de7cc69505
Allow more users per room
2025-05-17 10:42:41 +04:00
5777a45f0a
Fix/improve ejabberd cert renewals
2025-04-22 17:28:44 +04:00
f246f63594
Update Gandi API token
...
For certbot renewals. Also set resource to sensitive in ejabberd recipe.
Co-authored-by: Greg Karékinian <greg@karekinian.com>
2025-03-19 18:01:50 +04:00
e4112a3626
Fix TLS cert updates for kosmos.chat
...
Some recipes weren't updated for the proxy validation yet. Needed to
split the ejabberd cert in two, so it can do normal validation on
`.org` and proxy validation on `.chat`.
2024-12-09 18:17:10 +04:00
3853f94ae0
Use new proxy domain for ejabberd cert
2024-10-16 12:40:10 +02:00
0726e58f7c
Update ejabberd LDAP filter for new akkounts release
2024-10-16 12:36:30 +02:00
989185f951
Support proxy domain validation for Garage web domains
...
Also rename the data bag item
2024-04-30 12:23:36 +02:00
12b4fb37fa
Only allow ejabberd logins when XMPP service is enabled
2024-03-27 20:12:33 +04:00
4a8ab3abe3
Support letsencrypt proxy validation via CNAMEs
...
Allows to point other domains' `_acme-challenge.example.com` entries at
`example.com.letsencrypt.kosmos.chat` so we can validate from our side
without access to the other domain's DNS records.
Used for 5apps.com XMPP for now. Can be used for others later.
Co-authored-by: Greg Karékinian <greg@karekinian.com>
2024-03-11 16:21:28 +01:00
292366a77f
Domain vs realm vs IP
2023-12-18 13:23:05 +01:00
ed998fc1d3
Use TCP for TLS connections
2023-12-18 13:22:34 +01:00
8a97ebf4f8
Use domain instead of IP, add TLS endpoints
2023-12-17 17:57:49 +01:00
1576a8e731
Set up coturn, switch from ejabberd in production
...
https://github.com/coturn/coturn
2023-12-17 15:20:11 +01:00
Râu Cao
4dbc960eed
Switch ejabberd node handling TURN
...
Should use the same outgoing IP as for incoming
2023-12-05 18:19:48 +01:00
Râu Cao
65d71d6a73
Migrate ejabberd uploads to mod_s3_upload and Garage
...
In addition to installing and configuring the new module, this also
enables public access to the S3 API via `bucket-name.s3.kosmos.org` as
well as Web access on `bucket-name.web.s3.kosmos.org` (when enabled).
Also includes some drive-by improvements to Chef attribute naming and
usage.
Co-authored-by: Greg Karékinian <greg@karekinian.com>
2023-10-10 17:55:55 +02:00
Râu Cao
0f12a54eab
Refactor tor usage entirely
...
Use a custom resource and separate recipe for service configs with
pre-set keys and hostnames
2023-07-30 12:39:41 +02:00
Râu Cao
68b56789c5
Migrate ejabberd UDP streams to openresty
...
And remove the other streams in the process, in favor of running haproxy
on all LBs.
2023-07-30 12:39:36 +02:00
Râu Cao
14e04d77a9
Activate real-time MUC blocklist module
2023-04-19 17:32:15 +02:00
Râu Cao
f8f3fc7c3a
Upgrade ejabberd to 23.04
...
Also add a package version attribute, since the value changed in the
past.
2023-04-19 17:30:55 +02:00
Râu Cao
797dd241e0
Improve ejabberd HTTP API configs and access
...
Move the listener to a separate endpoint on port 80, which is only
accessible from the private network. Change accounts.kosmos.org to use
the new endpoint via a `.local` domain instead of faking external
access.
2023-04-03 15:38:40 +02:00
Râu Cao
a2fc3ba25c
Remove obsolete folder permissions
2023-03-24 16:35:07 +07:00
Râu Cao
13fc2e6e24
Improve MUC config
2023-03-24 16:34:40 +07:00
Râu Cao
991458208d
Use a role for configuring LDAP hostname on clients
...
This way it's also easy to converge all LDAP clients at once.
2022-11-26 16:45:45 +01:00
a85415ef48
Fix MUC service/domains not being announced
...
Only subdomains of `hosts` are automatically announced, but other
domains have to be added manually via the `extra_domains` disco module
config.
fixes #413
2022-06-03 18:07:50 +02:00
48cdd62973
Upgrade ejabberd to 22.05
...
Tested/running on all cluster nodes. Due to changes in the upstream
package we were able to remove some complexity from the recipe. Deleting
code FTW!
closes #334
2022-05-31 16:27:07 +02:00
decd937d43
Remove superfluous license header
2022-05-11 16:27:21 +02:00
b3f1a74cc2
Remove obsolete ejabberd backups
2022-05-11 16:27:21 +02:00
c158f845f0
Configure STUN/TURN for ejabberd and nginx proxy
2022-05-11 15:27:49 +02:00
Greg Karékinian
c56870008e
Use the new LDAP services application accounts
2022-05-11 14:49:28 +02:00
Greg Karékinian
e53e55cb2d
Disable TLS for LDAP since we're using Zerotier networking
2022-05-11 14:49:00 +02:00
Greg Karékinian
ff7cb1ce4a
Generate a hosts entry for the LDAP server
2022-05-11 14:48:30 +02:00
622fabe151
Use private IP for ejabberd TURN
2022-01-19 14:38:53 -06:00
62c95175cc
Only allow ZeroTier connections for ejabberd cluster
2022-01-18 12:50:13 -06:00
74dd59ad07
Write hostname-related configs for new ejabberd cluster
2022-01-18 12:50:10 -06:00
5b351036ba
Remove superfluous license header
2022-01-18 11:19:20 -06:00
024b4bf164
Fix typo
2022-01-18 11:19:19 -06:00
ad271e55d4
Merge pull request 'Move PostgreSQL to VMs and access via Zerotier' ( #282 ) from feature/postgres_vms into master
...
Reviewed-on: #282
2021-01-25 10:56:42 +00:00
Greg Karékinian
90ce664f2e
Update ejabberd to 20.12
...
It fixes a bug that prevented the config to be reloaded for LDAP options
(https://github.com/processone/ejabberd/issues/3181 ) and more:
https://www.process-one.net/blog/ejabberd-20-12/
2021-01-24 10:14:29 +01:00
Greg Karékinian
bb0e73d1b9
Switch ejabberd, mastodon and gitea to a hostname for Postgres
2021-01-23 17:11:45 +01:00
f1c8faff85
Merge branch 'master' into feature/api_permissions
2020-12-10 13:26:48 +00:00
239b6aed51
Add API permissions for akkounts VMs
...
Using the zerotier IP, which is the same as the knife-zero host.
2020-12-08 20:00:31 +01:00
Greg Karékinian
e6b7794e20
Extract firewall definitions to their own recipe
...
This allows us to use them for KVM hosts as well. Until now we had set
up ufw rules manually on the two KVM hosts (draco and centaurus)
Refs #244
2020-12-04 16:27:42 +01:00
8c60279fe1
Add cluster configs to ejabberd recipe
2020-11-25 21:02:46 +01:00
Greg Karékinian
3a8af26b5f
Remove firewall rule for an unused port
2020-11-25 16:36:07 +01:00
Greg Karékinian
085bd8abd5
Move TURN port to a different range
...
It landed on a port used by PostgreSQL. Also switch STUN/TURN to TCP
because HAProxy does not support UDP.
Closes #240
2020-11-25 16:36:07 +01:00
Greg Karékinian
7636f6ed19
Move the Gandi DNS certbot hook to kosmos-ejabberd
2020-11-25 16:36:07 +01:00
Greg Karékinian
8b1f90c568
Use the same Erlang cookie to enable clustering
...
Refs #243
2020-11-25 16:35:37 +01:00
f39f953b8a
Configure ejabberd nodes for HTTP upload service
2020-11-24 15:44:59 +01:00
0e29c930ed
Configure subdirectory level for upload.pm
...
This allows to post to per-domain subdirectories from XMPP clients.
2020-11-24 15:33:34 +01:00
0aef830aa3
Fix upload folder permissions
...
Uploads are failing with the current mode.
2020-11-23 20:50:01 +01:00
