57 Commits

Author SHA1 Message Date
1576a8e731
Set up coturn, switch from ejabberd in production
https://github.com/coturn/coturn
2023-12-17 15:20:11 +01:00
Râu Cao
65d71d6a73
Migrate ejabberd uploads to mod_s3_upload and Garage
In addition to installing and configuring the new module, this also
enables public access to the S3 API via `bucket-name.s3.kosmos.org` as
well as Web access on `bucket-name.web.s3.kosmos.org` (when enabled).

Also includes some drive-by improvements to Chef attribute naming and
usage.

Co-authored-by: Greg Karékinian <greg@karekinian.com>
2023-10-10 17:55:55 +02:00
Râu Cao
0f12a54eab
Refactor tor usage entirely
Use a custom resource and separate recipe for service configs with
pre-set keys and hostnames
2023-07-30 12:39:41 +02:00
Râu Cao
14e04d77a9
Activate real-time MUC blocklist module 2023-04-19 17:32:15 +02:00
Râu Cao
f8f3fc7c3a
Upgrade ejabberd to 23.04
Also add a package version attribute, since the value changed in the
past.
2023-04-19 17:30:55 +02:00
Râu Cao
797dd241e0
Improve ejabberd HTTP API configs and access
Move the listener to a separate endpoint on port 80, which is only
accessible from the private network. Change accounts.kosmos.org to use
the new endpoint via a `.local` domain instead of faking external
access.
2023-04-03 15:38:40 +02:00
Râu Cao
a2fc3ba25c
Remove obsolete folder permissions 2023-03-24 16:35:07 +07:00
Râu Cao
13fc2e6e24
Improve MUC config 2023-03-24 16:34:40 +07:00
Râu Cao
991458208d
Use a role for configuring LDAP hostname on clients
This way it's also easy to converge all LDAP clients at once.
2022-11-26 16:45:45 +01:00
a85415ef48
Fix MUC service/domains not being announced
Only subdomains of `hosts` are automatically announced, but other
domains have to be added manually via the `extra_domains` disco module
config.

fixes #413
2022-06-03 18:07:50 +02:00
48cdd62973
Upgrade ejabberd to 22.05
Tested/running on all cluster nodes. Due to changes in the upstream
package we were able to remove some complexity from the recipe. Deleting
code FTW!

closes #334
2022-05-31 16:27:07 +02:00
c158f845f0
Configure STUN/TURN for ejabberd and nginx proxy 2022-05-11 15:27:49 +02:00
Greg Karékinian
c56870008e Use the new LDAP services application accounts 2022-05-11 14:49:28 +02:00
Greg Karékinian
e53e55cb2d Disable TLS for LDAP since we're using Zerotier networking 2022-05-11 14:49:00 +02:00
Greg Karékinian
ff7cb1ce4a Generate a hosts entry for the LDAP server 2022-05-11 14:48:30 +02:00
622fabe151
Use private IP for ejabberd TURN 2022-01-19 14:38:53 -06:00
74dd59ad07
Write hostname-related configs for new ejabberd cluster 2022-01-18 12:50:10 -06:00
5b351036ba
Remove superfluous license header 2022-01-18 11:19:20 -06:00
024b4bf164
Fix typo 2022-01-18 11:19:19 -06:00
ad271e55d4 Merge pull request 'Move PostgreSQL to VMs and access via Zerotier' (#282) from feature/postgres_vms into master
Reviewed-on: #282
2021-01-25 10:56:42 +00:00
Greg Karékinian
90ce664f2e Update ejabberd to 20.12
It fixes a bug that prevented the config to be reloaded for LDAP options
(https://github.com/processone/ejabberd/issues/3181) and more:
https://www.process-one.net/blog/ejabberd-20-12/
2021-01-24 10:14:29 +01:00
Greg Karékinian
bb0e73d1b9 Switch ejabberd, mastodon and gitea to a hostname for Postgres 2021-01-23 17:11:45 +01:00
f1c8faff85 Merge branch 'master' into feature/api_permissions 2020-12-10 13:26:48 +00:00
239b6aed51
Add API permissions for akkounts VMs
Using the zerotier IP, which is the same as the knife-zero host.
2020-12-08 20:00:31 +01:00
Greg Karékinian
e6b7794e20 Extract firewall definitions to their own recipe
This allows us to use them for KVM hosts as well. Until now we had set
up ufw rules manually on the two KVM hosts (draco and centaurus)

Refs #244
2020-12-04 16:27:42 +01:00
8c60279fe1
Add cluster configs to ejabberd recipe 2020-11-25 21:02:46 +01:00
Greg Karékinian
3a8af26b5f Remove firewall rule for an unused port 2020-11-25 16:36:07 +01:00
Greg Karékinian
085bd8abd5 Move TURN port to a different range
It landed on a port used by PostgreSQL. Also switch STUN/TURN to TCP
because HAProxy does not support UDP.

Closes #240
2020-11-25 16:36:07 +01:00
Greg Karékinian
8b1f90c568 Use the same Erlang cookie to enable clustering
Refs #243
2020-11-25 16:35:37 +01:00
f39f953b8a
Configure ejabberd nodes for HTTP upload service 2020-11-24 15:44:59 +01:00
Greg Karékinian
2119c11243 Do not include kosmos-postgresql in kosmos-ejabberd default recipe
It will install PostgreSQL, and we do not want that on the ejabberd
server
2020-09-25 16:29:01 +02:00
Greg Karékinian
2c21d6255b Add PostgreSQL primary support to the kosmos-ejabberd cookbook
* Move the PostgreSQL user and database creation to a pg_db recipe
* Generate access rights for the ejabberd servers in the pg_db recipe
* Connect to the PostgreSQL primary instead of localhost

Refs #180
2020-06-10 18:38:40 +02:00
Greg Karékinian
091a46e972 Do not pass the pgsql_password variable to ejabberd.yml
The password is only used in the config files for the vhosts
2020-06-10 18:37:36 +02:00
4448ec2173
Configure TURN properly
Was missing a couple of necessary properties, and is now using an
explicit port range for TURN, and opening those ports in UFW.
2020-05-02 14:07:14 +02:00
ef2fa2da72
Configure STUN/TURN
Configures built-in STUN/TURN support, and adds the new service discovery
module for it.
2020-05-01 16:25:38 +02:00
Greg Karékinian
db8bb44c8b Update ejabberd to 20.03
The download URL has changed, they removed a prefix

Closes #153
2020-04-20 14:53:08 +02:00
Greg Karékinian
f5dd2c7de9 Fix the command importing the schema on db creation
It had an extra }, but this only fails when creating the databases
2020-04-20 14:52:11 +02:00
Greg Karékinian
6cd0fa039e Restart ejabberd service when changing a vhost config
I have ran into an issue, changes to the LDAP config for a host are
currently only loaded on startup, not on reload

https://github.com/processone/ejabberd/issues/3181

This should be fixed once
b39a1e2d74
is part of the next release
2020-03-04 13:23:54 +01:00
Greg Karékinian
6fa89b3c25 Switch the ejabberd LDAP setup to a new application account
Needs the new directory structure:

```
dn: cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalRole
cn: users

dn: ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
ou: kosmos.org

dn: ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
description: 5apps
ou: 5apps.com

dn: uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: wiki
userPassword: [snip]

dn: uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

dn: uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

```

And the new ACIs:

```
dn: ou=5apps.com,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)

dn: ou=kosmos.org,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=wiki,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
```

Refs #140
2020-02-21 18:03:58 +01:00
Greg Karékinian
90a0e6be9f Enable LDAP on the kosmos.org vhost 2020-02-19 12:30:55 +01:00
Greg Karékinian
72cc6342f1 Remove the unused LDAP variables from the main config file 2020-02-17 13:27:14 +01:00
Greg Karékinian
38f39af2a4 Move each vhost to its own config file 2020-02-17 13:20:54 +01:00
Greg Karékinian
dc1226073c Move the admin users to the ejabberd encrypted data bag 2020-02-14 13:56:17 +01:00
Greg Karékinian
49d01991fd Enable LDAP on the XMPP 5apps.com vhost
Refactor the ejabberd config file to remove hardcoded values about the
vhosts

Refs #123
2020-02-12 17:40:38 +01:00
Greg Karékinian
2ecc128abd Move the hidden service attributes to the attributes file
When it is set in the recipe the hidden service dir doesn't get set
correctly (nil), resulting in a broken torrc file
2019-09-11 13:47:42 +02:00
40eb94f091
Move Tor attributes to recipe files 2019-09-09 13:36:49 +02:00
03b3b2de91
Add hidden service for ejabberd 2019-09-03 19:47:52 +02:00
Greg Karékinian
0fa9e6cbb7 Set the uploads dir inside of /opt/ejabberd instead of /var/www
/var/www is intended for nginx/apache

I have copied over the old directories manually on Andromeda before
running this code

Fixes #80
2019-07-19 12:47:42 +02:00
Greg Karékinian
b01985ec4f Fix the permissions for the ejabberd upload folders 2019-06-14 16:38:49 +02:00
Greg Karékinian
5106ba20fd Add the version to the dpkg package to allow updates 2019-05-14 17:10:15 +02:00