From 83dc3e920cd3188a3a4b8aafd881ba86b10804fd Mon Sep 17 00:00:00 2001 From: Denshi Date: Sat, 4 Mar 2023 22:50:33 +0400 Subject: Fixed up credits, added PSQL guides to multiple tutorials, cleaned up Markdown --- content/coturn.md | 56 +++++++-------- content/dnsmasq.md | 9 ++- content/ejabberd.md | 140 ++++++++++++++++++++++--------------- content/matrix.md | 190 +++++++++++++++++++++++++++++++------------------- content/prosody.md | 197 +++++++++++++++++++++------------------------------- 5 files changed, 314 insertions(+), 278 deletions(-) (limited to 'content') diff --git a/content/coturn.md b/content/coturn.md index 51a1f2c..614b87c 100644 --- a/content/coturn.md +++ b/content/coturn.md @@ -7,15 +7,12 @@ img: "webrtc.svg" tags: ['service'] --- -[Coturn](https://github.com/coturn/coturn) is a libre **STUN** and -**TURN** server software that allows users of chat protocols (Such as -[XMPP](/prosody) and [Matrix](/matrix)) to perform WebRTC **voice -and video calls** despite them being behind NATs. +[Coturn](https://github.com/coturn/coturn) is a libre **STUN** and **TURN** server software that allows users of internet applications or protocols (Such as [XMPP](/prosody) and [Matrix](/matrix)) to perform WebRTC **voice and video calls** despite them being behind NATs. -Almost every self-hosted voice and video conferencing program (such as -[Jitsi](/jitsi) and [Nextcloud\'s](/nextcloud) Talk app) will -**require** Coturn or some other equivalent turnserver to function -properly. +If you want to add video and voice calling natively to your XMPP or Matrix server (or a myriad of various other applications), you'll need to install Coturn and configure it appropriately. + +### Note on ejabberd +If you're installing [ejabberd,](/ejabberd) then *you don't need Coturn.* Ejabberd comes with a TURN server built-in, and you should only setup ejabberd to connect to Coturn if you intend on running **multiple chat services** like Matrix and XMPP. ## Installation @@ -35,7 +32,7 @@ turnserver. Here is an example of some sane defaults: -```md +```txt server-name={{}}turn.example.org{{}} realm={{}}turn.example.org{{}} listening-ip=your_public_ip @@ -52,16 +49,14 @@ verbose There are two options for authentication on a turnserver: -1. **Usernames** and **passwords,** -2. or **authentication secrets.** +1. **Usernames** and **passwords** +2. **Authentication secrets** -Depending on what self-hosted service is being used in conjunction with -Coturn, you may need one or the other of these two options. +Depending on what self-hosted service is being used in conjunction with Coturn, you may need one or the other of these two options. #### Usernames and Passwords -To utilize username and password authentication with Coturn, add the -following configuration in `turnserver.conf`: +To utilize username and password authentication with Coturn, add the following configuration in `turnserver.conf`: ```txt lt-cred-mech @@ -78,35 +73,38 @@ use-auth-secret static-auth-secret={{}}your_auth_secret{{}} ``` -## TURNS (TLS Encryption) +### TURNS (TLS Encryption) -Some self-hosted services (such as Matrix and XMPP) may support the use -of **TURNS:** An encrypted version of TURN, which allows for WebRTC -connections to be established with the use of an encrypted TLS tunnel, -just like HTTPS allows for encrypted viewing of websites. +Some self-hosted services may support the use of **TURNS:** An encrypted version of TURN, which allows for WebRTC connections to be established with the use of an encrypted TLS tunnel, just like HTTPS allows for encrypted viewing of websites. -To utilize TURNS, certificates need to be declared for -**turn.example.org** in `turnserver.conf`: +*Note: This does **not** affect the encryption of the audio or video feeds. This only makes the requests to the TURN servers encrypted, which is still desireable for security. Any encryption of the call contents will be handled by the client and server of the application you are using.* + +To utilize TURNS, certificates need to be declared for **turn.example.org** in `turnserver.conf`: ```txt cert=/etc/letsencrypt/live/{{}}turn.example.org{{}}/fullchain.pem pkey=/etc/letsencrypt/live/{{}}turn.example.org{{}}/privkey.pem ``` +In this example, Letsencrypt certificates generated with `certbot` are used. + + + ## Starting Coturn -After all configuration changes are complete, Coturn can be started with -its systemd daemon: +After all configuration changes are complete, Coturn can be started with its systemd daemon: ```sh systemctl restart coturn ``` -Congratulations! You\'ve successfully setup a Coturn server! +## Configuring your application ------------------------------------------------------------------------- +At this stage, you should look in your application's own guide on how to set the TURN and STUN server settings. Configure it to point at **turn.example.org** and use either your **username and password pair** or your super-secure **authentication secret.** -*Written by [Denshi.](https://denshi.org) +Congratulations! You've successfully setup a Coturn server! + +--- -Donate Monero at 48dnPpGgo8WernVJp5VhvhaX3u9e46NujdYA44u8zuMdETNC5jXiA9S7JoYMM6qRt1ZcKpt1J3RZ3JPuMyXetmbHH7Mnc9C -[\[QR\]](https://denshi.org/images/xmr.png)* +Written by [Denshi.](https://denshi.org) +Donate Monero at: `48dnPpGgo8WernVJp5VhvhaX3u9e46NujdYA44u8zuMdETNC5jXiA9S7JoYMM6qRt1ZcKpt1J3RZ3JPuMyXetmbHH7Mnc9C` diff --git a/content/dnsmasq.md b/content/dnsmasq.md index aa2c3c8..89099bc 100644 --- a/content/dnsmasq.md +++ b/content/dnsmasq.md @@ -128,9 +128,8 @@ nameserver {{}}your_servers_public_ip{{}} Generally this should be an intuitive process on most router interfaces, and most OS' will let you edit the DNS in their respective network settings. ------------------------------------------------------------------------- - -*Written by [Denshi.](https://denshi.org) +--- -Donate Monero at 48dnPpGgo8WernVJp5VhvhaX3u9e46NujdYA44u8zuMdETNC5jXiA9S7JoYMM6qRt1ZcKpt1J3RZ3JPuMyXetmbHH7Mnc9C -[\[QR\]](https://denshi.org/images/xmr.png)* +Written by [Denshi.](https://denshi.org) +Donate Monero at: +`48dnPpGgo8WernVJp5VhvhaX3u9e46NujdYA44u8zuMdETNC5jXiA9S7JoYMM6qRt1ZcKpt1J3RZ3JPuMyXetmbHH7Mnc9C` diff --git a/content/ejabberd.md b/content/ejabberd.md index 76e6678..b8579cd 100644 --- a/content/ejabberd.md +++ b/content/ejabberd.md @@ -6,34 +6,45 @@ tags: ['service'] short_desc: "A chat server based on XMPP." --- -[Ejabberd](https://ejabberd.im) is a server for the XMPP protocol -written in Erlang. It\'s easier to configure and setup than -[Prosody](/prosody) due to having most of its modules built-in and -pre-configured by default. +[Ejabberd](https://ejabberd.im) is a server for the XMPP protocol written in Erlang. It's more scalable, and easier to setup than [Prosody](/prosody) due to having most of its modules built-in and pre-configured by default. ## Prerequisites ### Subdomains -Ejabberd presumes that you have already created all the **required and -optional subdomains** for its operation prior to running it. +Ejabberd presumes that you have already created all the **required and optional subdomains** for its operation prior to running it. -Depending on the usecase, you may need any or all of the following -domains for XMPP functionality: +Depending on the usecase, you may need any or all of the following domains for XMPP functionality: - **example.org** - Your XMPP hostname - **conference.example.org** - For Multi User Chats (MUCs) - **upload.example.org** - For file upload support - **proxy.example.org** - For SOCKS5 proxy support -- **pubsub.example.org** - For publish-subscribe support +- **pubsub.example.org** - For publish-subscribe support (A fancier RSS) This guide will assume **all these subdomains** have been created. +#### Custom Subdomains + +If you wish to customize any of these domains, edit `/etc/ejabberd.yml` and under every appropriate module that needs a subdomain, add the following setting: +```yml +mod_muc: + host: {{}}muc.example.org{{}} +``` + ## Installation -Ejabberd is available in the Debian repositories: +To get the latest version of ejabberd, you need to first setup the ejabberd apt repositories: ```sh +curl -o /etc/apt/sources.list.d/ejabberd.list https://repo.process-one.net/ejabberd.list +curl -o /etc/apt/trusted.gpg.d/ejabberd.gpg https://repo.process-one.net/ejabberd.gpg +``` + +Then update the repositories and install the `ejabberd` package: + +```sh +apt update apt install ejabberd ``` @@ -68,15 +79,20 @@ for both the fullchain cert and private key. Using certbot, this process can be easily automated with these commands: -```sh -$DOMAIN={{}}subdomain.example.org{{}} -certbot --nginx -d $DOMAIN certonly; mkdir -p /etc/ejabberd/certs/$DOMAIN -cp /etc/letsencrypt/live/$DOMAIN/fullchain.pem /etc/ejabberd/certs/$DOMAIN -cp /etc/letsencrypt/live/$DOMAIN/privkey.pem /etc/ejabberd/certs/$DOMAIN -``` +```bash +DOMAIN={{}}example.org{{}} -This should be ran with your XMPP hostname **(example.org)** and -repeated for all your desired subdomains. +# Set the domain names you want here +declare -a subdomains=("" "conference." "proxy." "pubsub." "upload.") + +for i in "${subdomains[@]}"; do + certbot --nginx -d $i$DOMAIN certonly + mkdir -p /etc/ejabberd/certs/$i$DOMAIN + cp /etc/letsencrypt/live/$i$DOMAIN/fullchain.pem /etc/ejabberd/certs/$i$DOMAIN + cp /etc/letsencrypt/live/$i$DOMAIN/privkey.pem /etc/ejabberd/certs/$i$DOMAIN +done +``` +*Note: Just like with Prosody, you might want to write this script to a file and setup a [cronjob](/cron) to run it periodically. This should help prevent your certificates from expiring.* Make sure all the certificates are readable by the `ejabberd` user: ```sh @@ -105,11 +121,29 @@ acl: This would make **admin@example.org** the user with administrator privileges. +### File Uploads + +To ensure full compliance with XMPP standards, add the following configuration to `mod_http_upload`: + +```yaml +mod_http_upload: + put_url: https://@HOST@:5443/upload + docroot: {{}}/var/www/upload{{}} + custom_headers: + "Access-Control-Allow-Origin": "https://@HOST@" + "Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS" + "Access-Control-Allow-Headers": "Content-Type" +``` + +Make sure to create and give the `ejabberd` user ownership of `/var/www/upload` or any other directory you choose to use for file uploads: + +```sh +chown -R ejabberd:ejabberd /var/www/upload +``` + ### Message Archives -The ejabberd server supports keeping archives of messages through its -`mod_mam` module. This can be enabled by uncommenting the following -lines: +The ejabberd server supports keeping archives of messages through its `mod_mam` module. This can be enabled by uncommenting the following lines: ```yml mod_mam: @@ -121,8 +155,7 @@ mod_mam: ### Why use a database? -In the `mod_mam` section of the ejabberd config file, the following -message is in comments: +We can find the following comment in the `mod_mam` section of `/etc/ejabberd.yml`: ```yml mod_mam: @@ -132,14 +165,7 @@ mod_mam: ## db_type: sql ``` -As these comments imply, an **SQL backend** is strongly recommended if -you wish to use your ejabberd server for anything more than just -testing. Ejabberd supports **MySQL, SQLite** and **PostgreSQL.** - -While all of those are suitable choices, the best database system to use -is PostgreSQL. It\'s the same database backend used by -[PeerTube](/peertube) and [Matrix](/matrix), making it the most -convenient option if you\'re already running those too. +As these comments imply, an **SQL backend** is strongly recommended if you wish to use your ejabberd server for anything more than just testing. Ejabberd supports **MySQL, SQLite** and **PostgreSQL.** For the purpose of efficiency, this guide will use **PostgresSQL** because other server software like [Matrix](/matrix) and [PeerTube](/peertube) support it. ### Installing PostgreSQL @@ -171,8 +197,7 @@ su -c "psql -c 'CREATE DATABASE ejabberd OWNER ejabberd;'" postgres ### Importing Database Scheme -Ejabberd doesn\'t create the database scheme by default; It has to be -imported into the database before use. +Ejabberd does **not** create the database scheme by default; It has to be imported into the database before use. ```sh su -c "curl -s https://raw.githubusercontent.com/processone/ejabberd/master/sql/pg.sql | psql ejabberd" postgres @@ -185,17 +210,16 @@ Finally, add the following configuration to `ejabberd.yml`: ```yml sql_type: pgsql sql_server: "localhost" -sql_database: "ejabberd" -sql_username: "ejabberd" -sql_password: "psql_password" +sql_database: "{{}}ejabberd{{}}" +sql_username: "{{}}ejabberd{{}}" +sql_password: "{{}}psql_password{{}}" ``` -Once you\'ve ensured your database name, username and password are all -correct, enable SQL storage for `mod_mam`: +Once you've ensured your database name, username and password are all correct, enable SQL storage for `mod_mam`: ```yml mod_mam: - ## (Other parameters) + ## (Other parameters above) db_type: sql ``` @@ -209,8 +233,7 @@ To begin using ejabberd, firstly start the ejabberd daemon: systemctl restart ejabberd ``` -Then, using `ejabberdctl` as the ejabberd user, register the admin user -which is set in `ejabberd.yml`: +Then, using `ejabberdctl` as the ejabberd user, register the admin user which is set in `ejabberd.yml`: ```sh su -c "ejabberdctl register {{}}admin example.org password{{}}" ejabberd @@ -220,25 +243,24 @@ This will create the user **admin@example.org.** ### Using the Web Interface -By default, ejabberd has a web interface accessible from -**http://example.org:5280/admin**. When accessing this interface, you -will be prompted for the admin credentials: +By default, ejabberd has a web interface accessible from **http://example.org:5280/admin**. When accessing this interface, you will be prompted for the admin credentials: -{{< img src="/pix/ejabberd-login.jpg" >}} +{{< img src="/pix/ejabberd-login.webp" >}} After signing in with the admin credentials, you will be able to manage your ejabberd server from this web interface: -{{< img src="/pix/ejabberd-admin.jpg" >}} +{{< img src="/pix/ejabberd-admin.webp" >}} ## TURN & STUN for Calls -Ejabberd supports the **TURN** and **STUN** protocols to allow internet -users behind NATs to perform voice and video calls with other XMPP -users. +Ejabberd supports the **TURN** and **STUN** protocols to allow internet users behind NATs to perform voice and video calls with other XMPP users. **This is enabled by default using [ejabberd_stun](https://docs.ejabberd.im/admin/configuration/listen#ejabberd-stun-1).** + +**However,** if you plan on running ejabberd alongside **other applications** that require TURN and STUN, such as Matrix, then you'll have to setup your own external TURN server using Coturn. -Firstly, setup a TURN and STUN server with [Coturn,](/coturn) using -an **authentication secret.** +### Setup with Coturn and `mod_stun_disco` + +Firstly, setup a TURN and STUN server with [Coturn,](/coturn) using an **authentication secret.** Then, edit `mod_stun_disco` to contain the appropriate information for your turnserver: @@ -255,11 +277,17 @@ your turnserver: type: turn ``` -And with that, you\'ve successfully setup your ejabberd XMPP server! +## Further Configuration + +For a deeper look into all the modules and options, have a look at the following ejabberd documentation: +- Ejabberd's [Listen Modules](https://docs.ejabberd.im/admin/configuration/listen/) and [Listen Options](https://docs.ejabberd.im/admin/configuration/listen-options/) +- Ejabberd's [Top-Level Options](https://docs.ejabberd.im/admin/configuration/toplevel/) +- Ejabberd's [Modules' Options](https://docs.ejabberd.im/admin/configuration/modules/) ------------------------------------------------------------------------- +*And with that, you've successfully setup your ejabberd XMPP server!* -*Written by [Denshi.](https://denshi.org) +--- -Donate Monero at 48dnPpGgo8WernVJp5VhvhaX3u9e46NujdYA44u8zuMdETNC5jXiA9S7JoYMM6qRt1ZcKpt1J3RZ3JPuMyXetmbHH7Mnc9C -[\[QR\]](https://denshi.org/images/xmr.png)* +Written by [Denshi.](https://denshi.org) +Donate Monero at: +`48dnPpGgo8WernVJp5VhvhaX3u9e46NujdYA44u8zuMdETNC5jXiA9S7JoYMM6qRt1ZcKpt1J3RZ3JPuMyXetmbHH7Mnc9C` diff --git a/content/matrix.md b/content/matrix.md index 338ff9b..0b71d7b 100644 --- a/content/matrix.md +++ b/content/matrix.md @@ -6,21 +6,14 @@ tags: ['service'] short_desc: "An encrypted chat server sleek and accessible even to normies." --- -Matrix is easy-to-use, decentralized and encrypted private chat -software. Matrix is federated, meaning that with a Matrix account on any -server, including your own, you can talk to any other Matrix account on -the internet, similar to email. Matrix also allows fully end-to-end -encrypted group chats. +Matrix is easy-to-use, decentralized and encrypted private chat software. Matrix is federated, meaning that with a Matrix account on any server, including your own, you can talk to any other Matrix account on +the internet, similar to email. Matrix also allows fully end-to-end encrypted group chats. -**Synapse** is the name of the default Matrix server. It is written in -Python. While it is requires somewhat more system resources than [an -XMPP server](/prosody), it makes up for that in being very accessible -to non-technical users. +**Synapse** is the name of the default Matrix server. It is written in Python. While it is requires somewhat more system resources than [an XMPP server](/prosody), it makes up for that in being very accessible to non-technical users. ## Installation -Synapse is not in the Debian package repositories by default, but we can -easily add Matrix\'s repository including it: +The latest version of Synapse is not in the Debian package repositories by default, but we can easily add Matrix's repository including it: ```sh apt install -y lsb-release wget apt-transport-https @@ -28,88 +21,134 @@ wget -O /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matr echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/matrix-org.list ``` -After we update our packages lists, we will be able to install Synapse -with `apt`. +After we update our packages lists, we will be able to install Synapse with `apt`. ```sh apt update apt install matrix-synapse-py3 ``` -When prompted, give your main domain name (not a subdomain). This will -be the domain appended to your Matrix address, e.g. -`@chad:landchad.net`. +When prompted, give your main domain name (not a subdomain). This will be the domain appended to your Matrix address, e.g. `@chad:{{}}landchad.net{{}}`. (*If you want to run Synapse under a different subdomain than the actual server name,* then you must set up [delegation.](https://matrix-org.github.io/synapse/latest/delegate.html)) ## Nginx configuration -Create an Nginx configuration file for Matrix, say -`/etc/nginx/sites-available/matrix` and add the content below: +Create an Nginx configuration file for Matrix, say `/etc/nginx/sites-available/matrix` and add the content below: ```nginx server { - server_name {{}}matrix.example.org{{}} ; + server_name {{}}matrix.example.org{{}}; + listen 80; listen [::]:80; - location / { - proxy_pass http://localhost:8008; - } - location ~* ^(\/_matrix|\/_synapse\/client) { + + listen 443 ssl http2 default_server; + listen [::]:443 ssl http2 default_server; + + listen 8448 ssl http2 default_server; + listen [::]:8448 ssl http2 default_server; + + location ~* ^(\/_matrix|\/_synapse|\/_client) { proxy_pass http://localhost:8008; proxy_set_header X-Forwarded-For $remote_addr; - client_max_body_size 50M ; + client_max_body_size {{}}50M{{}}; } - location /.well-known/matrix/server { + + # These sections are required for client and federation discovery + # (AKA: Client Well-Known URI) + location /.well-known/matrix/client { return 200 '{"m.homeserver": {"base_url": "https://{{}}matrix.example.org{{}}"}}'; default_type application/json; add_header Access-Control-Allow-Origin *; } + + location /.well-known/matrix/server { + return 200 '{"m.server": "{{}}matrix.example.org{{}}:443"}'; + default_type application/json; + add_header Access-Control-Allow-Origin *; + } } ``` -Note the `client_max_body_size` variable. By default, Nginx caps the -size of files it can transfer. We increase that to 50M if needed by -Matrix. (Note however that both Matrix and Nginx have seperate settings -for this and to raise it to something much larger, you will have to -increase the value in both configuration files.) +Note the `client_max_body_size` variable. By default, Nginx caps the size of files it can transfer. We increase that to 50M if needed by Matrix. (Note however that both Matrix and Nginx have seperate settings for this and to raise it to something much larger, you will have to increase the value in both configuration files.) -Now let\'s enable the Nginx Matrix site and reload Nginx to make it -active. +Now let's enable the Nginx Matrix site and run **certbot** to get an encryption certificate and restart Nginx. ```sh ln -s /etc/nginx/sites-available/matrix /etc/nginx/sites-enabled -systemctl reload nginx +certbot --nginx -d {{}}matrix.example.org{{}} ``` -### Encryption +## Configuration + +### Read the config file + +The configuration file for Matrix is in `/etc/matrix-synapse/homeserver.yaml`. It is well documented and +commented, so you can read about the settings, but let's change the essential ones here. + +Make what changes you want and run `systemctl reload matrix-synapse` to make the system configuration active. + +### Database Setup +Synapse, like [PeerTube](/peertube) and [Prosody](/prosody), supports **PostgreSQL** as a database backend. This can **significantly increase performance,** epsecially if you're already running PostgreSQL to run any other services. -Obviously, we need to encrypt our `matrix` subdomain as well. Let\'s do -that with certbot: +Begin by installing PostgreSQL: ```sh -certbot --nginx -d {{}}matrix.example.org{{}} +apt install postgresql ``` -## Configuration +Then start the daemon: +```sh +systemctl restart postgresql +``` -### Read the config file +Now create a user named `synapse_user` to manage your database: +```sh +su -c "createuser --pwprompt synapse_user" postgres +``` + +And finally, create the actual database: +```sh +su -c "psql -c 'CREATE DATABASE synapse ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0 OWNER synapse_user;'" postgres +``` + +Now edit the database configuration in `/etc/matrix-synapse/homeserver.yaml` and comment out the following lines for the previous SQLite configuration: -The configuration file for Matrix is in -`/etc/matrix-synapse/homeserver.yaml`. It is well documented and -commented, so you can read about the settings, but let\'s change the -essential ones here. +```yml +# database: + # name: sqlite3 + # args: + # database: DATADIR/homeserver.db +``` + +*Note: The example above is how yours should look like after it's commented out.* + +Then, uncomment the following configuration above, and set the appropriate entries: +```yaml +database: + name: psycopg2 + args: + user: {{}}synapse_user{{}} + password: {{}}secretpassword{{}} + database: {{}}synapse{{}} + host: localhost + cp_min: 5 + cp_max: 10 +``` -Make what changes you want and run `systemctl reload matrix-synapse` to -make the system configuration active. +Ensure that `synapse` is set to your database name, `synapse_user` is set to that database's owner, and that `secretpassword` is set to that user's password. -### Create an administrator account +### Adding Users and Admins -If you allow open registration on your server in the configuration file, -you can create an account through Element or another Matrix client, but -you are probably going to want an official admin account to use. To make -one, simply run the following command, which will then give you several -choices for creating a user, among which will be the ability to make it -an admin. +If you allow open registration on your server in the configuration file, you can create an account through Element or another Matrix client, but you are probably going to want an official admin account to use. To make one, simply run the following command, which will then give you several choices for creating a user, among which will be the ability to make it an admin. + +Before setting up the admin user, make sure to set a `registration_shared_secret` in `/etc/matrix-synapse/homserver.yaml`: + +```yaml +registration_shared_secret: {{}}???{{}} +``` + +Then, run the following command to register a user: ```sh cd /etc/matrix-synapse @@ -117,40 +156,49 @@ cd /etc/matrix-synapse register_new_matrix_user -c homeserver.yaml http://localhost:8008 ``` -### Error Shared secret registration is not enabled +This command will prompt you for a username, password and whether to make the user an admin or not. -Sometimes the default configuration is not fully setup, so you need -to add the following the keys to your `homeserver.yaml`: +### URL Previews -- `macaroon_secret_key` -- `registration_shared_secret` +To enable server-generated previews of webpages, change this line to true in `/etc/matrix-synapse/homeserver.yaml`: -Make sure to restart Matrix Synapse +```yaml +url_preview_enabled: true +``` -```sh -systemctl restart matrix-synapse +And make sure to uncomment the `url_preview_ip_range_blacklist:` section; Otherwise, Synapse will refuse to start up again! + +### Federation + +Using the Nginx configuration provided with this guide, federation should work out of the box with Synapse. You can test whether it's working using the [Matrix Federation Tester.](https://federationtester.matrix.org/) + +However, some extra features can be enabled to increase the usability of your homeserver over federation. In `/etc/matrix-synapse/homeserver.yaml`, the following lines can be edited: + +```yaml +allow_public_rooms_over_federation: true ``` +This can be un-commented to allow users to add your homserver to their list of servers (in a client like Element) and see a list of all the public rooms. + +```yaml +allow_public_rooms_without_auth: true +``` + +This can be un-commented to enable guests to see public rooms without authenticating. + ## Using Matrix with ![Element Matrix logo](/pix/element.svg)Element -There are many different [clients](https://matrix.org/clients/) that can -be used on desktops or phones to chat on your Matrix server, but the -most popular and most widely vetted is ![Element -logo](/pix/element.svg)Element. +There are many different [clients](https://matrix.org/clients/) that can be used on desktops or phones to chat on your Matrix server, but the most popular and most widely vetted is ![Element logo](/pix/element.svg)Element. Get Element to access your Matrix server: - Mobile: - [F-droid](https://f-droid.org/packages/im.vector.app/) - - [Google - Play](https://play.google.com/store/apps/details?id=im.vector.app) - - [Apple App - Store](https://apps.apple.com/app/vector/id1083446067) + - [Google Play](https://play.google.com/store/apps/details?id=im.vector.app) + - [Apple App Store](https://apps.apple.com/app/vector/id1083446067) - Real computer: - GNU/Linux: You know how to install it. - [Windows](https://packages.riot.im/desktop/install/win32/x64/Element%20Setup.exe) - [Mac](https://packages.riot.im/desktop/install/macos/Element.dmg) -Note also that Element has a web client (i.e. a version that can be -accessed on your own website) that is also easy to install on an Nginx -server, although that will be covered in another article. +Note also that Element has a web client (i.e. a version that can be accessed on your own website) that is also easy to install on an Nginx server, although that will be covered in another article. diff --git a/content/prosody.md b/content/prosody.md index 7210e2c..5c6bbc1 100644 --- a/content/prosody.md +++ b/content/prosody.md @@ -6,18 +6,21 @@ tags: ['service'] short_desc: 'A minimalist XMPP chat server.' --- -XMPP is a fantastically simple protocol that\'s usually used as a messenger. -It\'s highly extensible, better than IRC, lighter and more decentralized than -Matrix, and normie social media like Telegram can\'t hold a candle to it. +XMPP is a fantastically simple protocol that's usually used as a messenger. It's highly extensible, better than IRC, lighter and more decentralized than Matrix, and normie social media like Telegram can't hold a candle to it. -XMPP is so decentralized and extensible that there are many *different* -XMPP servers. Here, let\'s set up an [Prosody](https://prosody.im/) XMPP -server. +XMPP is so decentralized and extensible that there are many [*different*](/ejabberd) XMPP servers. Here, let's set up a [Prosody](https://prosody.im/) XMPP server. ## Installation -Prosody is in the Debian repositories, so we can easily install it on -our server with the following command: +To install Prosody, first add the official Prosody repositories for Debian: + +```sh +# Install extrepo if you already haven't +apt install extrepo +extrepo enable prosody +apt update +``` +Then, install Prosody: ```sh apt install prosody @@ -25,14 +28,11 @@ apt install prosody ## Configuration -The Prosody configuration file is in `/etc/prosody/prosody.cfg.lua`. To -set it all up, we will be changing several things. +The Prosody configuration file is in `/etc/prosody/prosody.cfg.lua`. To set it all up, we will be changing several things. ### Setting Admins -Let\'s go ahead and set who our admin(s) will be. Find the line that -says `admins = { }` and to this we can specify one or more server -admins. +Let's go ahead and set who our admin(s) will be. Find the line that says `admins = { }` and to this we can specify one or more server admins. ```cfg # To add one admin: @@ -42,19 +42,15 @@ admins = { "chad@example.org" } admins = { "chad@example.org", "chadmin@example.org" } ``` -Note that we have not created these accounts yet, we will do this -[below](#user). +Note that we have not created these accounts yet, we will do this [below](#user). ### Set the Server URL -Find the line `VirtualHost "localhost"` and replace `localhost` with -your domain. In our case, we will have `VirtualHost "example.org"` +Find the line `VirtualHost "localhost"` and replace `localhost` with your domain. In our case, we will have `VirtualHost "example.org"` ### Multi-User Chats -Most people will probably want the ability to have chats with more than -two users. This is easily enough to enable. In the config file, add the -following: +Most people will probably want the ability to have chats with more than two users. This is easily enough to enable. In the config file, add the following: ```cfg Component "chat.example.org" "muc" @@ -62,165 +58,142 @@ Component "chat.example.org" "muc" restrict_room_creation = "admin" ``` -On the first line, you must have a separate subdomain for your -multi-user chats. I use the `chat.` subdomain, but some use `muc.`. -Anything if possible. +On the first line, you must have a separate subdomain for your multi-user chats. I use the `chat.` subdomain, but some use `muc.`. Anything is possible. -The second line is important because it prevents non-admins from -creating and squatting rooms on your server. The only situation where -you might not want that is if you indend to open a general public chat -system for people you don\'t know. +The second line is important because it prevents non-admins from creating and squatting rooms on your server. The only situation where you might not want that is if you indend to open a general public chat system for people you don't know. -Read more about the `muc` plugin on the Prosody documentation page -[here](https://prosody.im/doc/modules/mod_muc). +Read more about the `muc` plugin on the Prosody documentation page [here](https://prosody.im/doc/modules/mod_muc). ### Enabling chat histories -By default, Prosody will send out messages received only to the first -available clients. That means that if you have your desktop client -turned off and your cell phone receives a message, it will *not* be -available to the desktop client when you start it. +By default, Prosody will send out messages received only to the first available clients. +That means that if you have your desktop client turned off and your cell phone receives a message, +it will *not* be available to the desktop client when you start it. -While this may be preferred in some cases, enable the MAM module -(Message Archive Management) to have the server hold on messages and -sync them to all clients. +While this may be preferred in some cases, +enable the `mam` module (Message Archive Management) to have the server hold on messages and sync them to all clients. -Within the `modules_enabled` block, you can uncomment the `mam` line to -enable it. You can see other settings for this module -[here](https://prosody.im/doc/modules/mod_mam) like, for example, how -long a server should hold on to message histories for synching. +Within the `modules_enabled` block, you can uncomment the `mam` line to enable it. +You can see other settings for this module [here](https://prosody.im/doc/modules/mod_mam) +like, for example, how long a server should hold on to message histories for synching. -Note also that Prosody comes with the `carbons` activated module by -default, which is related. This will send received messages to *all* -active clients (your phone and desktop), although it will not save -messages like MAM for clients not online or to be added later. +Note also that Prosody comes with the `carbons` activated module by default, which is related. +This will send received messages to *all* active clients (your phone and desktop), +although it will not save messages like MAM for clients not online or to be added later. ### File sharing -With this we can bring XMPP to the level of other popular instant -messaging applications like Matrix and whatsapp. It is extremely easy to -setup. This part is optional, but it can make XMPP more normie-friendly -if you plan on moving family members and friends over to XMPP. +With this we can bring XMPP to the level of other popular instant messaging applications like Matrix and whatsapp. +It is extremely easy to setup. +This part is optional, but it can make XMPP more normie-friendly if you plan on moving family members and friends over to XMPP. -First we need to install extra prosody modules. Run the following -command: +First we need to install extra prosody modules. Run the following command: ```sh apt install prosody-modules ``` -Then we can add the following line to you prosody config file to enable -file uploads: +Then we can add the following line to you prosody config file to enable file uploads: ```cfg Component "uploads.example.org" "http_upload" ``` -As you will notice, you need another subdomain for this. We will add an -ssl certficate for this later. +As you will notice, you need another subdomain for this. We will add an ssl certficate for this later. -You will also need to go back to `modules_enabled` and uncomment the -`http_files` module. This is used to actually serve the files to users. +You will also need to go back to `modules_enabled` and uncomment the `http_files` module. +This is used to actually serve the files to users. And the last part of the setup is to enable the built in proxy server. -This helps with file transfers for devices behind a NAT, and unless you -are using XMPP in a LAN, you probably need this. Enable the proxy by -adding the following line to the config: +This helps with file transfers for devices behind a NAT, and unless you are using XMPP in a LAN, you probably need this. +Enable the proxy by adding the following line to the config: ```cfg Component "proxy.example.org" "proxy65" ``` -As you can see, another subdomain is needed. We will add ssl -certificates for this later. +As you can see, another subdomain is needed. We will add ssl certificates for this later. -At this point, file sharing is now setup and ready to be used. Although -there are some concerns that should be addressed. +At this point, file sharing is now setup and ready to be used. Although there are some concerns that should be addressed. -A big concern with file sharing is large files, seeing as all files -shared over XMPP will be stored on your server. This can become a -problem when many (and large) files are being shared. We can put a cap -on large files by adding the following line to our config: +A big concern with file sharing is large files, seeing as all files shared over XMPP will be stored on your server. This can become a problem when many (and large) files are being shared. We can put a cap on large files by adding the following line to our config: ```cfg http_upload_file_size_limit = 20971520 ``` -This puts a 20MB cap on all files being shared. The value is specified -in bytes. You can also specify after how long files should be deleted by -adding the following line: +This puts a 20MB cap on all files being shared. The value is specified in bytes. You can also specify after how long files should be deleted by adding the following line: ```cfg http_upload_expire_after = 60 * 60 * 24 * 7 ``` -The value is specified in seconds. The above line will make prosody -delete files after a week. +The value is specified in seconds. The above line will make prosody delete files after a week. -If it is for some reason neccessary, you can also manually invoke expiry -with the following command: +If it is for some reason neccessary, you can also manually invoke expiry with the following command: ```cfg prosodyctl mod_http_upload expire ``` +### Database Setup + +Prosody includes the `internal` and `sql` storage backends by default. If you wish to run Prosody with PostgreSQL, edit the following lines: + +```cfg +storage = "sql" + +sql = { + driver = "PostgreSQL", + database = "{{}}prosody{{}}", + username = "{{}}prosody{{}}", + password = "{{}}password{{}}", + host = "localhost" +} +``` + +(This is assuming you've installed the `postgresql` package, and setup a database named `prosody` with a user named `prosody` as the owner.) + ### Other things to check -Check the config file for other settings you might want to change. For -example, if you want to run a general public XMPP server, you can allow -anyone to create an account by changing `allow_registration` to `true`. +Check the config file for other settings you might want to change. For example, if you want to run a general public XMPP server, you can allow anyone to create an account by changing `allow_registration` to `true`. -Another thing you can do is enable the `csi_simple` module, which will -add some optimizations for mobile devices. +Another thing you can do is enable the `csi_simple` module, which will add some optimizations for mobile devices. -Another thing worth noting is the `archive_expires_after = "1w"` line. -This specifies after how long message archives will be deleted. +Another thing worth noting is the `archive_expires_after = "1w"` line. This specifies after how long message archives will be deleted. Also the `smacks` module helps a lot with slow internet connections. ## Certificates -Obviously, we want to have client-to-server and server-to-server -encryption. Nowadays, use can use Certbot to generate certificates and -use a convenient command below `prosodyctl` to import them. +Obviously, we want to have client-to-server and server-to-server encryption. Nowadays, use can use Certbot to generate certificates and use a convenient command below `prosodyctl` to import them. -**If you have multi-user chat enabled, be sure to get a certificate for -that subdomain as well.** Include the `--nginx` option assuming you have -an Nginx server running. +**If you have multi-user chat enabled, be sure to get a certificate for that subdomain as well.** Include the `--nginx` option assuming you have an Nginx server running. ```sh certbot -d chat.example.org --nginx ``` -**If you have file sharing enabled, be sure to get a certificate for -those subdomains as well.** +**If you have file sharing enabled, be sure to get a certificate for those subdomains as well.** ```sh certbot -d uploads.example.org --nginx certbot -d proxy.example.org --nginx ``` -Once you have the certificates for encryption, run the following to -import them into Prosody. +Once you have the certificates for encryption, run the following to import them into Prosody. ```sh prosodyctl --root cert import /etc/letsencrypt/live/ ``` -Note that you might get an error that a certificate has not been found -if your `muc` subdomain and your main domain share a certificate. It -should still work, this is just notifying you that no specific -certificate for the subdomain. +Note that you might get an error that a certificate has not been found if your `muc` subdomain and your main domain share a certificate. It should still work, this is just notifying you that no specific certificate for the subdomain. -**Note:** The above command will need to be rerun when certificates are -renewed. You may want to create a [cronjob](/cron) to have this done -automatically. +**Note:** The above command will need to be rerun when certificates are renewed. You may want to create a [cronjob](/cron) to have this done automatically. ## Creating users/admins manually {#user} -Let\'s manually create the admin user we prepared for above. Note that -you can indeed do this in your XMPP client if you have not disabled -registration, but this is how it is done on the command line: +Let's manually create the admin user we prepared for above. Note that you can indeed do this in your XMPP client if you have not disabled registration, but this is how it is done on the command line: ```sh prosodyctl adduser chad@example.org @@ -230,8 +203,7 @@ This will prompt you to create a password as well. ## Make changes active -With any system service, use `systemctl reload` or `systemctl restart` -to make the new settings active: +With any system service, use `systemctl reload` or `systemctl restart` to make the new settings active: ```sh systemctl restart prosody @@ -239,8 +211,7 @@ systemctl restart prosody ## Using your Server! -Once your server is set up, you just need an XMPP client to use your new -and secure chat system. +Once your server is set up, you just need an XMPP client to use your new and secure chat system. - GNU/Linux: [Dino](https://dino.im/) or [Gajim](https://gajim.org/) - Windows: [Gajim](https://gajim.org/) also runs on Windows. @@ -253,26 +224,18 @@ and secure chat system. - [See a more complete list kept by XMPP](https://xmpp.org/software/clients.html) -Install whichever of these clients you want on your computer or phone -and you can log into your new XMPP server with the account you made. -Note that if you enabled public registration, anyone can create an -account on your server through one of these clients. +Install whichever of these clients you want on your computer or phone and you can log into your new XMPP server with the account you made. Note that if you enabled public registration, anyone can create an account on your server through one of these clients. ### Account addresses -XMPP account addressed look just like email addresses: -`username@example.org`. You can message any account on any XMPP server -on the internet with that format. +XMPP account addressed look just like email addresses: `username@example.org`. You can message any account on any XMPP server on the internet with that format. ### Note on MUCs (multi-user chats) -Remember that MUCs are kept on a separate subdomain that we created and -should\'ve gotten a certificate for above, for example, -`chat.example.org`. Chatrooms are created and referred to in the -following format: `#chatroomname@chat.example.org`. +Remember that MUCs are kept on a separate subdomain that we created and should've gotten a certificate for above, for example, `chat.example.org`. Chatrooms are created and referred to in the following format: `#chatroomname@chat.example.org`. ### Note on firewalls and opening ports -If you use a firewall, you should open ports 5222 and 5281. The first one is needed for clients to be able to connect to your server. The second is only necessary if you are using the ‘http_upload' module for file sharing. +If you use a firewall, you should open ports 5222 and 5281. The first one is needed for clients to be able to connect to your server. The second is only necessary if you are using the `http_upload` module for file sharing. A complete list of ports used by Prosody can be found [here](https://prosody.im/doc/ports). -- cgit v1.2.3