Stefan-Sanger
bc5b550d9c
Default to 5 (upstream default) when SMACKS_MAX_UNACKED_STANZAS is unset. Part-of: <http://gitlab.vnc.biz/uxf/vnctalk-prosody/-/merge_requests/3>
344 lines
12 KiB
Plaintext
344 lines
12 KiB
Plaintext
--------------------------------------------------------------------------------
|
|
---- VNCtalk Prosody/XMPP Settings
|
|
--------------------------------------------------------------------------------
|
|
|
|
pidfile = "/var/log/prosody/prosody.pid"; -- Required for init scripts and prosodyctl
|
|
|
|
-- Enable use of libevent for better performance under high load
|
|
-- For more information see: http://prosody.im/doc/libevent
|
|
-- use_libevent = true;
|
|
network_backend = "epoll";
|
|
|
|
|
|
allow_registration = false;
|
|
|
|
network_default_read_size = 8192; -- Increase buffer size to allow jitsi meet and file transfers. Default 4096.
|
|
|
|
-- Stanza size limits (bytes). Override via C2S_STANZA_SIZE_LIMIT /
|
|
-- S2S_STANZA_SIZE_LIMIT env vars. Default 5MB (5242880).
|
|
c2s_stanza_size_limit = ${C2S_STANZA_SIZE_LIMIT}
|
|
s2s_stanza_size_limit = ${S2S_STANZA_SIZE_LIMIT}
|
|
|
|
-- expose the telnet admin console (5582) beyond loopback; an external
|
|
-- service connects to it to run commands
|
|
console_interfaces = { "*" }
|
|
|
|
-- 'http' (5280, BOSH/websocket behind the ingress) is a private service in
|
|
-- 0.12+ and would default to loopback only
|
|
http_interfaces = { "*", "::" }
|
|
|
|
-- production and the compose harness run as root (startup.sh writes certs and
|
|
-- the rendered config into root-owned /etc/prosody); without this, mod_posix
|
|
-- refuses to start and deactivates c2s
|
|
run_as_root = true;
|
|
|
|
admins = {
|
|
"admin@${prosodyDomain}"
|
|
}
|
|
|
|
plugin_paths = {
|
|
"/usr/local/lib/prosody/modules",
|
|
"/usr/lib/prosody/modules",
|
|
}
|
|
|
|
modules_enabled = {
|
|
"roster"; -- Allow users to have a roster. Recommended ;)
|
|
"saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
|
|
"tls"; -- Add support for secure TLS on c2s/s2s connections
|
|
"dialback"; -- s2s dialback support
|
|
"disco"; -- Service discovery
|
|
"private"; -- Private XML storage (for room bookmarks, etc.)
|
|
"vcard"; -- Allow users to set vCards
|
|
"blocklist"; -- Allow users to block communications with other users
|
|
"smacks";
|
|
"carbons";
|
|
"carbons_copies";
|
|
"mam";
|
|
"vnc_lastactivity";
|
|
"offline"; -- Store offline messages
|
|
"version"; -- Replies to server version requests
|
|
"uptime"; -- Report how long server has been running
|
|
"time"; -- Let others know the time here on this server
|
|
"ping"; -- Replies to XMPP pings with pongs
|
|
"pep"; -- Enables users to publish their mood, activity, playing music and more
|
|
"vnc_vcard_avatar"; -- publish avatars
|
|
|
|
"adhoc";
|
|
"admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands
|
|
"admin_telnet"; -- Opens telnet console interface on localhost port 5582
|
|
"bosh"; -- Enable mod_bosh
|
|
"websocket";
|
|
"http_altconnect";
|
|
"idlecompat";
|
|
-- "groups"; -- Shared roster support
|
|
|
|
-- Other specific functionality
|
|
"announce"; -- Send announcement to all online users
|
|
"watchregistrations"; -- Alert admins of registrations
|
|
"motd"; -- Send a message to users when they log in
|
|
"webpresence";
|
|
"http_rest";
|
|
"csi";
|
|
-- "throttle_presence";
|
|
"filter_chatstates";
|
|
-- s2s keepalive with default jitsi
|
|
"s2s_keepalive";
|
|
|
|
-- VNCtalk modules
|
|
"vnc_receipts";
|
|
"vnc_remotemucstore";
|
|
|
|
-- debug
|
|
"log_slow_events";
|
|
}
|
|
|
|
modules_disabled = {
|
|
-- "c2s"; -- Handle client connections
|
|
-- "s2s"; -- Handle server-to-server connections
|
|
|
|
"archive";
|
|
"register"; -- Allow users to register on this server using a client and change passwords
|
|
}
|
|
|
|
-- mod_admin_socket (a dependency of the telnet console since 0.12) defaults its
|
|
-- unix socket into the data directory, which is not writable in this container
|
|
admin_socket = "/var/log/prosody/prosody.sock"
|
|
|
|
--------------------------------------------------------------------------------
|
|
---- Logging configuration
|
|
--------------------------------------------------------------------------------
|
|
|
|
-- The supported levels are: "debug", "info", "warn", "error".
|
|
-- Set PROSODY_DEBUG=true in the environment to enable debug logging.
|
|
log = {
|
|
-- levels = { "info", "warn", "error" }, to = "console" ;
|
|
${PROSODY_LOG_LEVEL} = "/var/log/prosody/prosody.log";
|
|
error = "/var/log/prosody/prosody.err";
|
|
}
|
|
|
|
--------------------------------------------------------------------------------
|
|
---- Components Settings
|
|
--------------------------------------------------------------------------------
|
|
|
|
component_ports = { 5347 }
|
|
component_interface = "0.0.0.0";
|
|
--component_interface = "192.168.0.10"; -- Prosody to listen for component connections on port XXXX, coming only to the IP address 192.168.0.10.
|
|
|
|
--------------------------------------------------------------------------------
|
|
---- BOSH Settings
|
|
--------------------------------------------------------------------------------
|
|
|
|
http_ports = { 5280 }
|
|
bosh_max_inactivity = 60; --Maximum amount of time in seconds a client may remain silent for, with no requests
|
|
-- CORS for BOSH/websocket: replaces the pre-0.12 cross_domain_* options;
|
|
-- origins default to * (any site), matching the previous behaviour
|
|
http_cors_override = {
|
|
bosh = { enabled = true };
|
|
websocket = { enabled = true };
|
|
}
|
|
consider_bosh_secure = true; --Use if proxying HTTPS->HTTP on the server side
|
|
bosh_default_hold = 1; --Maximum number of requests the server will hold open for a client
|
|
bosh_max_requests = 2; --Maximum number of requests a client may make to the server at a time
|
|
-- 2check: internel network in k8s ?
|
|
trusted_proxies = { "127.0.0.1" } --A list of proxies to trust, used to find a client's real IP
|
|
|
|
--------------------------------------------------------------------------------
|
|
---- Websocket Settings
|
|
--------------------------------------------------------------------------------
|
|
|
|
consider_websocket_secure = true; --Use if proxying HTTPS->HTTP on the server side
|
|
|
|
--------------------------------------------------------------------------------
|
|
---- SSL/TLS Settings
|
|
--------------------------------------------------------------------------------
|
|
|
|
ssl = {
|
|
key = "/etc/prosody/certs/prosody-ssl.key";
|
|
certificate = "/etc/prosody/certs/prosody-ssl.pem";
|
|
}
|
|
|
|
c2s_require_encryption = true; -- Force clients to use encrypted connections
|
|
s2s_secure_auth = false; -- Force certificate authentication for server-to-server connections
|
|
|
|
--s2s_secure_domains = { "jabber.org" }
|
|
-- list of domains here that will not be required to authenticate using certificates
|
|
--s2s_insecure_domains = { "gmail.com" }
|
|
|
|
allow_anonymous_s2s = true
|
|
|
|
keepalive_servers = { "${DEFAULT_JITSI_CONFERENCE}" }
|
|
keepalive_interval = 90 -- (in seconds, default is 60 )
|
|
keepalive_timeout = 300 -- (in seconds, default is 593 )
|
|
|
|
--------------------------------------------------------------------------------
|
|
---- Authentication Settings
|
|
--------------------------------------------------------------------------------
|
|
|
|
authentication = "internal_hashed"
|
|
|
|
--------------------------------------------------------------------------------
|
|
---- Storage Settings
|
|
--------------------------------------------------------------------------------
|
|
|
|
default_storage = "sql"
|
|
storage = "sql"
|
|
|
|
sql = {
|
|
driver = "PostgreSQL",
|
|
host = "${prosodyDBhost}",
|
|
database = "${prosodyDBname}",
|
|
username = "${prosodyDBuser}",
|
|
password = "${prosodyDBpass}",
|
|
}
|
|
|
|
-- storage = { archive2 = "sql2" }
|
|
|
|
sql_manage_tables = true; --allow auto create table
|
|
|
|
-- PEP limit
|
|
|
|
pep_max_items = 256
|
|
|
|
--------------------------------------------------------------------------------
|
|
---- MAM XEP-0313 Settings
|
|
--------------------------------------------------------------------------------
|
|
|
|
max_archive_query_results = 20;
|
|
archive_expires_after = "never"
|
|
default_archive_policy = "roster"
|
|
|
|
--------------------------------------------------------------------------------
|
|
---- SMACKS config
|
|
--------------------------------------------------------------------------------
|
|
smacks_hibernation_time = ${SMACKS_HIBERNATION_TIME};
|
|
smacks_enabled_s2s = false;
|
|
smacks_max_unacked_stanzas = ${SMACKS_MAX_UNACKED_STANZAS};
|
|
smacks_max_ack_delay = 60;
|
|
smacks_max_old_sessions = 10;
|
|
--------------------------------------------------------------------------------
|
|
|
|
log_slow_events_threshold = ${log_slow_events_threshold}
|
|
|
|
--------------------------------------------------------------------------------
|
|
---- MOTD config
|
|
--------------------------------------------------------------------------------
|
|
|
|
motd_jid = "admin@${prosodyDomain}"
|
|
-- motd_text = "Currently the XMPP service is under maintence."
|
|
|
|
|
|
----------- Virtual hosts -----------
|
|
|
|
VirtualHost "${prosodyDomain}"
|
|
enabled = true; -- Remove this line to enable this host
|
|
|
|
admins = { "admin@${prosodyDomain}" }
|
|
|
|
authentication = "http_async"
|
|
http_auth_url = "${hybridaAuthUrl}"
|
|
|
|
fcm_api_key = "${fcmApiKey}"
|
|
fcm_api_url = "${fcm_api_url}"
|
|
del_api_url = "${del_api_url}"
|
|
|
|
|
|
modules_enabled = {
|
|
"bosh";
|
|
"ping"; -- Enable mod_ping
|
|
-- "auto_accept_subscriptions";
|
|
"vnc_delfile";
|
|
"vnc_fcm";
|
|
"http_upload_external";
|
|
"alias";
|
|
"vnc_timestamp";
|
|
}
|
|
|
|
modules_disabled = {
|
|
"discoitems"; --manually override the service discovery items for a host
|
|
}
|
|
|
|
http_upload_external_base_url = "${fileShareBaseUrl}"
|
|
http_upload_external_secret = "${fileShareSecret}"
|
|
http_upload_external_file_size_limit = 104857600 -- bytes
|
|
|
|
-- avatar_upload_url = "https://vnctalk.dev.vnc.de/avatarupload/"
|
|
avatar_upload_url = "${avatarUploadUrl}"
|
|
avatar_upload_user = "${avatarUploadUser}"
|
|
avatar_upload_pass = "${avatarUploadPass}"
|
|
|
|
ssl = {
|
|
key = "/etc/prosody/certs/prosody-ssl.key";
|
|
certificate = "/etc/prosody/certs/prosody-ssl.pem";
|
|
}
|
|
|
|
|
|
|
|
disco_items = {
|
|
-- Do not display/publicy any disco item to avoid information leaking due to public reachable chatroom service.
|
|
}
|
|
|
|
VirtualHost "anon.${prosodyDomain}"
|
|
enabled = true;
|
|
authentication = "anonymous"
|
|
modules_enabled = {
|
|
"bosh";
|
|
"ping"; -- Enable mod_ping
|
|
"http_upload_external";
|
|
"websocket";
|
|
}
|
|
|
|
modules_disabled = {
|
|
"discoitems"; --manually override the service discovery items for a host
|
|
}
|
|
|
|
http_upload_external_base_url = "${fileShareBaseUrl}"
|
|
http_upload_external_secret = "${fileShareSecret}"
|
|
http_upload_external_file_size_limit = 104857600 -- bytes
|
|
|
|
ssl = {
|
|
key = "/etc/prosody/certs/prosody-ssl.key";
|
|
certificate = "/etc/prosody/certs/prosody-ssl.pem";
|
|
}
|
|
|
|
|
|
Component "conference.${prosodyDomain}" "muc"
|
|
component_secret = "${componentSecret}"
|
|
modules_enabled = {
|
|
"muc_mam",
|
|
"vnc_muc_automember",
|
|
"vnc_muc_fcm",
|
|
"vnc_remotemucinvite",
|
|
"vnc_delfile",
|
|
"vnc_e2ehints",
|
|
"vnc_muc_hook",
|
|
"vnc_muc_data",
|
|
"vnc_track_kicks",
|
|
"vcard_muc"; -- allow vcards for muc
|
|
}
|
|
storage = {
|
|
-- This makes mod_mam_muc use the sql2 storage backend (others will use internal)
|
|
-- which at the time of this writing is the only one supporting stanza archives
|
|
muc_log = "sql";
|
|
}
|
|
muc_log_by_default = true; -- Enable logging by default (can be disabled in room config)
|
|
muc_log_all_rooms = true; -- set to true to force logging of all rooms
|
|
muc_log_expires_after = "never";
|
|
|
|
-- This is the largest number of messages that are allowed to be retrieved in one MAM request.
|
|
max_archive_query_results = 20;
|
|
|
|
-- This is the largest number of messages that are allowed to be retrieved when joining a room.
|
|
max_history_messages = 1000;
|
|
fcm_api_key = "${fcmApiKey}"
|
|
fcm_api_url = "${fcm_api_url}"
|
|
del_api_url = "${del_api_url}"
|
|
|
|
avatar_upload_url = "${avatarUploadUrl}"
|
|
avatar_upload_user = "${avatarUploadUser}"
|
|
avatar_upload_pass = "${avatarUploadPass}"
|
|
storage_host = "${prosodyDomain}";
|
|
|
|
Component "pubsub.${prosodyDomain}" "pubsub"
|
|
|
|
Component "broadcast@${prosodyDomain}" "vnc_broadcast"
|