Documentation du service
This commit is contained in:
parent
6583a843fe
commit
07500a5690
370
README.md
370
README.md
|
|
@ -5,3 +5,373 @@ Service XMPP de l'association Libre en communs.
|
|||
Responsable: Adrien Bourmault (@neox)
|
||||
|
||||
Déployé sur la machine `xmpp` (voir la [documentation spécifique](https://git.a-lec.org/a-lec/commissions/infrastructure/doc-infra/-/blob/master/Machines%20virtuelles/xmpp.md)).
|
||||
|
||||
Le contenu de ce répertoire est publié sous licence libre GNU AGPL3+.
|
||||
|
||||
[TOC]
|
||||
|
||||
# Installation
|
||||
|
||||
## Prérequis
|
||||
|
||||
On aura besoin de quelques paquets de base :
|
||||
|
||||
```
|
||||
sudo apt install postgres erlang-p1-pgsql
|
||||
sudo apt install postgresql erlang-p1-pgsql
|
||||
sudo apt install certbot
|
||||
```
|
||||
|
||||
On crée un utilisateur pour la base de données postgres :
|
||||
|
||||
```
|
||||
sudo -u postgres createuser -P ejabberd
|
||||
sudo -u postgres createdb -O ejabberd ejabberd
|
||||
```
|
||||
|
||||
## Installation du serveur XMPP ejabberd
|
||||
|
||||
Installer le paquet `ejabberd` des dépôts de Debian stable :
|
||||
|
||||
```
|
||||
sudo apt install ejabberd
|
||||
```
|
||||
|
||||
Initialiser la base de données avec le schéma récupéré dans les fichiers installés par le paquet :
|
||||
|
||||
```
|
||||
psql -U ejabberd ejabberd < /usr/share/ejabberd/sql/pg.new.sql
|
||||
```
|
||||
|
||||
Éditer ensuite la configuration dans `/etc/ejabberd/ejabberd.yml`.
|
||||
|
||||
Afin de pouvoir réaliser des statistiques sur l'utilisation des appels audio/vidéo, renforcer la verbosité tout en masquant le maximum de données privées :
|
||||
|
||||
```
|
||||
# loglevel: Verbosity of log files generated by ejabberd
|
||||
loglevel: info
|
||||
hide_sensitive_log_data: true
|
||||
```
|
||||
|
||||
Paramétrer les domaines couverts par le service :
|
||||
|
||||
```
|
||||
hosts:
|
||||
- a-lec.org
|
||||
```
|
||||
|
||||
Paramétrer les `acl` pour configurer la liste des admins, et les bannissements de serveurs et/ou de comptes :
|
||||
```
|
||||
acl:
|
||||
admin:
|
||||
- user: "admin@a-lec.org"
|
||||
|
||||
local:
|
||||
user_regexp: ""
|
||||
loopback:
|
||||
ip:
|
||||
- 127.0.0.0/8
|
||||
- ::1/128
|
||||
|
||||
banned_forever:
|
||||
- user: destroytrannies@jabber.systemli.org
|
||||
- user: truman@chatterboxtown.us
|
||||
- user: abortionismurder@chatterboxtown.us
|
||||
- user: peacefulashell@chatterboxtown.us
|
||||
- user: whitepower@jabber.systemli.org
|
||||
- user: blackbubonicplauge@chatterboxtown.us
|
||||
- user: templeos@magicbroccoli.de
|
||||
- user: killniggers@magicbroccoli.de
|
||||
- user: killniggers@chatterboxtown.us
|
||||
- user: blackbubonicplauge@chatterboxtown.us
|
||||
- user: killblackpeople@jabber.systemli.org
|
||||
- user: censorship@magicbroccoli.de
|
||||
- user: killniggers@magicbroccoli.de
|
||||
- user: killniggers@chatterboxtown.us
|
||||
- user: dietrannies@chatterboxtown.us
|
||||
|
||||
problematic_hosts:
|
||||
- server: creep.im
|
||||
- server: 0nl1ne.cc
|
||||
- server: aegir.tech
|
||||
- server: blackjabber.cc
|
||||
- server: blug.moe
|
||||
- server: chat.hoferr.ch
|
||||
- server: vremsg.com
|
||||
```
|
||||
|
||||
On paramètre ensuite les règles d'accès, utilisant les `acl` :
|
||||
```
|
||||
access_rules:
|
||||
local:
|
||||
- allow: local
|
||||
c2s:
|
||||
- deny: blocked
|
||||
- allow
|
||||
s2s:
|
||||
- deny: problematic_hosts
|
||||
- allow
|
||||
announce:
|
||||
- allow: admin
|
||||
configure:
|
||||
- allow: admin
|
||||
muc_create:
|
||||
- allow: local
|
||||
pubsub_createnode:
|
||||
- allow: local
|
||||
trusted_network:
|
||||
- allow: loopback
|
||||
|
||||
api_permissions:
|
||||
"console commands":
|
||||
from:
|
||||
- ejabberd_ctl
|
||||
who: all
|
||||
what: "*"
|
||||
"admin access":
|
||||
who:
|
||||
access:
|
||||
allow:
|
||||
- acl: loopback
|
||||
- acl: admin
|
||||
oauth:
|
||||
scope: "ejabberd:admin"
|
||||
access:
|
||||
allow:
|
||||
- acl: loopback
|
||||
- acl: admin
|
||||
what:
|
||||
- "*"
|
||||
- "!stop"
|
||||
- "!start"
|
||||
"public commands":
|
||||
who:
|
||||
ip: 127.0.0.1/8
|
||||
what:
|
||||
- status
|
||||
- connected_users_number
|
||||
```
|
||||
|
||||
|
||||
On indique l'emplacement des certificats (préalablement créés avec certbot) et on désactive le système interne de demande de certificat :
|
||||
|
||||
```
|
||||
certfiles:
|
||||
- /etc/letsencrypt/live/xmpp.a-lec.org/fullchain.pem
|
||||
- /etc/letsencrypt/live/xmpp.a-lec.org/privkey.pem
|
||||
- /etc/letsencrypt/live/a-lec.org/fullchain.pem
|
||||
- /etc/letsencrypt/live/a-lec.org/privkey.pem
|
||||
|
||||
acme:
|
||||
auto: false
|
||||
```
|
||||
|
||||
On peut alors paramétrer les différents modules du service XMPP, c'est à dire le C2S, le S2S, TURN/STUN pour les appels audio/vidéo :
|
||||
|
||||
```
|
||||
listen:
|
||||
-
|
||||
port: 5222
|
||||
ip: "::"
|
||||
module: ejabberd_c2s
|
||||
max_stanza_size: 262144
|
||||
shaper: c2s_shaper
|
||||
access: c2s
|
||||
starttls_required: true
|
||||
protocol_options: 'TLS_OPTIONS'
|
||||
-
|
||||
port: 5223
|
||||
ip: "::"
|
||||
module: ejabberd_c2s
|
||||
max_stanza_size: 262144
|
||||
shaper: c2s_shaper
|
||||
access: c2s
|
||||
tls: true
|
||||
protocol_options: 'TLS_OPTIONS'
|
||||
-
|
||||
port: 5269
|
||||
ip: "::"
|
||||
module: ejabberd_s2s_in
|
||||
max_stanza_size: 524288
|
||||
-
|
||||
port: 5443
|
||||
ip: "::"
|
||||
module: ejabberd_http
|
||||
tls: true
|
||||
protocol_options: 'TLS_OPTIONS'
|
||||
request_handlers:
|
||||
/api: mod_http_api
|
||||
/bosh: mod_bosh
|
||||
/captcha: ejabberd_captcha
|
||||
/upload: mod_http_upload
|
||||
/ws: ejabberd_http_ws
|
||||
custom_headers:
|
||||
"Access-Control-Allow-Origin": "*"
|
||||
"Access-Control-Allow-Methods": "OPTIONS, HEAD, GET, PUT"
|
||||
"Access-Control-Allow-Headers": "Authorization"
|
||||
"Access-Control-Allow-Credentials": "true"
|
||||
-
|
||||
port: 5280
|
||||
ip: "::"
|
||||
module: ejabberd_http
|
||||
tls: true
|
||||
protocol_options: 'TLS_OPTIONS'
|
||||
request_handlers:
|
||||
/admin: ejabberd_web_admin
|
||||
-
|
||||
port: 3478
|
||||
ip: "::"
|
||||
transport: udp
|
||||
module: ejabberd_stun
|
||||
use_turn: true
|
||||
## The server's public IPv4 address:
|
||||
turn_ipv4_address: "80.67.176.33"
|
||||
## The server's public IPv6 address:
|
||||
turn_ipv6_address: "2001:910:1021::211"
|
||||
```
|
||||
|
||||
On active SCRAM pour les mots de passes utilisateurs et STARTTLS pour les connexions S2S :
|
||||
|
||||
```
|
||||
s2s_use_starttls: required
|
||||
|
||||
## Store the plain passwords or hashed for SCRAM:
|
||||
auth_password_format: scram
|
||||
```
|
||||
|
||||
On met aussi en place la connexion à la base de données pour ejabberd :
|
||||
|
||||
```
|
||||
auth_method: sql
|
||||
|
||||
sql_type: pgsql
|
||||
sql_server: "localhost"
|
||||
sql_database: "ejabberd"
|
||||
sql_username: "ejabberd"
|
||||
sql_password: "XXXXXXXXXXXXXXXXXXXXX"
|
||||
|
||||
sql_pool_size: 10
|
||||
new_sql_schema: true
|
||||
default_db: sql
|
||||
```
|
||||
|
||||
|
||||
On paramètre les quotas pour le téléversement de fichiers :
|
||||
|
||||
```
|
||||
shaper_rules:
|
||||
max_user_sessions: 10
|
||||
max_user_offline_messages:
|
||||
50000: admin
|
||||
5000: all
|
||||
c2s_shaper:
|
||||
none: admin
|
||||
normal: all
|
||||
s2s_shaper: fast
|
||||
|
||||
mod_http_upload:
|
||||
host: "xmpp.a-lec.org"
|
||||
put_url: "https://xmpp.a-lec.org:5443/upload"
|
||||
get_url: "https://xmpp.a-lec.org:5443/upload"
|
||||
docroot: /var/www/upload
|
||||
max_size: 500000000 # 250 MB
|
||||
file_mode: "0644"
|
||||
dir_mode: "2755"
|
||||
secret_length: 20
|
||||
jid_in_url: sha1
|
||||
custom_headers:
|
||||
"Access-Control-Allow-Origin": "https://@HOST@"
|
||||
"Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS"
|
||||
"Access-Control-Allow-Headers": "Content-Type"
|
||||
```
|
||||
|
||||
On paramètre les accès aux salons de discussion :
|
||||
```
|
||||
mod_muc:
|
||||
hosts: ["salons.a-lec.org"]
|
||||
access:
|
||||
- deny: banned_forever
|
||||
- deny: problematic_hosts
|
||||
- allow: all
|
||||
access_admin:
|
||||
- allow: admin
|
||||
access_create: muc_create
|
||||
access_persistent: muc_create
|
||||
access_mam:
|
||||
- allow
|
||||
default_room_options:
|
||||
mam: true
|
||||
lang: "fr"
|
||||
max_users: 500
|
||||
```
|
||||
|
||||
|
||||
On corrige la configuration de PEP :
|
||||
```
|
||||
mod_pubsub:
|
||||
hosts:
|
||||
- "pubsub.@HOST@"
|
||||
- "news.@HOST@"
|
||||
- "comments.@HOST@"
|
||||
access_createnode: pubsub_createnode
|
||||
ignore_pep_from_offline: false
|
||||
last_item_cache: false
|
||||
max_items_node: 1000
|
||||
default_node_config:
|
||||
max_items: 1000
|
||||
plugins:
|
||||
- flat
|
||||
- pep
|
||||
force_node_config:
|
||||
"eu.siacs.conversations.axolotl.*":
|
||||
access_model: open
|
||||
## Avoid buggy clients to make their bookmarks public
|
||||
storage:bookmarks:
|
||||
access_model: whitelist
|
||||
"urn:xmpp:bookmarks:0":
|
||||
access_model: whitelist
|
||||
send_last_published_item: never
|
||||
persist_items: true
|
||||
max_items: infinity
|
||||
"urn:xmpp:bookmarks:1":
|
||||
access_model: whitelist
|
||||
send_last_published_item: never
|
||||
persist_items: true
|
||||
max_items: infinity
|
||||
"urn:xmpp:pubsub:movim-public-subscription":
|
||||
access_model: whitelist
|
||||
persist_items: true
|
||||
max_items: infinity
|
||||
"storage:bookmarks":
|
||||
access_model: whitelist
|
||||
"urn:xmpp:microblog:0":
|
||||
max_items: infinity
|
||||
access_model: presence
|
||||
notify_retract: true
|
||||
persist_items: true
|
||||
"urn:xmpp:microblog:0:comments*":
|
||||
max_items: infinity
|
||||
access_model: open
|
||||
notify_retract: true
|
||||
persist_items: true
|
||||
```
|
||||
|
||||
Et enfin, pour que les appels audio/vidéo fonctionnent correctement :
|
||||
|
||||
```
|
||||
mod_stun_disco: {}
|
||||
```
|
||||
|
||||
Une fois la configuration effectuée on recharge ejabberd avec :
|
||||
|
||||
```
|
||||
sudo ejabberdctl reload_config
|
||||
```
|
||||
|
||||
Le débogage peut se faire à l'aide du fichier journal `/var/log/ejabberd/ejabberd.log`.
|
||||
|
||||
## Création d'un premier compte
|
||||
|
||||
```
|
||||
sudo ejabberdctl register admin@chalec.org mot_de_passe
|
||||
```
|
||||
|
|
|
|||
Loading…
Reference in New Issue