From 923dfb49df8e3a094d19ca984fdc822cb8d1e294 Mon Sep 17 00:00:00 2001
From: Alexander Dahl <post@lespocky.de>
Date: Fri, 18 Nov 2022 09:30:12 +0100
Subject: [PATCH 1/8] :bento: prosody: Import existing configuration files

No changes reported by ansible to what's currently deployed.
---
 host-pottwal.yml                           |  30 +++
 templates/prosody/jabber.n39.eu.cfg.lua.j2 |  36 ++++
 templates/prosody/localhost.cfg.lua.j2     |   5 +
 templates/prosody/prosody.cfg.lua.j2       | 227 +++++++++++++++++++++
 4 files changed, 298 insertions(+)
 create mode 100644 templates/prosody/jabber.n39.eu.cfg.lua.j2
 create mode 100644 templates/prosody/localhost.cfg.lua.j2
 create mode 100644 templates/prosody/prosody.cfg.lua.j2

diff --git a/host-pottwal.yml b/host-pottwal.yml
index 4d910f0..0668636 100644
--- a/host-pottwal.yml
+++ b/host-pottwal.yml
@@ -125,6 +125,36 @@
         msg: "prosody data dir is missing, please restore from the backup!"
       when: not prosody_dir.stat.exists
 
+    - name: Ensure prosody main config file is in place
+      ansible.builtin.template:
+        src: "templates/prosody/prosody.cfg.lua.j2"
+        dest: "{{ prosody_data_dir }}/etc/prosody/prosody.cfg.lua"
+        mode: 0644
+
+    - name: Ensure prosody localhost config file is in place
+      ansible.builtin.template:
+        src: "templates/prosody/localhost.cfg.lua.j2"
+        dest: "{{ prosody_data_dir }}/etc/prosody/conf.avail/localhost.cfg.lua"
+        mode: 0644
+
+    - name: Ensure prosody localhost config symlink exists
+      ansible.builtin.file:
+        src: "../conf.avail/localhost.cfg.lua"
+        dest: "{{ prosody_data_dir }}/etc/prosody/conf.d/localhost.cfg.lua"
+        state: link
+
+    - name: "Ensure prosody {{ prosody_domain_name }} config file is in place"
+      ansible.builtin.template:
+        src: "templates/prosody/{{ prosody_domain_name }}.cfg.lua.j2"
+        dest: "{{ prosody_data_dir }}/etc/prosody/conf.avail/{{ prosody_domain_name }}.cfg.lua"
+        mode: 0644
+
+    - name: "Ensure prosody {{ prosody_domain_name }} config symlink exists"
+      ansible.builtin.file:
+        src: "../conf.avail/{{ prosody_domain_name }}.cfg.lua"
+        dest: "{{ prosody_data_dir }}/etc/prosody/conf.d/{{ prosody_domain_name }}.cfg.lua"
+        state: link
+
     - name: Ensure container for prosody XMPP server is running
       docker_container:
         name: prosody
diff --git a/templates/prosody/jabber.n39.eu.cfg.lua.j2 b/templates/prosody/jabber.n39.eu.cfg.lua.j2
new file mode 100644
index 0000000..47d99ef
--- /dev/null
+++ b/templates/prosody/jabber.n39.eu.cfg.lua.j2
@@ -0,0 +1,36 @@
+-- Section for example.com
+
+VirtualHost "jabber.n39.eu"
+
+	-- Assign this host a certificate for TLS, otherwise it would use the one
+	-- set in the global section (if any).
+	-- Note that old-style SSL on port 5223 only supports one certificate, and will always
+	-- use the global one.
+	ssl = {
+		key = "/etc/prosody/certs/jabber.n39.eu.key";
+		certificate = "/etc/prosody/certs/jabber.n39.eu.pem";
+		dhparam = "/etc/prosody/certs/dh-2048.pem";
+		-- TODO	for post 0.10 see http://prosody.im/doc/advanced_ssl_config again
+		options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" };
+	}
+
+------ Components ------
+-- You can specify components to add hosts that provide special services,
+-- like multi-user conferences, and transports.
+-- For more information on components, see http://prosody.im/doc/components
+
+-- Set up a MUC (multi-user chat) room server on conference.example.com:
+--Component "conference.example.com" "muc"
+Component "conference.jabber.n39.eu" "muc"
+
+-- Set up a SOCKS5 bytestream proxy for server-proxied file transfers:
+--Component "proxy.example.com" "proxy65"
+
+---Set up an external component (default component port is 5347)
+--Component "gateway.example.com"
+--	component_secret = "password"
+
+-- alex: service discovery
+disco_items = {
+	{ "conference.jabber.n39.eu", "The Netz39 Multi-User-Chat" };
+}
diff --git a/templates/prosody/localhost.cfg.lua.j2 b/templates/prosody/localhost.cfg.lua.j2
new file mode 100644
index 0000000..38a6655
--- /dev/null
+++ b/templates/prosody/localhost.cfg.lua.j2
@@ -0,0 +1,5 @@
+-- Section for localhost
+
+-- This allows clients to connect to localhost. No harm in it.
+VirtualHost "localhost"
+
diff --git a/templates/prosody/prosody.cfg.lua.j2 b/templates/prosody/prosody.cfg.lua.j2
new file mode 100644
index 0000000..59a2521
--- /dev/null
+++ b/templates/prosody/prosody.cfg.lua.j2
@@ -0,0 +1,227 @@
+-- Prosody Example Configuration File
+--
+-- Information on configuring Prosody can be found on our
+-- website at http://prosody.im/doc/configure
+--
+-- Tip: You can check that the syntax of this file is correct
+-- when you have finished by running: luac -p prosody.cfg.lua
+-- If there are any errors, it will let you know what and where
+-- they are, otherwise it will keep quiet.
+--
+-- The only thing left to do is rename this file to remove the .dist ending, and fill in the
+-- blanks. Good luck, and happy Jabbering!
+
+
+---------- Server-wide settings ----------
+-- Settings in this section apply to the whole server and are the default settings
+-- for any virtual hosts
+
+-- This is a (by default, empty) list of accounts that are admins
+-- for the server. Note that you must create the accounts separately
+-- (see http://prosody.im/doc/creating_accounts for info)
+-- Example: admins = { "user1@example.com", "user2@example.net" }
+admins = { "alex@jabber.n39.eu", "tux@jabber.n39.eu" }
+
+-- Enable use of libevent for better performance under high load
+-- For more information see: http://prosody.im/doc/libevent
+use_libevent = true;
+
+-- This is the list of modules Prosody will load on startup.
+-- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too.
+-- Documentation on modules can be found at: http://prosody.im/doc/modules
+modules_enabled = {
+
+	-- Generally required
+		"roster"; -- Allow users to have a roster. Recommended ;)
+		"saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
+		"tls"; -- Add support for secure TLS on c2s/s2s connections
+		"dialback"; -- s2s dialback support
+		"disco"; -- Service discovery
+
+	-- Not essential, but recommended
+		"private"; -- Private XML storage (for room bookmarks, etc.)
+		"vcard"; -- Allow users to set vCards
+	
+	-- These are commented by default as they have a performance impact
+		"privacy"; -- Support privacy lists
+		"compression"; -- Stream compression (Debian: requires lua-zlib module to work)
+
+	-- Nice to have
+		"version"; -- Replies to server version requests
+		"uptime"; -- Report how long server has been running
+		"time"; -- Let others know the time here on this server
+		"ping"; -- Replies to XMPP pings with pongs
+		"pep"; -- Enables users to publish their mood, activity, playing music and more
+		"register"; -- Allow users to register on this server using a client and change passwords
+
+	-- Admin interfaces
+		"admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands
+		"admin_telnet"; -- Opens telnet console interface on localhost port 5582
+	
+	-- HTTP modules
+		--"bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
+		--"http_files"; -- Serve static files from a directory over HTTP
+
+	-- Other specific functionality
+		"posix"; -- POSIX functionality, sends server to background, enables syslog, etc.
+		--"groups"; -- Shared roster support
+		"announce"; -- Send announcement to all online users
+		--"welcome"; -- Welcome users who register accounts
+		"watchregistrations"; -- Alert admins of registrations
+		--"motd"; -- Send a message to users when they log in
+		--"legacyauth"; -- Legacy authentication. Only used by some old clients and bots.
+
+	-- alex
+		"smacks";	-- XEP-0198: Stream Management
+		"carbons";	-- XEP-0280: Message Carbons
+
+		"csi";		-- XEP-0352: Client State Indication
+		"csi_compat";
+		"throttle_presence";
+		--"filter_chatstates";	-- triggers https://prosody.im/issues/issue/648 pre 0.9.11
+		"graceful_shutdown";
+		"blocking";	-- XEP-0191: Simple Communications Blocking
+};
+
+-- These modules are auto-loaded, but should you want
+-- to disable them then uncomment them here:
+modules_disabled = {
+	-- "offline"; -- Store offline messages
+	-- "c2s"; -- Handle client connections
+	-- "s2s"; -- Handle server-to-server connections
+};
+
+-- Disable account creation by default, for security
+-- For more information see http://prosody.im/doc/creating_accounts
+allow_registration = false;
+registration_blacklist = { "127.0.0.1" };
+min_seconds_between_registrations = 3600; -- Clients must wait 1 hour before they can register another account
+
+-- Debian:
+--   send the server to background.
+--
+daemonize = true;
+
+-- Debian:
+--   Please, don't change this option since /var/run/prosody/
+--   is one of the few directories Prosody is allowed to write to
+--
+pidfile = "/var/run/prosody/prosody.pid";
+
+-- These are the SSL/TLS-related settings. If you don't want
+-- to use SSL/TLS, you may comment or remove this
+ssl = {
+	key = "/etc/prosody/certs/localhost.key";
+	certificate = "/etc/prosody/certs/localhost.crt";
+	dhparam = "/etc/prosody/certs/dh-2048.pem";
+	-- TODO	for post 0.10 see http://prosody.im/doc/advanced_ssl_config again
+	options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" };
+}
+
+-- Force clients to use encrypted connections? This option will
+-- prevent clients from authenticating unless they are using encryption.
+
+c2s_require_encryption = true
+
+-- Force certificate authentication for server-to-server connections?
+-- This provides ideal security, but requires servers you communicate
+-- with to support encryption AND present valid, trusted certificates.
+-- NOTE: Your version of LuaSec must support certificate verification!
+-- For more information see http://prosody.im/doc/s2s#security
+
+s2s_secure_auth = false
+
+-- Many servers don't support encryption or have invalid or self-signed
+-- certificates. You can list domains here that will not be required to
+-- authenticate using certificates. They will be authenticated using DNS.
+
+--s2s_insecure_domains = { "gmail.com" }
+
+-- Even if you leave s2s_secure_auth disabled, you can still require valid
+-- certificates for some domains by specifying a list here.
+
+--s2s_secure_domains = { "jabber.org" }
+
+-- Select the authentication backend to use. The 'internal' providers
+-- use Prosody's configured data storage to store the authentication data.
+-- To allow Prosody to offer secure authentication mechanisms to clients, the
+-- default provider stores passwords in plaintext. If you do not trust your
+-- server please see http://prosody.im/doc/modules/mod_auth_internal_hashed
+-- for information about using the hashed backend.
+
+authentication = "internal_hashed"
+
+-- Select the storage backend to use. By default Prosody uses flat files
+-- in its configured data directory, but it also supports more backends
+-- through modules. An "sql" backend is included by default, but requires
+-- additional dependencies. See http://prosody.im/doc/storage for more info.
+
+storage = "sql" -- Default is "internal" (Debian: "sql" requires one of the
+-- lua-dbi-sqlite3, lua-dbi-mysql or lua-dbi-postgresql packages to work)
+
+-- For the "sql" backend, you can uncomment *one* of the below to configure:
+sql = { driver = "SQLite3", database = "prosody.sqlite" } -- Default. 'database' is the filename.
+--sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
+--sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
+
+-- Logging configuration
+-- For advanced logging see http://prosody.im/doc/logging
+--
+-- Debian:
+--  Logs info and higher to /var/log
+--  Logs errors to syslog also
+log = {
+	-- Log files (change 'info' to 'debug' for debug logs):
+	info = "/var/log/prosody/prosody.log";
+	error = "/var/log/prosody/prosody.err";
+	-- Syslog:
+	{ levels = { "error" }; to = "syslog";  };
+}
+
+-- alex: security stuff, see 
+-- http://blog.prosody.im/mandatory-encryption-on-xmpp-starts-today/
+-- http://wiki.xmpp.org/web/Securing_XMPP and http://xmpp.net/
+s2s_require_encryption = true
+
+----------- Virtual hosts -----------
+-- You need to add a VirtualHost entry for each domain you wish Prosody to serve.
+-- Settings under each VirtualHost entry apply *only* to that host.
+
+VirtualHost "example.com"
+	enabled = false -- Remove this line to enable this host
+
+	-- Assign this host a certificate for TLS, otherwise it would use the one
+	-- set in the global section (if any).
+	-- Note that old-style SSL on port 5223 only supports one certificate, and will always
+	-- use the global one.
+	ssl = {
+		key = "/etc/prosody/certs/example.com.key";
+		certificate = "/etc/prosody/certs/example.com.crt";
+	}
+
+------ Components ------
+-- You can specify components to add hosts that provide special services,
+-- like multi-user conferences, and transports.
+-- For more information on components, see http://prosody.im/doc/components
+
+---Set up a MUC (multi-user chat) room server on conference.example.com:
+--Component "conference.example.com" "muc"
+
+-- Set up a SOCKS5 bytestream proxy for server-proxied file transfers:
+--Component "proxy.example.com" "proxy65"
+
+---Set up an external component (default component port is 5347)
+--
+-- External components allow adding various services, such as gateways/
+-- transports to other networks like ICQ, MSN and Yahoo. For more info
+-- see: http://prosody.im/doc/components#adding_an_external_component
+--
+--Component "gateway.example.com"
+--	component_secret = "password"
+
+------ Additional config files ------
+-- For organizational purposes you may prefer to add VirtualHost and
+-- Component definitions in their own config files. This line includes
+-- all config files in /etc/prosody/conf.d/
+
+Include "conf.d/*.cfg.lua"

From fa811dd7876fd7fec01f0d6597323a66cdfa3575 Mon Sep 17 00:00:00 2001
From: Alexander Dahl <post@lespocky.de>
Date: Tue, 20 Dec 2022 09:33:34 +0100
Subject: [PATCH 2/8] :ok_hand: prosody: Use plain file instead of template

No need to run the template engine, if no replacements are done.

Suggested-by: David Kilias <dkdent@netz39.de>
---
 .../prosody/jabber.n39.eu.cfg.lua                    |  0
 .../prosody/localhost.cfg.lua                        |  0
 host-pottwal.yml                                     | 12 ++++++------
 3 files changed, 6 insertions(+), 6 deletions(-)
 rename templates/prosody/jabber.n39.eu.cfg.lua.j2 => files/prosody/jabber.n39.eu.cfg.lua (100%)
 rename templates/prosody/localhost.cfg.lua.j2 => files/prosody/localhost.cfg.lua (100%)

diff --git a/templates/prosody/jabber.n39.eu.cfg.lua.j2 b/files/prosody/jabber.n39.eu.cfg.lua
similarity index 100%
rename from templates/prosody/jabber.n39.eu.cfg.lua.j2
rename to files/prosody/jabber.n39.eu.cfg.lua
diff --git a/templates/prosody/localhost.cfg.lua.j2 b/files/prosody/localhost.cfg.lua
similarity index 100%
rename from templates/prosody/localhost.cfg.lua.j2
rename to files/prosody/localhost.cfg.lua
diff --git a/host-pottwal.yml b/host-pottwal.yml
index 0668636..9eb30f7 100644
--- a/host-pottwal.yml
+++ b/host-pottwal.yml
@@ -132,8 +132,8 @@
         mode: 0644
 
     - name: Ensure prosody localhost config file is in place
-      ansible.builtin.template:
-        src: "templates/prosody/localhost.cfg.lua.j2"
+      ansible.builtin.copy:
+        src: "files/prosody/localhost.cfg.lua"
         dest: "{{ prosody_data_dir }}/etc/prosody/conf.avail/localhost.cfg.lua"
         mode: 0644
 
@@ -143,13 +143,13 @@
         dest: "{{ prosody_data_dir }}/etc/prosody/conf.d/localhost.cfg.lua"
         state: link
 
-    - name: "Ensure prosody {{ prosody_domain_name }} config file is in place"
-      ansible.builtin.template:
-        src: "templates/prosody/{{ prosody_domain_name }}.cfg.lua.j2"
+    - name: "Ensure prosody config file is in place: {{ prosody_domain_name }}"
+      ansible.builtin.copy:
+        src: "files/prosody/{{ prosody_domain_name }}.cfg.lua"
         dest: "{{ prosody_data_dir }}/etc/prosody/conf.avail/{{ prosody_domain_name }}.cfg.lua"
         mode: 0644
 
-    - name: "Ensure prosody {{ prosody_domain_name }} config symlink exists"
+    - name: "Ensure prosody config symlink exists: {{ prosody_domain_name }}"
       ansible.builtin.file:
         src: "../conf.avail/{{ prosody_domain_name }}.cfg.lua"
         dest: "{{ prosody_data_dir }}/etc/prosody/conf.d/{{ prosody_domain_name }}.cfg.lua"

From 2c0d00bc280ef0add3295180cf0cdf8b296f3fe1 Mon Sep 17 00:00:00 2001
From: Alexander Dahl <post@lespocky.de>
Date: Tue, 20 Dec 2022 09:36:42 +0100
Subject: [PATCH 3/8] :wrench: prosody: Use ansible variable in main config
 template

---
 templates/prosody/prosody.cfg.lua.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/prosody/prosody.cfg.lua.j2 b/templates/prosody/prosody.cfg.lua.j2
index 59a2521..604254f 100644
--- a/templates/prosody/prosody.cfg.lua.j2
+++ b/templates/prosody/prosody.cfg.lua.j2
@@ -20,7 +20,7 @@
 -- for the server. Note that you must create the accounts separately
 -- (see http://prosody.im/doc/creating_accounts for info)
 -- Example: admins = { "user1@example.com", "user2@example.net" }
-admins = { "alex@jabber.n39.eu", "tux@jabber.n39.eu" }
+admins = { "alex@{{ prosody_domain_name }}", "tux@{{ prosody_domain_name }}" }
 
 -- Enable use of libevent for better performance under high load
 -- For more information see: http://prosody.im/doc/libevent

From bd8500bf3a0d7883e04585b06ed32cab9b83ac41 Mon Sep 17 00:00:00 2001
From: Alexander Dahl <post@lespocky.de>
Date: Tue, 20 Dec 2022 09:56:07 +0100
Subject: [PATCH 4/8] :wrench: prosody: Rework configuration for prosody v0.11

The previous configuration was copied over from helium.n39.eu for
prosody v0.9 and did only work more or less by accident.  The new
configuration was done based on the upstream example configuration.

Some modules we used for 0.9 were replaced, some are not necessary
anymore, some modules are new for 0.11.  The list was reviewed carefully
on a test host, and proved to work for several months there.

The VirtualHost 'localhost' is kept, but moved from a separate
configuration file to the main configuration, because it's only one line
and it's part of the example config anyways.
---
 files/prosody/localhost.cfg.lua      |   5 -
 host-pottwal.yml                     |  12 --
 templates/prosody/prosody.cfg.lua.j2 | 187 +++++++++++++--------------
 3 files changed, 90 insertions(+), 114 deletions(-)
 delete mode 100644 files/prosody/localhost.cfg.lua

diff --git a/files/prosody/localhost.cfg.lua b/files/prosody/localhost.cfg.lua
deleted file mode 100644
index 38a6655..0000000
--- a/files/prosody/localhost.cfg.lua
+++ /dev/null
@@ -1,5 +0,0 @@
--- Section for localhost
-
--- This allows clients to connect to localhost. No harm in it.
-VirtualHost "localhost"
-
diff --git a/host-pottwal.yml b/host-pottwal.yml
index 9eb30f7..cb91aa0 100644
--- a/host-pottwal.yml
+++ b/host-pottwal.yml
@@ -131,18 +131,6 @@
         dest: "{{ prosody_data_dir }}/etc/prosody/prosody.cfg.lua"
         mode: 0644
 
-    - name: Ensure prosody localhost config file is in place
-      ansible.builtin.copy:
-        src: "files/prosody/localhost.cfg.lua"
-        dest: "{{ prosody_data_dir }}/etc/prosody/conf.avail/localhost.cfg.lua"
-        mode: 0644
-
-    - name: Ensure prosody localhost config symlink exists
-      ansible.builtin.file:
-        src: "../conf.avail/localhost.cfg.lua"
-        dest: "{{ prosody_data_dir }}/etc/prosody/conf.d/localhost.cfg.lua"
-        state: link
-
     - name: "Ensure prosody config file is in place: {{ prosody_domain_name }}"
       ansible.builtin.copy:
         src: "files/prosody/{{ prosody_domain_name }}.cfg.lua"
diff --git a/templates/prosody/prosody.cfg.lua.j2 b/templates/prosody/prosody.cfg.lua.j2
index 604254f..1545068 100644
--- a/templates/prosody/prosody.cfg.lua.j2
+++ b/templates/prosody/prosody.cfg.lua.j2
@@ -1,15 +1,18 @@
--- Prosody Example Configuration File
+-- When running in Docker do not daemonize (for nice shutdown, logging etc.)
+daemonize = false;
+
+-- Prosody XMPP Server Configuration
 --
 -- Information on configuring Prosody can be found on our
--- website at http://prosody.im/doc/configure
+-- website at https://prosody.im/doc/configure
 --
 -- Tip: You can check that the syntax of this file is correct
--- when you have finished by running: luac -p prosody.cfg.lua
+-- when you have finished by running this command:
+--     prosodyctl check config
 -- If there are any errors, it will let you know what and where
 -- they are, otherwise it will keep quiet.
 --
--- The only thing left to do is rename this file to remove the .dist ending, and fill in the
--- blanks. Good luck, and happy Jabbering!
+-- Good luck, and happy Jabbering!
 
 
 ---------- Server-wide settings ----------
@@ -18,17 +21,22 @@
 
 -- This is a (by default, empty) list of accounts that are admins
 -- for the server. Note that you must create the accounts separately
--- (see http://prosody.im/doc/creating_accounts for info)
+-- (see https://prosody.im/doc/creating_accounts for info)
 -- Example: admins = { "user1@example.com", "user2@example.net" }
 admins = { "alex@{{ prosody_domain_name }}", "tux@{{ prosody_domain_name }}" }
 
 -- Enable use of libevent for better performance under high load
--- For more information see: http://prosody.im/doc/libevent
-use_libevent = true;
+-- For more information see: https://prosody.im/doc/libevent
+use_libevent = true
+
+-- Prosody will always look in its source directory for modules, but
+-- this option allows you to specify additional locations where Prosody
+-- will look for modules first. For community modules, see https://modules.prosody.im/
+plugin_paths = { "/usr/local/lib/prosody-modules" }
 
 -- This is the list of modules Prosody will load on startup.
 -- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too.
--- Documentation on modules can be found at: http://prosody.im/doc/modules
+-- Documentation for bundled modules can be found at: https://prosody.im/doc/modules
 modules_enabled = {
 
 	-- Generally required
@@ -39,49 +47,48 @@ modules_enabled = {
 		"disco"; -- Service discovery
 
 	-- Not essential, but recommended
+		"carbons"; -- Keep multiple clients in sync
+		"pep"; -- Enables users to publish their avatar, mood, activity, playing music and more
 		"private"; -- Private XML storage (for room bookmarks, etc.)
-		"vcard"; -- Allow users to set vCards
-	
-	-- These are commented by default as they have a performance impact
-		"privacy"; -- Support privacy lists
-		"compression"; -- Stream compression (Debian: requires lua-zlib module to work)
+		"blocklist"; -- Allow users to block communications with other users
+		"vcard4"; -- User profiles (stored in PEP)
+		"vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard
 
 	-- Nice to have
 		"version"; -- Replies to server version requests
 		"uptime"; -- Report how long server has been running
 		"time"; -- Let others know the time here on this server
 		"ping"; -- Replies to XMPP pings with pongs
-		"pep"; -- Enables users to publish their mood, activity, playing music and more
 		"register"; -- Allow users to register on this server using a client and change passwords
+		--"mam"; -- Store messages in an archive and allow users to access it
+		--"csi_simple"; -- Simple Mobile optimizations
 
 	-- Admin interfaces
 		"admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands
 		"admin_telnet"; -- Opens telnet console interface on localhost port 5582
-	
+
 	-- HTTP modules
 		--"bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
+		--"websocket"; -- XMPP over WebSockets
 		--"http_files"; -- Serve static files from a directory over HTTP
 
 	-- Other specific functionality
-		"posix"; -- POSIX functionality, sends server to background, enables syslog, etc.
+		--"limits"; -- Enable bandwidth limiting for XMPP connections
 		--"groups"; -- Shared roster support
+		--"server_contact_info"; -- Publish contact information for this service
 		"announce"; -- Send announcement to all online users
 		--"welcome"; -- Welcome users who register accounts
 		"watchregistrations"; -- Alert admins of registrations
 		--"motd"; -- Send a message to users when they log in
 		--"legacyauth"; -- Legacy authentication. Only used by some old clients and bots.
+		--"proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use
 
 	-- alex
-		"smacks";	-- XEP-0198: Stream Management
-		"carbons";	-- XEP-0280: Message Carbons
-
-		"csi";		-- XEP-0352: Client State Indication
-		"csi_compat";
-		"throttle_presence";
-		--"filter_chatstates";	-- triggers https://prosody.im/issues/issue/648 pre 0.9.11
+		"smacks";       -- XEP-0198: Stream Management
+		"csi";          -- XEP-0352: Client State Indication
+		"csi_battery_saver";
 		"graceful_shutdown";
-		"blocking";	-- XEP-0191: Simple Communications Blocking
-};
+}
 
 -- These modules are auto-loaded, but should you want
 -- to disable them then uncomment them here:
@@ -89,132 +96,118 @@ modules_disabled = {
 	-- "offline"; -- Store offline messages
 	-- "c2s"; -- Handle client connections
 	-- "s2s"; -- Handle server-to-server connections
-};
+	-- "posix"; -- POSIX functionality, sends server to background, enables syslog, etc.
+}
 
 -- Disable account creation by default, for security
--- For more information see http://prosody.im/doc/creating_accounts
-allow_registration = false;
-registration_blacklist = { "127.0.0.1" };
-min_seconds_between_registrations = 3600; -- Clients must wait 1 hour before they can register another account
-
--- Debian:
---   send the server to background.
---
-daemonize = true;
-
--- Debian:
---   Please, don't change this option since /var/run/prosody/
---   is one of the few directories Prosody is allowed to write to
---
-pidfile = "/var/run/prosody/prosody.pid";
-
--- These are the SSL/TLS-related settings. If you don't want
--- to use SSL/TLS, you may comment or remove this
-ssl = {
-	key = "/etc/prosody/certs/localhost.key";
-	certificate = "/etc/prosody/certs/localhost.crt";
-	dhparam = "/etc/prosody/certs/dh-2048.pem";
-	-- TODO	for post 0.10 see http://prosody.im/doc/advanced_ssl_config again
-	options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" };
-}
+-- For more information see https://prosody.im/doc/creating_accounts
+allow_registration = false
 
 -- Force clients to use encrypted connections? This option will
 -- prevent clients from authenticating unless they are using encryption.
 
 c2s_require_encryption = true
 
+-- Force servers to use encrypted connections? This option will
+-- prevent servers from authenticating unless they are using encryption.
+
+s2s_require_encryption = true
+
 -- Force certificate authentication for server-to-server connections?
--- This provides ideal security, but requires servers you communicate
--- with to support encryption AND present valid, trusted certificates.
--- NOTE: Your version of LuaSec must support certificate verification!
--- For more information see http://prosody.im/doc/s2s#security
 
 s2s_secure_auth = false
 
--- Many servers don't support encryption or have invalid or self-signed
--- certificates. You can list domains here that will not be required to
--- authenticate using certificates. They will be authenticated using DNS.
+-- Some servers have invalid or self-signed certificates. You can list
+-- remote domains here that will not be required to authenticate using
+-- certificates. They will be authenticated using DNS instead, even
+-- when s2s_secure_auth is enabled.
 
---s2s_insecure_domains = { "gmail.com" }
+--s2s_insecure_domains = { "insecure.example" }
 
--- Even if you leave s2s_secure_auth disabled, you can still require valid
+-- Even if you disable s2s_secure_auth, you can still require valid
 -- certificates for some domains by specifying a list here.
 
 --s2s_secure_domains = { "jabber.org" }
 
+-- Required for init scripts and prosodyctl
+pidfile = "/var/run/prosody/prosody.pid"
+
 -- Select the authentication backend to use. The 'internal' providers
 -- use Prosody's configured data storage to store the authentication data.
--- To allow Prosody to offer secure authentication mechanisms to clients, the
--- default provider stores passwords in plaintext. If you do not trust your
--- server please see http://prosody.im/doc/modules/mod_auth_internal_hashed
--- for information about using the hashed backend.
 
 authentication = "internal_hashed"
 
 -- Select the storage backend to use. By default Prosody uses flat files
 -- in its configured data directory, but it also supports more backends
 -- through modules. An "sql" backend is included by default, but requires
--- additional dependencies. See http://prosody.im/doc/storage for more info.
+-- additional dependencies. See https://prosody.im/doc/storage for more info.
 
-storage = "sql" -- Default is "internal" (Debian: "sql" requires one of the
--- lua-dbi-sqlite3, lua-dbi-mysql or lua-dbi-postgresql packages to work)
+storage = "sql" -- Default is "internal"
 
 -- For the "sql" backend, you can uncomment *one* of the below to configure:
 sql = { driver = "SQLite3", database = "prosody.sqlite" } -- Default. 'database' is the filename.
 --sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
 --sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
 
+
+-- Archiving configuration
+-- If mod_mam is enabled, Prosody will store a copy of every message. This
+-- is used to synchronize conversations between multiple clients, even if
+-- they are offline. This setting controls how long Prosody will keep
+-- messages in the archive before removing them.
+
+archive_expires_after = "1w" -- Remove archived messages after 1 week
+
+-- You can also configure messages to be stored in-memory only. For more
+-- archiving options, see https://prosody.im/doc/modules/mod_mam
+
 -- Logging configuration
--- For advanced logging see http://prosody.im/doc/logging
---
--- Debian:
---  Logs info and higher to /var/log
---  Logs errors to syslog also
+-- For advanced logging see https://prosody.im/doc/logging
 log = {
-	-- Log files (change 'info' to 'debug' for debug logs):
-	info = "/var/log/prosody/prosody.log";
-	error = "/var/log/prosody/prosody.err";
-	-- Syslog:
-	{ levels = { "error" }; to = "syslog";  };
+    {levels = {min = "info"}, to = "console"};
 }
 
--- alex: security stuff, see 
--- http://blog.prosody.im/mandatory-encryption-on-xmpp-starts-today/
--- http://wiki.xmpp.org/web/Securing_XMPP and http://xmpp.net/
-s2s_require_encryption = true
+-- Uncomment to enable statistics
+-- For more info see https://prosody.im/doc/statistics
+-- statistics = "internal"
+
+-- Certificates
+-- Every virtual host and component needs a certificate so that clients and
+-- servers can securely verify its identity. Prosody will automatically load
+-- certificates/keys from the directory specified here.
+-- For more information, including how to use 'prosodyctl' to auto-import certificates
+-- (from e.g. Let's Encrypt) see https://prosody.im/doc/certificates
+
+-- Location of directory to find certificates in (relative to main config file):
+certificates = "certs"
+
+-- HTTPS currently only supports a single certificate, specify it here:
+--https_certificate = "/etc/prosody/certs/localhost.crt"
 
 ----------- Virtual hosts -----------
 -- You need to add a VirtualHost entry for each domain you wish Prosody to serve.
 -- Settings under each VirtualHost entry apply *only* to that host.
 
-VirtualHost "example.com"
-	enabled = false -- Remove this line to enable this host
+VirtualHost "localhost"
 
-	-- Assign this host a certificate for TLS, otherwise it would use the one
-	-- set in the global section (if any).
-	-- Note that old-style SSL on port 5223 only supports one certificate, and will always
-	-- use the global one.
-	ssl = {
-		key = "/etc/prosody/certs/example.com.key";
-		certificate = "/etc/prosody/certs/example.com.crt";
-	}
+--VirtualHost "example.com"
+--	certificate = "/path/to/example.crt"
 
 ------ Components ------
 -- You can specify components to add hosts that provide special services,
 -- like multi-user conferences, and transports.
--- For more information on components, see http://prosody.im/doc/components
+-- For more information on components, see https://prosody.im/doc/components
 
 ---Set up a MUC (multi-user chat) room server on conference.example.com:
 --Component "conference.example.com" "muc"
-
--- Set up a SOCKS5 bytestream proxy for server-proxied file transfers:
---Component "proxy.example.com" "proxy65"
+--- Store MUC messages in an archive and allow users to access it
+--modules_enabled = { "muc_mam" }
 
 ---Set up an external component (default component port is 5347)
 --
 -- External components allow adding various services, such as gateways/
 -- transports to other networks like ICQ, MSN and Yahoo. For more info
--- see: http://prosody.im/doc/components#adding_an_external_component
+-- see: https://prosody.im/doc/components#adding_an_external_component
 --
 --Component "gateway.example.com"
 --	component_secret = "password"

From 55204a1b21a1febc09909a87b152c2075516f0a7 Mon Sep 17 00:00:00 2001
From: Alexander Dahl <post@lespocky.de>
Date: Tue, 20 Dec 2022 10:26:11 +0100
Subject: [PATCH 5/8] :wrench: prosody: Remove legacy TLS options

Connections to server failed after Let's Encrypt certificate renew.
---
 files/prosody/jabber.n39.eu.cfg.lua | 37 +++++++++++------------------
 1 file changed, 14 insertions(+), 23 deletions(-)

diff --git a/files/prosody/jabber.n39.eu.cfg.lua b/files/prosody/jabber.n39.eu.cfg.lua
index 47d99ef..5168396 100644
--- a/files/prosody/jabber.n39.eu.cfg.lua
+++ b/files/prosody/jabber.n39.eu.cfg.lua
@@ -1,36 +1,27 @@
--- Section for example.com
-
 VirtualHost "jabber.n39.eu"
-
-	-- Assign this host a certificate for TLS, otherwise it would use the one
-	-- set in the global section (if any).
-	-- Note that old-style SSL on port 5223 only supports one certificate, and will always
-	-- use the global one.
-	ssl = {
-		key = "/etc/prosody/certs/jabber.n39.eu.key";
-		certificate = "/etc/prosody/certs/jabber.n39.eu.pem";
-		dhparam = "/etc/prosody/certs/dh-2048.pem";
-		-- TODO	for post 0.10 see http://prosody.im/doc/advanced_ssl_config again
-		options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" };
-	}
+--	certificate = "/path/to/example.crt"
 
 ------ Components ------
 -- You can specify components to add hosts that provide special services,
 -- like multi-user conferences, and transports.
--- For more information on components, see http://prosody.im/doc/components
+-- For more information on components, see https://prosody.im/doc/components
 
--- Set up a MUC (multi-user chat) room server on conference.example.com:
+---Set up a MUC (multi-user chat) room server on conference.example.com:
 --Component "conference.example.com" "muc"
+--- Store MUC messages in an archive and allow users to access it
+--modules_enabled = { "muc_mam" }
 Component "conference.jabber.n39.eu" "muc"
 
--- Set up a SOCKS5 bytestream proxy for server-proxied file transfers:
---Component "proxy.example.com" "proxy65"
-
----Set up an external component (default component port is 5347)
---Component "gateway.example.com"
---	component_secret = "password"
-
 -- alex: service discovery
 disco_items = {
 	{ "conference.jabber.n39.eu", "The Netz39 Multi-User-Chat" };
 }
+
+---Set up an external component (default component port is 5347)
+--
+-- External components allow adding various services, such as gateways/
+-- transports to other networks like ICQ, MSN and Yahoo. For more info
+-- see: https://prosody.im/doc/components#adding_an_external_component
+--
+--Component "gateway.example.com"
+--	component_secret = "password"

From 1de850826f7dcf02e7318289338324c73ac337ad Mon Sep 17 00:00:00 2001
From: Alexander Dahl <alex@netz39.de>
Date: Tue, 20 Dec 2022 17:29:14 +0100
Subject: [PATCH 6/8] :ok_hand: pottwal: Add handler for prosody restart

The XMPP server should be restarted after the config has changed.

Suggested-by: Stefan Haun <tux@netz39.de>
---
 host-pottwal.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/host-pottwal.yml b/host-pottwal.yml
index cb91aa0..8803cff 100644
--- a/host-pottwal.yml
+++ b/host-pottwal.yml
@@ -130,18 +130,24 @@
         src: "templates/prosody/prosody.cfg.lua.j2"
         dest: "{{ prosody_data_dir }}/etc/prosody/prosody.cfg.lua"
         mode: 0644
+      notify:
+        - Restart prosody
 
     - name: "Ensure prosody config file is in place: {{ prosody_domain_name }}"
       ansible.builtin.copy:
         src: "files/prosody/{{ prosody_domain_name }}.cfg.lua"
         dest: "{{ prosody_data_dir }}/etc/prosody/conf.avail/{{ prosody_domain_name }}.cfg.lua"
         mode: 0644
+      notify:
+        - Restart prosody
 
     - name: "Ensure prosody config symlink exists: {{ prosody_domain_name }}"
       ansible.builtin.file:
         src: "../conf.avail/{{ prosody_domain_name }}.cfg.lua"
         dest: "{{ prosody_data_dir }}/etc/prosody/conf.d/{{ prosody_domain_name }}.cfg.lua"
         state: link
+      notify:
+        - Restart prosody
 
     - name: Ensure container for prosody XMPP server is running
       docker_container:
@@ -442,3 +448,8 @@
         proxy_preserve_host: "On"
 
   handlers:
+    - name: Restart prosody
+      community.docker.docker_container:
+        name: prosody
+        state: started
+        restart: yes

From 88e14f7ca699130df8acf7d356a61fbd13b8a5b3 Mon Sep 17 00:00:00 2001
From: Alexander Dahl <alex@netz39.de>
Date: Tue, 20 Dec 2022 18:06:16 +0100
Subject: [PATCH 7/8] :ok_hand: pottwal: Move prosody config to /etc

Configuration is not data.

Suggested-by: Stefan Haun <tux@netz39.de>
---
 host-pottwal.yml                  | 32 +++++++++++++++++++++++++++----
 host_vars/pottwal.n39.eu/vars.yml |  1 +
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/host-pottwal.yml b/host-pottwal.yml
index 8803cff..5d683a0 100644
--- a/host-pottwal.yml
+++ b/host-pottwal.yml
@@ -125,10 +125,34 @@
         msg: "prosody data dir is missing, please restore from the backup!"
       when: not prosody_dir.stat.exists
 
+    - name: Ensure prosody config dir exists
+      ansible.builtin.file:
+        path: "{{ prosody_config_dir }}"
+        state: directory
+        mode: 0755
+
+    - name: Ensure prosody certs dir exists
+      ansible.builtin.file:
+        path: "{{ prosody_config_dir }}/certs"
+        state: directory
+        mode: 0750
+
+    - name: Ensure prosody conf.avail dir exists
+      ansible.builtin.file:
+        path: "{{ prosody_config_dir }}/conf.avail"
+        state: directory
+        mode: 0755
+
+    - name: Ensure prosody certs dir exists
+      ansible.builtin.file:
+        path: "{{ prosody_config_dir }}/conf.d"
+        state: directory
+        mode: 0755
+
     - name: Ensure prosody main config file is in place
       ansible.builtin.template:
         src: "templates/prosody/prosody.cfg.lua.j2"
-        dest: "{{ prosody_data_dir }}/etc/prosody/prosody.cfg.lua"
+        dest: "{{ prosody_config_dir }}/prosody.cfg.lua"
         mode: 0644
       notify:
         - Restart prosody
@@ -136,7 +160,7 @@
     - name: "Ensure prosody config file is in place: {{ prosody_domain_name }}"
       ansible.builtin.copy:
         src: "files/prosody/{{ prosody_domain_name }}.cfg.lua"
-        dest: "{{ prosody_data_dir }}/etc/prosody/conf.avail/{{ prosody_domain_name }}.cfg.lua"
+        dest: "{{ prosody_config_dir }}/conf.avail/{{ prosody_domain_name }}.cfg.lua"
         mode: 0644
       notify:
         - Restart prosody
@@ -144,7 +168,7 @@
     - name: "Ensure prosody config symlink exists: {{ prosody_domain_name }}"
       ansible.builtin.file:
         src: "../conf.avail/{{ prosody_domain_name }}.cfg.lua"
-        dest: "{{ prosody_data_dir }}/etc/prosody/conf.d/{{ prosody_domain_name }}.cfg.lua"
+        dest: "{{ prosody_config_dir }}/conf.d/{{ prosody_domain_name }}.cfg.lua"
         state: link
       notify:
         - Restart prosody
@@ -162,7 +186,7 @@
           - 5222:5222   # xmpp-client
           - 5269:5269   # xmpp-server
         volumes:
-          - "{{ prosody_data_dir }}/etc/prosody:/etc/prosody:rw"
+          - "{{ prosody_config_dir }}:/etc/prosody:rw"
           - "{{ prosody_data_dir }}/var/lib/prosody:/var/lib/prosody:rw"
           - "{{ prosody_data_dir }}/var/log/prosody:/var/log/prosody:rw"
           - "{{ dehydrated_certs_dir }}/{{ prosody_domain_name }}:/var/lib/dehydrated/certs/{{ prosody_domain_name }}:ro"
diff --git a/host_vars/pottwal.n39.eu/vars.yml b/host_vars/pottwal.n39.eu/vars.yml
index c70ce80..7e12fe0 100644
--- a/host_vars/pottwal.n39.eu/vars.yml
+++ b/host_vars/pottwal.n39.eu/vars.yml
@@ -31,6 +31,7 @@ influxdb_init_password: "{{ vault_influxdb_init_password }}"
 
 gitea_host_port: 9091
 
+prosody_config_dir: "/etc/prosody"
 prosody_data_dir: "{{ data_dir }}/prosody"
 prosody_domain_name: jabber.n39.eu
 jabber_host_port: 8086

From d79566f613d5c121e323abb1d4edabdd280c319a Mon Sep 17 00:00:00 2001
From: Alexander Dahl <alex@netz39.de>
Date: Tue, 20 Dec 2022 18:07:08 +0100
Subject: [PATCH 8/8] :wrench: pottwal: Mount prosody config read-only

The prosody process only needs to write in the certs subdirectory.
---
 host-pottwal.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/host-pottwal.yml b/host-pottwal.yml
index 5d683a0..921bf2f 100644
--- a/host-pottwal.yml
+++ b/host-pottwal.yml
@@ -186,7 +186,8 @@
           - 5222:5222   # xmpp-client
           - 5269:5269   # xmpp-server
         volumes:
-          - "{{ prosody_config_dir }}:/etc/prosody:rw"
+          - "{{ prosody_config_dir }}:/etc/prosody:ro"
+          - "{{ prosody_config_dir }}/certs:/etc/prosody/certs:rw"
           - "{{ prosody_data_dir }}/var/lib/prosody:/var/lib/prosody:rw"
           - "{{ prosody_data_dir }}/var/log/prosody:/var/log/prosody:rw"
           - "{{ dehydrated_certs_dir }}/{{ prosody_domain_name }}:/var/lib/dehydrated/certs/{{ prosody_domain_name }}:ro"