Prosody

Prosody is a XMPP (aka jabber) server, that aims to be simple and fast. It's written in lua. Further documentation is available from https://prosody.im/. Configuration documentation from https://prosody.im/doc/configure and details on creating accounts from https://prosody.im/doc/creating_accounts.

$ doas pkg_add prosody

Read /usr/local/share/doc/pkg-readmes/prosody

Using mercurial ? (you may need to install it using pkg_add mercurial), download the modules:

$ doas pkg_add mercurial
$ hg clone https://hg.prosody.im/prosody-modules/ prosody-modules

$ doas mkdir -p /usr/local/lib/prosody/extras/
$ doas cp -R mod_auto_accept_subscriptions mod_cloud_notify mod_csi mod_deny_omemo mod_group_bookmarks mod_http_upload mod_message_logging mod_muc_log mod_roster_allinall mod_roster_command mod_smacks mod_support_contact mod_throttle_presence mod_block_registrations mod_muc_limits mod_filter_chatstates mod_muc_ban_ip mod_captcha_registration mod_support_room mod_throttle_unsolicited mod_bookmarks mod_firewall mod_bookmarks2 mod_vcard_muc mod_http_upload /usr/local/lib/prosody/extras/

DNS Configuration

xmpp works a lot like email. Each virtual domain you want to support on your server needs the xmpp equivalent to an email mx record. Full details can be found here, but it will look something like this:

xmpp                3600    IN      A       38.87.162.191
                    3600    IN      AAAA    2602:fccf:1:1191::
_xmpp-client._tcp   3600    IN      SRV     0   5   5222     xmpp
_xmpp-server._tcp   3600    IN      SRV     0   5   5269     xmpp

You will need a section like this in the SOA of every domain you wish to support accounts on. This allows you to point xmpp clients and servers to the correct host to handle the connection. The address used should be the address of your prosody server.

Lets Encrypt Certificats

Prosody needs special handling for Certificate as explained here https://prosody.im/doc/certificates, especially if you are using letsencrypt certificates as explained here https://prosody.im/doc/letsencrypt. Specifically, there is a conflict with permissions as explained

Generally Prosody is unable to use certificates directly from the letsencrypt directory, because for security reasons the clients always ensure that the private key is only accessible by the root user. Meanwhile, also for security, Prosody does not run as root.

This cron job solves the problem by making a copy of the cert in prosody's directory.

# echo "~	*	*	*	*	acme-client -v xmpp.example.com && cp /etc/ssl/{xmpp.example.com.fullchain.pem,private/xmpp.example.com.key} /etc/prosody/certs/ && chown _prosody:_prosody /etc/prosody/certs/*.{pem,key}" >> /var/cron/tabs/root