I have added a task to create a new page that documents the SASL downgrade on Conversations for existing users. I think it should include a screenshot for it to be clear. The best way I can think of to do that is to create a test kosmos.org user, and then enable both psql and ldap temporarily (with only that user created in LDAP)
How many passwords to we really have in the config? It can’t be that many.
Good point, I have moved the admin users to an encrypted data bag
The LDAP implementation in ejabberd doesn't support SASL authentication. From the docs:
I was considering using different files for the vhosts, but then I could not find a way to define the hosts all at once (https://docs.ejabberd.im/admin/configuration/#host-names), so it didn't seem to make much sense to split the config. I'm going to look into what's possible