Enable LDAP on the XMPP 5apps.com vhost

Refactor the ejabberd config file to remove hardcoded values about the
vhosts

Refs #123

data_bags/credentials/ejabberd.json

@@ -0,0 +1,10 @@
+{
+  "id": "ejabberd",
+  "5apps_ldap_password": {
+    "encrypted_data": "NjlYL0mMpXmLP2pk1ZSo5mWt+qosx7eh7+duoPc57avQGwPJ6Vxb\n",
+    "iv": "q/py5XYCEXARUEA9\n",
+    "auth_tag": "4xoSjTjLYNzuLvoksf3Thw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  }
+}

site-cookbooks/kosmos-ejabberd/recipes/default.rb

@@ -26,6 +26,8 @@
 
 include_recipe "kosmos-postgresql"
 
+ejabberd_credentials = data_bag_item("credentials", "ejabberd")
+
 cookbook_file "#{Chef::Config[:file_cache_path]}/pg.sql" do
   source "pg.sql"
   mode "0664"
@@ -55,35 +57,90 @@ postgresql_user 'ejabberd' do
   password postgresql_data_bag_item['ejabberd_user_password']
 end
 
-postgresql_database 'ejabberd' do
+hosts = [
+  {
+    name: "kosmos.org",
+    sql_database: "ejabberd",
+    ldap_enabled: false,
+    append_host_config: <<-EOF
+modules:
+      mod_muc:
+        host: "kosmos.chat"
+        access:
+          - allow
+        access_admin:
+          - allow: admin
+        access_create: muc_create
+        access_persistent: muc_create
+        max_user_conferences: 1000
+        default_room_options:
+          mam: true
+                EOF
+  },
+  {
+    name: "5apps.com",
+    sql_database: "ejabberd_5apps",
+    ldap_enabled: true,
+    ldap_password: ejabberd_credentials['5apps_ldap_password'],
+    append_host_config: <<-EOF
+modules:
+      mod_muc:
+        host: "muc.@HOST@"
+        access:
+          - allow: local
+        access_admin:
+          - allow: admin
+        access_create: muc_create
+        access_persistent: muc_create
+        max_user_conferences: 1000
+        default_room_options:
+          anonymous: false
+          public: true
+          members_only: true
+          public_list: false
+          persistent: true
+          mam: true
+                EOF
+  }
+]
+
+hosts.each do |host|
+  postgresql_database host[:sql_database] do
     owner 'ejabberd'
     action :create
-  notifies :run, "execute[create db schema ejabberd]", :delayed
+    notifies :run, "execute[create db schema #{host[:sql_database]}]", :delayed
   end
 
-postgresql_database 'ejabberd_5apps' do
+  execute "create db schema #{host[:sql_database]}" do
-  owner 'ejabberd'
-  action :create
-  notifies :run, "execute[create db schema ejabberd_5apps]", :delayed
-end
-
-execute "create db schema ejabberd" do
     user "ejabberd"
-  command "psql ejabberd < #{Chef::Config[:file_cache_path]}/pg.sql"
+    command "psql #{host[:sql_database]}} < #{Chef::Config[:file_cache_path]}/pg.sql"
     action :nothing
   end
-
-execute "create db schema ejabberd_5apps" do
-  user "ejabberd"
-  command "psql ejabberd_5apps < #{Chef::Config[:file_cache_path]}/pg.sql"
-  action :nothing
 end
 
+ldap_domain = node['kosmos-dirsrv']['master_hostname']
+ldap_encryption_type = node.chef_environment == "development" ? "none" : "tls"
+ldap_base = "cn=users,dc=kosmos,dc=org"
+
+admin_users = [
+  "greg@5apps.com",
+  "sebastian@5apps.com",
+  "garret@5apps.com",
+  "raucao@kosmos.org",
+  "greg@kosmos.org",
+  "galfert@kosmos.org"
+]
+
 template "/opt/ejabberd/conf/ejabberd.yml" do
   source    "ejabberd.yml.erb"
   mode      0640
   sensitive true
-  variables pgsql_password: postgresql_data_bag_item['ejabberd_user_password']
+  variables pgsql_password: postgresql_data_bag_item['ejabberd_user_password'],
+            hosts: hosts,
+            ldap_base: ldap_base,
+            ldap_server: ldap_domain,
+            ldap_encryption_type: ldap_encryption_type,
+            admin_users: admin_users
   notifies :run, "execute[ejabberdctl reload_config]", :delayed
 end
 

site-cookbooks/kosmos-ejabberd/templates/ejabberd.yml.erb

@@ -7,36 +7,38 @@ log_rotate_count: 1
 log_rate_limit: 100
 
 hosts:
-  - "kosmos.org"
+<% @hosts.each do |host| -%>
-  - "5apps.com"
+  - "<%= host[:name] %>"
+<% end -%>
 
 host_config:
-  "kosmos.org":
+<% @hosts.each do |host| -%>
+  "<%= host[:name] %>":
     sql_type: pgsql
     sql_server: "localhost"
-    sql_database: "ejabberd"
+    sql_database: "<%= host[:sql_database] %>"
-    sql_username: "ejabberd"
-    sql_password: "<%= @pgsql_password %>"
-  "5apps.com":
-    sql_type: pgsql
-    sql_server: "localhost"
-    sql_database: "ejabberd_5apps"
     sql_username: "ejabberd"
     sql_password: "<%= @pgsql_password %>"
+  <% if host[:ldap_enabled] -%>
+    auth_method: ldap
+    ldap_servers: ["<%= @ldap_server %>"]
+    ldap_rootdn: "cn=xmpp,ou=<%= host[:name] %>,<%= @ldap_base %>"
+    ldap_password: "<%= host[:ldap_password] %>"
+    ldap_encrypt: <%= @ldap_encryption_type %>
+    ldap_base: "ou=<%= host[:name] %>,<%= @ldap_base %>"
+    ldap_filter: "(nsRole=cn=xmpp_role,ou=<%= host[:name] %>,<%= @ldap_base %>)"
+  <% end -%>
+<% end -%>
 
-<% if (File.exist?("/opt/ejabberd/conf/kosmos.org.crt") && File.exist?("/opt/ejabberd/conf/kosmos.org.key")) ||
+<% if @hosts.any? { |host| File.exist?("/opt/ejabberd/conf/#{host[:name]}.crt") && File.exist?("/opt/ejabberd/conf/#{host[:name]}.key") } -%>
-    (File.exist?("/opt/ejabberd/conf/5apps.com.crt") && File.exist?("/opt/ejabberd/conf/5apps.com.key")) -%>
 certfiles:
-<% if File.exist?("/opt/ejabberd/conf/kosmos.org.crt") && File.exist?("/opt/ejabberd/conf/kosmos.org.key") -%>
+<% @hosts.each do |host| -%>
-  - "/opt/ejabberd/conf/kosmos.org.crt"
+  <% if File.exist?("/opt/ejabberd/conf/#{host[:name]}.crt") && File.exist?("/opt/ejabberd/conf/#{host[:name]}.key") -%>
-  - "/opt/ejabberd/conf/kosmos.org.key"
+  - "/opt/ejabberd/conf/<%= host[:name] %>.crt"
-<% end -%>
+  - "/opt/ejabberd/conf/<%= host[:name] %>.key"
-<% if File.exist?("/opt/ejabberd/conf/5apps.com.crt") && File.exist?("/opt/ejabberd/conf/5apps.com.key") -%>
+  <% end -%>
-  - "/opt/ejabberd/conf/5apps.com.crt"
-  - "/opt/ejabberd/conf/5apps.com.key"
 <% end -%>
 <% end -%>
-
 ca_file: "/opt/ejabberd/conf/cacert.pem"
 
 define_macro:
@@ -113,12 +115,9 @@ max_fsm_queue: 10000
 acl:
   admin:
     user:
-      - "greg@5apps.com"
+    <% @admin_users.each do |admin| -%>
-      - "sebastian@5apps.com"
+      - "<%= admin %>"
-      - "garret@5apps.com"
+    <% end -%>
-      - "raucao@kosmos.org"
-      - "greg@kosmos.org"
-      - "galfert@kosmos.org"
 
   local:
     user_regexp: ""
@@ -232,14 +231,9 @@ modules:
       - "pep" # pep requires mod_caps
   mod_push: {}
   mod_push_keepalive: {}
+  # Allow existing accounts to change their password
   mod_register:
-    welcome_message:
+    access: none
-      subject: "Welcome!"
-      body: |-
-        Hi.
-        Welcome to this XMPP server.
-    ip_access: trusted_network
-    access: register
   mod_roster:
     versioning: true
     store_current_id: true
@@ -254,37 +248,10 @@ modules:
   mod_http_api: {}
 
 append_host_config:
-  "5apps.com":
+<% @hosts.each do |host| -%>
-    modules:
+  "<%= host[:name] %>":
-      mod_muc:
+    <%= host[:append_host_config].chomp %>
-        host: "muc.@HOST@"
+<% end -%>
-        access:
-          - allow: local
-        access_admin:
-          - allow: admin
-        access_create: muc_create
-        access_persistent: muc_create
-        max_user_conferences: 1000
-        default_room_options:
-          anonymous: false
-          public: true
-          members_only: true
-          public_list: false
-          persistent: true
-          mam: true
-  "kosmos.org":
-    modules:
-      mod_muc:
-        host: "kosmos.chat"
-        access:
-          - allow
-        access_admin:
-          - allow: admin
-        access_create: muc_create
-        access_persistent: muc_create
-        max_user_conferences: 1000
-        default_room_options:
-          mam: true
 
 allow_contrib_modules: true