-- Prosody XMPP Server Configuration -- -- Information on configuring Prosody can be found on our -- website at http://metronome.im/doc/configure -- -- Tip: You can check that the syntax of this file is correct -- when you have finished by running: metronomectl check config -- If there are any errors, it will let you know what and where -- they are, otherwise it will keep quiet. -- -- Good luck, and happy Jabbering! ---------- Server-wide settings ---------- -- Settings in this section apply to the whole server and are the default settings -- for any virtual hosts -- This is a (by default, empty) list of accounts that are admins -- for the server. Note that you must create the accounts separately -- (see http://metronome.im/doc/creating_accounts for info) -- Example: admins = { "user1@example.com", "user2@example.net" } admins = { } -- Required for init scripts and metronomectl pidfile = "/var/run/metronome/metronome.pid" -- ulimit metronome_max_files_soft = 200000 metronome_max_files_hard = 200000 -- HTTP server http_ports = { 5280 } http_interfaces = { "0.0.0.0", "::" } https_ports = { 5281 } https_interfaces = { "0.0.0.0", "::" } -- Enable IPv6 use_ipv6 = true -- This is the list of modules Prosody will load on startup. -- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too. -- Documentation on modules can be found at: http://metronome.im/doc/modules modules_enabled = { -- Generally required --"roster"; -- Allow users to have a roster. Recommended ;) "saslauth"; -- Authentication for clients and servers. Recommended if you want to log in. "tls"; -- Add support for secure TLS on c2s/s2s connections "dialback"; -- s2s dialback support "disco"; -- Service discovery "extdisco"; -- External Service Discovery -- Not essential, but recommended --"private"; -- Private XML storage (for room bookmarks, etc.) --"vcard"; -- Allow users to set vCards -- These are commented by default as they have a performance impact "compression"; -- Stream compression (requires the lua-zlib package installed) -- Nice to have "version"; -- Replies to server version requests "uptime"; -- Report how long server has been running "time"; -- Let others know the time here on this server "ping"; -- Replies to XMPP pings with pongs --"pep"; -- Enables users to publish their mood, activity, playing music and more --"register"; -- Allow users to register on this server using a client and change passwords -- Admin interfaces "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands --"admin_telnet"; -- Opens telnet console interface on localhost port 5582 -- HTTP modules "bosh"; -- Enable BOSH clients, aka "Jabber over HTTP" "websocket"; -- Enable WebSocket clients --"http_files"; -- Serve static files from a directory over HTTP -- Other specific functionality "posix"; -- POSIX functionality, sends server to background, enables syslog, etc. "bidi"; -- Bidirectional Streams for S2S connections "stream_management"; -- Stream Management support --"groups"; -- Shared roster support --"announce"; -- Send announcement to all online users --"welcome"; -- Welcome users who register accounts --"watchregistrations"; -- Alert admins of registrations --"motd"; -- Send a message to users when they log in "legacyauth"; -- Legacy authentication. Only used by some old clients and bots. "log_auth"; } -- These modules are auto-loaded, but should you want -- to disable them then uncomment them here: modules_disabled = { -- "offline"; -- Store offline messages -- "c2s"; -- Handle client connections -- "s2s"; -- Handle server-to-server connections } -- Discovery items disco_items = { { "muc.example.org" }, { "proxy.example.org" }, { "pubsub.example.org" }, { "vjud.example.org" } }; -- External Service Discovery (mod_extdisco) external_services = { ["stun.example.org"] = { [1] = { port = "3478", transport = "udp", type = "stun" }, [2] = { port = "3478", transport = "tcp", type = "stun" } } }; -- Bidirectional Streams configuration (mod_bidi) bidi_exclusion_list = { "jabber.org" } -- BOSH configuration (mod_bosh) bosh_max_inactivity = 30 consider_bosh_secure = true cross_domain_bosh = true -- WebSocket configuration (mod_websockets) consider_websockets_secure = true cross_domain_websockets = true -- Disable account creation by default, for security allow_registration = false -- Ignore priority settings ignore_presence_priority = true -- These are the SSL/TLS-related settings. If you don't want -- to use SSL/TLS, you may comment or remove this ssl = { key = "/etc/metronome/certs/localhost.key"; certificate = "/etc/metronome/certs/localhost.cert"; options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference" }; } -- Force clients to use encrypted connections? This option will -- prevent clients from authenticating unless they are using encryption. c2s_require_encryption = true -- Force servers to use encrypted connections? This option will -- prevent servers from connecting unless they are using encryption. s2s_require_encryption = true -- Allow servers to use an unauthenticated encryption channel s2s_allow_encryption = true -- Don't require encryption for listed servers s2s_encryption_exceptions = { "cisco.com", "gmail.com" } -- Logging configuration -- For advanced logging see http://metronome.im/doc/logging log = { info = "/var/log/metronome/metronome.log"; -- Change 'info' to 'debug' for verbose logging error = "/var/log/metronome/metronome.err"; -- "*syslog"; -- Uncomment this for logging to syslog -- "*console"; -- Log to the console, useful for debugging with daemonize=false } activity_log_dir = "/var/log/metronome/activity_log" -- For the "sql" backend, you can uncomment *one* of the below to configure: sql = { driver = "SQLite3", database = "metronome.sqlite" } -- Default. 'database' is the filename. --sql = { driver = "MySQL", database = "metronome", username = "metronome", password = "password", host = "localhost" } --sql = { driver = "PostgreSQL", database = "metronome", username = "metronome", password = "secret", host = "localhost" } ----------- Virtual hosts ----------- -- You need to add a VirtualHost entry for each domain you wish Prosody to serve. -- Settings under each VirtualHost entry apply *only* to that host. VirtualHost "example.org" enabled = true default_storage = "sql" modules_enabled = { -- Generally required "roster"; -- Allow users to have a roster. Recommended ;) -- Not essential, but recommended "private"; -- Private XML storage (for room bookmarks, etc.) "vcard"; -- Allow users to set vCards -- These are commented by default as they have a performance impact "mam"; -- Message Archive Management "privacy"; -- Support privacy lists -- Nice to have "lastactivity"; -- Logs the user last activity timestamp "pep"; -- Enables users to publish their mood, activity, playing music and more "message_carbons"; -- Allow clients to keep in sync with messages send on other resources --"register"; -- Allow users to register on this server using a client and change passwords --"register_redirect"; -- Redirects users registering to the registration form "public_service"; -- Provides some information about the XMPP server --"log_activity"; -- Activity log, module from https://github.com/jappix/jappix-xmppd-modules "groups"; -- Shared groups -- Admin interfaces --"admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands } groups_file = "/etc/metronome/groups.txt" resources_limit = 10 no_registration_whitelist = true registration_url = "https://example.org/" registration_text = "Please register your account on Jappix itself (open example.org in your Web browser). Then you'll be able to use it anywhere you want." public_service_vcard = { name = "Jappix XMPP service", url = "https://example.org/", foundation_year = "2010", country = "RU", email = "admin@example.org", admin_jid = "admin@example.org", geo = "48.87,2.33", ca = { name = "StartSSL", url = "https://www.startssl.com/" }, oob_registration_uri = "https://example.org/" } VirtualHost "anonymous.example.org" enabled = true authentication = "anonymous" allow_anonymous_multiresourcing = true allow_anonymous_s2s = true anonymous_jid_gentoken = "Jappix Anonymous User" anonymous_randomize_for_trusted_addresses = { "127.0.0.1", "::1" } ------ Components ------ -- You can specify components to add hosts that provide special services, -- like multi-user conferences, and transports. ---Set up a MUC (multi-user chat) room server on muc.example.org: Component "muc.example.org" "muc" name = "Jappix Chatrooms" modules_enabled = { "muc_limits"; "muc_log"; "muc_log_http"; "pastebin"; } muc_event_rate = 0.5 muc_burst_factor = 10 muc_log_http_config = { url_base = "logs"; theme = "metronome"; } pastebin_url = "https://muc.example.org/paste/" pastebin_path = "/paste/" pastebin_expire_after = 0 pastebin_trigger = "!paste" ---Set up a PubSub server Component "pubsub.example.org" "pubsub" name = "Jappix Publish/Subscribe" --unrestricted_node_creation = true -- Anyone can create a PubSub node (from any server) ---Set up a VJUD service Component "vjud.example.org" "vjud" ud_disco_name = "Jappix User Directory" synchronize_to_host_vcards = "example.org" ---Set up a BOSH service ( https://bind.example.org:5281/http-bind ) Component "bind.example.org" "http" modules_enabled = { "bosh" } ---Set up a WebSocket service Component "websocket.example.org" "http" modules_enabled = { "websocket" } ---Set up a BOSH + WebSocket service Component "me.example.org" "http" modules_enabled = { "bosh", "websocket" } ---Set up a statistics service Component "stats.example.org" "http" modules_enabled = { "server_status" } server_status_basepath = "/xmppd/" server_status_show_hosts = { "example.org", "anonymous.example.org" } server_status_show_comps = { "muc.example.org", "proxy.example.org", "pubsub.example.org", "vjud.example.org" } -- Set up a SOCKS5 bytestream proxy for server-proxied file transfers: Component "proxy.example.org" "proxy65" proxy65_acl = { "example.org", "anonymous.example.org" } 

 server { listen 80; server_name jappix.example.org; return 301 https://jappix.example.org$request_uri; } server { listen 443 ssl; server_name jappix.example.org; root /var/www/jappix; index index.html index.php; access_log /var/log/nginx/jappix-access.log; error_log /var/log/nginx/jappix-error.log; # Configuration SSL # Support du HSTS (HTTP Strict Transport Security) add_header Strict-Transport-Security "max-age=315360000; includeSubdomains"; # Configuration SSL ssl_certificate /etc/nginx/certificates/common-ssl.cert; ssl_certificate_key /etc/nginx/certificates/common-ssl.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"; location / { try_files $uri $uri/ /index.php?$args; } location ~ \.php$ { try_files $uri =404; fastcgi_index index.php; fastcgi_pass php5-fpm-sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include /etc/nginx/fastcgi_params; fastcgi_param PHP_VALUE "upload_max_filesize = 25M \n post_max_size = 25M \n max_execution_time = 600"; } location ~ /(app|i18n|log|test|tmp|tools)/ { deny all; } } + aRSA + AESGCM EECDH + ECDSA + SHA384 EECDH + ECDSA + SHA256 EECDH + aRSA + SHA384 EECDH + aRSA + SHA256 EECDH EDH + aRSA! RC4! aNULL! eNULL! LOW! 3DES! MD5! EXP server { listen 80; server_name jappix.example.org; return 301 https://jappix.example.org$request_uri; } server { listen 443 ssl; server_name jappix.example.org; root /var/www/jappix; index index.html index.php; access_log /var/log/nginx/jappix-access.log; error_log /var/log/nginx/jappix-error.log; # Configuration SSL # Support du HSTS (HTTP Strict Transport Security) add_header Strict-Transport-Security "max-age=315360000; includeSubdomains"; # Configuration SSL ssl_certificate /etc/nginx/certificates/common-ssl.cert; ssl_certificate_key /etc/nginx/certificates/common-ssl.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"; location / { try_files $uri $uri/ /index.php?$args; } location ~ \.php$ { try_files $uri =404; fastcgi_index index.php; fastcgi_pass php5-fpm-sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include /etc/nginx/fastcgi_params; fastcgi_param PHP_VALUE "upload_max_filesize = 25M \n post_max_size = 25M \n max_execution_time = 600"; } location ~ /(app|i18n|log|test|tmp|tools)/ { deny all; } }