kris / ejabberd.yml.movim.example

### ### ejabberd configuration file ### ### The parameters used in this configuration file are explained at ### ### https://docs.ejabberd.im/admin/configuration ### ### The configuration file is written in YAML. ### ******************************************************* ### ******* !!! WARNING !!! ******* ### ******* YAML IS INDENTATION SENSITIVE ******* ### ******* MAKE SURE YOU INDENT SECTIONS CORRECTLY ******* ### ******************************************************* ### Refer to http://en.wikipedia.org/wiki/YAML for the brief description. ### hosts: - example.org - anon.example.org host_config: example.org: auth_method: [ldap] ldap_servers: - 127.0.0.1 ldap_port: 389 ldap_uids: - uid ldap_rootdn: "uid=lldap_readonly,ou=people,dc=example,dc=org" ldap_password: "thisisareadonlysupersecurepassword" ldap_base: "ou=people,dc=example,dc=org" anon.example.org: #Todo: disable http_upload auth_method: [anonymous] disable_sasl_mechanisms: [ "X-OAUTH2", "digest-md5" , "plain" ] anonymous_protocol: sasl_anon append_host_config: example.org: modules: mod_http_upload: put_url: https://uploads.@HOST@/upload docroot: /data/exampleorg/xmpp/ejabberd/user-uploads #max_size: 104857600 # 100 MiB (default) file_mode: "0640" dir_mode: "2750" mod_http_upload_quota: max_days: 365 loglevel: warning # rotation: Disable ejabberd's internal log rotation #log_rotate_count: 0 ca_file: /opt/ejabberd/conf/cacert.pem #certfiles: # - /opt/ejabberd/conf/server.pem ## If you already have certificates, list them here certfiles: - /data/exampleorg/xmpp/ejabberd/certs/*/*.pem acme: auto: false # TLS configuration define_macro: 'TLS_CIPHERS': "HIGH:!aNULL:!eNULL:!3DES:@STRENGTH" 'TLS_OPTIONS': - "no_sslv3" - "no_tlsv1" - "no_tlsv1_1" - "cipher_server_preference" - "no_compression" 'DH_FILE': "/data/exampleorg/xmpp/ejabberd/certs/dhparams.pem" # generated with: openssl dhparam -out dhparams.pem 2048 c2s_ciphers: 'TLS_CIPHERS' s2s_ciphers: 'TLS_CIPHERS' c2s_protocol_options: 'TLS_OPTIONS' s2s_protocol_options: 'TLS_OPTIONS' c2s_dhfile: 'DH_FILE' s2s_dhfile: 'DH_FILE' listen: - port: 5222 ip: "::" module: ejabberd_c2s max_stanza_size: 262144 shaper: c2s_shaper access: c2s starttls_required: true protocol_options: 'TLS_OPTIONS' - port: 5223 ip: "::" tls: true module: ejabberd_c2s max_stanza_size: 262144 shaper: c2s_shaper access: c2s starttls_required: true - port: 5269 ip: "::" module: ejabberd_s2s_in max_stanza_size: 524288 - port: 5280 ip: "::" # ip: "127.0.0.1" protocol_options: 'TLS_OPTIONS' module: ejabberd_http request_handlers: /admin: ejabberd_web_admin /api: mod_http_api /bosh: mod_bosh # /captcha: ejabberd_captcha /upload: mod_http_upload /ws: ejabberd_http_ws # /.well-known/acme-challenge: ejabberd_acme custom_headers: "Access-Control-Allow-Origin": "*" "Access-Control-Allow-Methods": "OPTIONS, HEAD, GET, PUT" "Access-Control-Allow-Headers": "Authorization" "Access-Control-Allow-Credentials": "true" ## STUN/TURN ToDo # - # port: 3478 # ip: "::" # transport: udp # module: ejabberd_stun # use_turn: true ## The server's public IPv4 address: # turn_ipv4_address: "203.0.113.3" ## The server's public IPv6 address: # turn_ipv6_address: "2001:db8::3" # - # port: 5349 # transport: tcp # module: ejabberd_stun # use_turn: true # tls: true # turn_min_port: 49152 # turn_max_port: 65535 # turn_ipv4_address: !!!!IP INTERFACE ADDRESS # - # port: 1883 # ip: "::" # module: mod_mqtt # backlog: 1000 ## Matrix gateway ## ToDo: change port to avoid conflict with nginx/synapse and reverse-proxy it # - # port: 8448 # module: ejabberd_http # tls: false # request_handlers: # "/_matrix": mod_matrix_gw ## XMPP Components - port: 5347 ip: "127.0.0.1" module: ejabberd_service global_routes: false hosts: # biboumi IRC gateways irc.example.org: password: "supersecretpasswordhere" ## Disabling digest-md5 SASL authentication. digest-md5 requires plain-text ## password storage (see auth_password_format option). disable_sasl_mechanisms: - "digest-md5" ## Disable SASL SCRAM Downgrade Protection (XEP-0474) ## Todo: remove once Movim supports XEP-0474 disable_sasl_scram_downgrade_protection: true s2s_use_starttls: required trusted_proxies: - "127.0.0.1" - "192.168.1.1" ## Postgresql database config sql_type: pgsql sql_database: 'ejabberd' sql_username: 'ejabberd' #sql_server: localhost # Postgres container systemd-ejabberd-psql sql_port: 5432 sql_password: 'anothersupersecretpasswordhere' sql_prepared_statements: false #sql_pool_size: 2 #default 10 new_sql_schema: true update_sql_schema: true # Use SQL as the default persistent database default_db: sql acl: admin: user: - "admin@example.org" local: user_regexp: "" loopback: ip: - 127.0.0.0/8 - ::1/128 access_rules: local: allow: local c2s: deny: blocked allow: all announce: allow: admin configure: allow: admin muc_create: allow: local pubsub_createnode: allow: local trusted_network: allow: loopback api_permissions: "console commands": from: - ejabberd_ctl who: all what: "*" "admin access": who: access: allow: - acl: loopback - acl: admin oauth: scope: "ejabberd:admin" access: allow: - acl: loopback - acl: admin what: - "*" - "!stop" - "!start" "public commands": who: ip: 127.0.0.1/8 what: - status - connected_users_number shaper: normal: rate: 3000 burst_size: 20000 fast: 100000 shaper_rules: max_user_sessions: 10 max_user_offline_messages: 5000: admin 100: all c2s_shaper: none: admin normal: all s2s_shaper: fast soft_upload_quota: 250: all # MiB hard_upload_quota: 300: all # MiB modules: mod_adhoc: {} mod_admin_extra: {} mod_announce: access: announce mod_avatar: {} mod_blocking: {} mod_bosh: {} mod_caps: {} mod_carboncopy: {} mod_client_state: {} mod_configure: {} mod_disco: server_info: - modules: all name: "admin-addresses" urls: - "xmpp:admin@example.org" - modules: all name: "security-addresses" urls: - "xmpp:support@chat.example.org?join" - modules: all name: "abuse-addresses" urls: - "xmpp:support@chat.example.org?join" - modules: all name: "feedback-addresses" urls: - "xmpp:support@chat.example.org?join" - modules: all name: "support-addresses" urls: - "mailto:info@example.org" # mod_fail2ban: {} mod_host_meta: bosh_service_url: "https://chat.@HOST@/bosh" websocket_url: "wss://chat.@HOST@/ws" mod_http_api: {} # mod_http_upload: # put_url: https://uploads.@HOST@/upload # docroot: /data/exampleorg/xmpp/user-uploads # #max_size: 104857600 # 100 MiB (default) # file_mode: "0640" # dir_mode: "2750" # #custom_headers: # # "Access-Control-Allow-Origin": "https://@HOST@" # # "Access-Control-Allow-Origin": "*" # # "Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS" # # "Access-Control-Allow-Headers": "Content-Type" # # "Access-Control-Allow-Headers": "Authorization" # # "Access-Control-Allow-Credentials": "true" # #thumbnail: false # otherwise needs the identify command from ImageMagick installed # mod_http_upload_quota: # max_days: 365 mod_last: {} mod_mam: db_type: sql assume_mam_usage: true default: always user_mucsub_from_muc_archive: true compress_xml: true # mod_matrix_gw: # host: "matrix.@HOST@" # matrix_domain: "@HOST@" # key_name: "somename" # key: "yourkeyinbase64" # matrix_id_as_jid: false # mod_mqtt: {} mod_muc: host: "chat.@HOST@" access: - allow access_admin: - allow: admin access_create: muc_create access_persistent: muc_create access_mam: - allow max_users: 400 #default 200 max_users_presence: 2000 #default 1000 min_message_interval: 0.4 #spam rate limit history_size: 50 #default 20 default_room_options: allow_subscription: true allow_change_subj: false mam: true persistent: true anonymous: false members_only: true allow_user_invites: true public: false public_list: false lang: "en" mod_muc_admin: {} mod_muc_occupantid: {} mod_muc_rtbl: {} mod_offline: access_max_user_messages: max_user_offline_messages mod_ping: {} mod_pres_counter: count: 5 interval: 60 mod_privacy: {} mod_private: {} mod_proxy65: access: local max_connections: 5 mod_pubsub: #access_createnode: pubsub_createnode access_createnode: local ignore_pep_from_offline: false last_item_cache: false max_items_node: 1000 default_node_config: max_items: 1000 plugins: - flat - pep force_node_config: ## Avoid buggy clients to make their bookmarks public "storage:bookmarks": access_model: whitelist persist_items: true ## Enforce pubsub config for Movim "eu.siacs.conversations.axolotl.*": access_model: open "urn:xmpp:bookmarks:0": access_model: whitelist send_last_published_item: never persist_items: true max_items: infinity "urn:xmpp:bookmarks:1": access_model: whitelist send_last_published_item: never persist_items: true max_items: infinity "urn:xmpp:pubsub:movim-public-subscription": access_model: whitelist persist_items: true max_items: infinity "urn:xmpp:microblog:0": max_items: infinity access_model: presence notify_retract: true persist_items: true "urn:xmpp:microblog:0:comments*": max_items: infinity access_model: open notify_retract: true persist_items: true mod_push: {} mod_push_keepalive: {} mod_register: ## No registration via XMPP supported, redirect to ## Todo: make vhost specific redirect_url: "https://example.org/" ## Only accept registration requests from the "trusted" ## network (see access_rules section above). ## Think twice before enabling registration from any ## address. See the Jabber SPAM Manifesto for details: ## https://github.com/ge0rg/jabber-spam-fighting-manifesto #ip_access: trusted_network mod_roster: versioning: true mod_s2s_dialback: {} mod_shared_roster: {} mod_stream_mgmt: resend_on_timeout: if_offline mod_stun_disco: credentials_lifetime: 6h mod_vcard: search: false mod_vcard_xupdate: {} mod_version: show_os: false allow_contrib_modules: true ### Local Variables: ### mode: yaml ### End: ### vim: set filetype=yaml tabstop=8