Improve ejabberd HTTP API configs and access

Move the listener to a separate endpoint on port 80, which is only
accessible from the private network. Change accounts.kosmos.org to use
the new endpoint via a `.local` domain instead of faking external
access.

site-cookbooks/kosmos-ejabberd/templates/ejabberd.yml.erb

@@ -61,6 +61,14 @@ listen:
     use_proxy_protocol: true
     max_stanza_size: 131072
     shaper: s2s_shaper
+  -
+    port: 80
+    ip: "<%= @private_ip_address %>"
+    module: ejabberd_http
+    request_handlers:
+      "/api": mod_http_api
+    tls: false
+    captcha: false
   -
     port: 5443
     ip: "::"
@@ -69,7 +77,6 @@ listen:
     request_handlers:
       "/ws": ejabberd_http_ws
       "/bosh": mod_bosh
-      "/api": mod_http_api
       "/upload": mod_http_upload
       "/admin": ejabberd_web_admin
     custom_headers: