} - -... -``` - -Where you can uncomment the `robots` line to let web crawlers (like Google's) to index your `git` web app. And at the end keep all your repositories (the ones you want to make public), for example for my [*dotfiles*](https://git.luevano.xyz/.dots) I have: - -```apache -... -repo.url=.dots -repo.path=/home/git/.dots.git -repo.owner=luevano -repo.desc=These are my personal dotfiles. -... -``` - -Otherwise you could let `cgit` to automatically detect your repositories (you have to be careful if you want to keep "private" repos) using the option `scan-path` and setup `.git/description` for each repository. For more, you can check [cgitrc(5)](https://man.archlinux.org/man/cgitrc.5). - -By default you can't see the files on the site, you need a highlighter to render the files, I use `highlight`. Install the `highlight` package: - -```sh -pacman -S highlight -``` - -Copy the `syntax-highlighting.sh` script to the corresponding location (basically adding `-edited` to the file): - -```sh -cp /usr/lib/cgit/filters/syntax-highlighting.sh /usr/lib/cgit/filters/syntax-highlighting-edited.sh -``` - -And edit it to use the version 3 and add `--inline-css` for more options without editing `cgit`'s CSS file: - -```sh -... -# This is for version 2 -# exec highlight --force -f -I -X -S "$EXTENSION" 2>/dev/null - -# This is for version 3 -exec highlight --force --inline-css -f -I -O xhtml -S "$EXTENSION" 2>/dev/null -... -``` - -Finally, enable the filter in `/etc/cgitrc` configuration: - -```apache -source-filter=/usr/lib/cgit/filters/syntax-highlighting-edited.sh -``` - -That would be everything. If you need support for more stuff like compressed snapshots or support for markdown, check the optional dependencies for `cgit`. diff --git a/gb/index.html b/gb/index.html index c0f3f67..8df243f 100644 --- a/gb/index.html +++ b/gb/index.html @@ -1,20 +1,79 @@ - - - - - Gameboy + + + + + + Gameboy -- Luévano's Site + + + + - - + + + + - - - + + + + - - [HOME] - + + + + + + + + + + + + + + + + + + + + + Home + + + + Blog + + + + Art + + + Git + + + + + + + + + + Stuff + + Gameboy + + + + + + + + + @@ -25,37 +84,37 @@ - + - + - + - + - + - + - + @@ -68,10 +127,10 @@ - + - + @@ -80,10 +139,27 @@ - - Gameboy emulator written in Go by Aaron Liu AKA HFO4 on GitHub. - Input button images also taken from him. - + + Gameboy emulator written in Go by Aaron Liu AKA HFO4 on GitHub. Also took his images for the buttons. + + + + + + + + Contact + + + + + Donate + - + + + Copyright 2021 David Luévano Alvarado + + + diff --git a/luevano/contact.html b/luevano/contact.html index 067c619..7977412 100644 --- a/luevano/contact.html +++ b/luevano/contact.html @@ -72,7 +72,7 @@ Contact - + You can contact me through: diff --git a/static/css/gb.css b/static/css/gb.css index 54682d0..8152469 100644 --- a/static/css/gb.css +++ b/static/css/gb.css @@ -1,33 +1,26 @@ -body{ +main { text-align: center; - background-color: #e0dbcd; } -div.gameboy{ - padding: 10px; - border-radius: 10px; +div.gameboy { display: inline-block; background-color: #a89f94; + border-radius: 10px; + padding: 1em; + width: clamp(30ch, 100%, 45ch); } -img.screen{ +div.gameboy img.screen { border: 10px solid #2b2b26; border-radius: 10px; - width: 320px; - height: 288px; + width: 100%; } -table{ +div.gameboy table.controls { margin-left: auto; margin-right: auto; } -table.controls{ - max-width: 320px; - height: auto; -} - -.controls input, img{ - height: 35px; - width: auto; +div.gameboy table.controls input{ + width: 100%; } diff --git a/static/css/style.css b/static/css/style.css index 47ec270..915a1f2 100644 --- a/static/css/style.css +++ b/static/css/style.css @@ -13,7 +13,8 @@ h2 { text-align: center; } -body, html { +body, +html { margin: 0; padding: 0; } @@ -36,10 +37,13 @@ body > header { body > footer { grid-area: footer; + padding-top: 0.5em; + padding-bottom: 0.5em; } main { grid-area: main; + padding-top: 0.5em; border-radius: 5px; padding-bottom: 0.5em; } @@ -48,7 +52,9 @@ a{ text-decoration: none; } -body > header, body > footer, main { +body > header, +body > footer, +main { justify-self: center; width: clamp(30ch, calc(100% - 1em), 75ch); padding-left: 0.5em; @@ -59,6 +65,12 @@ main.art { width: clamp(30ch, calc(100% - 1em), 100%); } +main.art p { + margin-left: auto; + margin-right: auto; + width: clamp(30ch, calc(100% - 1em), 75ch); +} + /* article/art elements */ div.article-info, @@ -180,6 +192,9 @@ pre { } code { + padding: 0.1em; + padding-left: 0.4em; + padding-right: 0.4em; overflow-wrap: anywhere; } @@ -208,6 +223,19 @@ code.crypto { /* images */ +figure { + margin: 0; + margin-left: 1em; + margin-right: 1em; +} + +figcaption { + margin-top: 0.5em; + text-align: center; + font-size: smaller; + font-style: italic; +} + img { border-radius: 5px; max-width: 100%; @@ -267,7 +295,6 @@ div.art-grid a { } div.art-grid img { - border: 1px solid white; object-fit: cover; } @@ -293,8 +320,9 @@ a.zoom-in { cursor: zoom-in; } -/* art nav */ -div.art-nav { +/* art nav / for now also page nav */ +div.art-nav, +div.page-nav { width: 100%; display: grid; grid-template-areas: @@ -305,19 +333,23 @@ div.art-nav { justify-items: center; } -div.art-nav > span.index { +div.art-nav > span.index, +div.page-nav > span.index { grid-area: index; } -div.art-nav > span.previous { +div.art-nav > span.previous, +div.page-nav > span.previous { grid-area: prev; } -div.art-nav > span.next { +div.art-nav > span.next, +div.page-nav > span.next { grid-area: next; } -div.art-nav > span { +div.art-nav > span, +div.page-nav > span { border-radius: 5px; min-width: 1em; max-width: 10em; @@ -329,12 +361,14 @@ div.art-nav > span { margin-right: 0.2em; } -div.art-nav > span span { +div.art-nav > span span, +div.page-nav > span span { display: none; } @media screen and (min-width: 600px) { - div.art-nav > span span { + div.art-nav > span span, + div.page-nav > span span { display: inline; } } diff --git a/static/css/theme.css b/static/css/theme.css index 8f900ba..b3bbb18 100644 --- a/static/css/theme.css +++ b/static/css/theme.css @@ -44,6 +44,7 @@ --switch-sun: var(--color13); --code-border: var(--color3); + --art-border: var(--color3); --pagenav-bg: var(--color1); --pagenav-bg-hl: var(--color2); @@ -77,6 +78,7 @@ --switch-sun: var(--color13); --code-border: var(--color4); + --art-border: var(--color4); --pagenav-bg: var(--color10); --pagenav-bg-hl: var(--color9); @@ -188,19 +190,32 @@ button.theme-switcher > .fa-sun { color: var(--switch-sun); } -/* art nav */ -div.art-nav > span { +/* art grid / art gallery */ +div.art-grid img { + border: 1px solid var(--art-border); +} + +div.art-grid img:hover { + border: 5px solid var(--art-border); +} + +/* art nav / for now also page nav */ +div.art-nav > span, +div.page-nav > span { background: var(--pagenav-bg); } -div.art-nav > span > a { +div.art-nav > span > a, +div.page-nav > span > a { color: var(--pagenav-link); } -div.art-nav > span:hover { +div.art-nav > span:hover, +div.page-nav > span:hover { background: var(--pagenav-bg-hl); } -div.art-nav > span:hover > a { +div.art-nav > span:hover > a, +div.page-nav > span:hover > a { color: var(--pagenav-link-hl); } -- cgit v1.2.3-54-g00ecf