diff --git a/nixos/doc/manual/release-notes/rl-1803.xml b/nixos/doc/manual/release-notes/rl-1803.xml index b755245a69fb..20f23261b608 100644 --- a/nixos/doc/manual/release-notes/rl-1803.xml +++ b/nixos/doc/manual/release-notes/rl-1803.xml @@ -322,6 +322,33 @@ following incompatible changes: external module. + + + The Prosody XMPP server has received a major update. The following modules were renamed: + + + + is now + + + + + is now + + + + + + + Many new modules are now core modules, most notably + and . + + + + The better-performing libevent backend is now enabled by default. + + + diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix index 9d7e6d6018af..a7b43fb78a95 100644 --- a/nixos/modules/services/networking/prosody.nix +++ b/nixos/modules/services/networking/prosody.nix @@ -15,6 +15,7 @@ let description = "Path to the key file."; }; + # TODO: rename to certificate to match the prosody config cert = mkOption { type = types.path; description = "Path to the certificate file."; @@ -30,7 +31,7 @@ let }; moduleOpts = { - + # Generally required roster = mkOption { type = types.bool; default = true; @@ -61,12 +62,38 @@ let description = "Service discovery"; }; - legacyauth = mkOption { + # Not essential, but recommended + carbons = mkOption { type = types.bool; default = true; - description = "Legacy authentication. Only used by some old clients and bots"; + description = "Keep multiple clients in sync"; }; + pep = mkOption { + type = types.bool; + default = true; + description = "Enables users to publish their mood, activity, playing music and more"; + }; + + private = mkOption { + type = types.bool; + default = true; + description = "Private XML storage (for room bookmarks, etc.)"; + }; + + blocklist = mkOption { + type = types.bool; + default = true; + description = "Allow users to block communications with other users"; + }; + + vcard = mkOption { + type = types.bool; + default = true; + description = "Allow users to set vCards"; + }; + + # Nice to have version = mkOption { type = types.bool; default = true; @@ -91,36 +118,112 @@ let description = "Replies to XMPP pings with pongs"; }; - console = mkOption { + register = mkOption { type = types.bool; - default = false; - description = "telnet to port 5582"; + default = true; + description = "Allow users to register on this server using a client and change passwords"; }; + mam = mkOption { + type = types.bool; + default = false; + description = "Store messages in an archive and allow users to access it"; + }; + + # Admin interfaces + admin_adhoc = mkOption { + type = types.bool; + default = true; + description = "Allows administration via an XMPP client that supports ad-hoc commands"; + }; + + admin_telnet = mkOption { + type = types.bool; + default = false; + description = "Opens telnet console interface on localhost port 5582"; + }; + + # HTTP modules bosh = mkOption { type = types.bool; default = false; description = "Enable BOSH clients, aka 'Jabber over HTTP'"; }; - httpserver = mkOption { - type = types.bool; - default = false; - description = "Serve static files from a directory over HTTP"; - }; - websocket = mkOption { type = types.bool; default = false; description = "Enable WebSocket support"; }; + http_files = mkOption { + type = types.bool; + default = false; + description = "Serve static files from a directory over HTTP"; + }; + + # Other specific functionality + limits = mkOption { + type = types.bool; + default = false; + description = "Enable bandwidth limiting for XMPP connections"; + }; + + groups = mkOption { + type = types.bool; + default = false; + description = "Shared roster support"; + }; + + server_contact_info = mkOption { + type = types.bool; + default = false; + description = "Publish contact information for this service"; + }; + + announce = mkOption { + type = types.bool; + default = false; + description = "Send announcement to all online users"; + }; + + welcome = mkOption { + type = types.bool; + default = false; + description = "Welcome users who register accounts"; + }; + + watchregistrations = mkOption { + type = types.bool; + default = false; + description = "Alert admins of registrations"; + }; + + motd = mkOption { + type = types.bool; + default = false; + description = "Send a message to users when they log in"; + }; + + legacyauth = mkOption { + type = types.bool; + default = false; + description = "Legacy authentication. Only used by some old clients and bots"; + }; + + proxy65 = mkOption { + type = types.bool; + default = false; + description = "Enables a file transfer proxy service which clients behind NAT can use"; + }; + }; toLua = x: if builtins.isString x then ''"${x}"'' - else if builtins.isBool x then toString x + else if builtins.isBool x then (if x == true then "true" else "false") else if builtins.isInt x then toString x + else if builtins.isList x then ''{ ${lib.concatStringsSep ", " (map (n: toLua n) x) } }'' else throw "Invalid Lua value"; createSSLOptsStr = o: '' @@ -198,6 +301,59 @@ in description = "Allow account creation"; }; + c2sRequireEncryption = mkOption { + type = types.bool; + default = true; + description = '' + Force clients to use encrypted connections? This option will + prevent clients from authenticating unless they are using encryption. + ''; + }; + + s2sRequireEncryption = mkOption { + type = types.bool; + default = true; + description = '' + Force servers to use encrypted connections? This option will + prevent servers from authenticating unless they are using encryption. + Note that this is different from authentication. + ''; + }; + + s2sSecureAuth = mkOption { + type = types.bool; + default = false; + description = '' + Force certificate authentication for server-to-server connections? + This provides ideal security, but requires servers you communicate + with to support encryption AND present valid, trusted certificates. + For more information see https://prosody.im/doc/s2s#security + ''; + }; + + s2sInsecureDomains = mkOption { + type = types.listOf types.str; + default = []; + example = [ "insecure.example.com" ]; + description = '' + Some servers have invalid or self-signed certificates. You can list + remote domains here that will not be required to authenticate using + certificates. They will be authenticated using DNS instead, even + when s2s_secure_auth is enabled. + ''; + }; + + s2sSecureDomains = mkOption { + type = types.listOf types.str; + default = []; + example = [ "jabber.org" ]; + description = '' + Even if you leave s2s_secure_auth disabled, you can still require valid + certificates for some domains by specifying a list here. + ''; + }; + + modules = moduleOpts; extraModules = mkOption { @@ -266,27 +422,35 @@ in data_path = "/var/lib/prosody" - allow_registration = ${boolToString cfg.allowRegistration}; - - ${ optionalString cfg.modules.console "console_enabled = true;" } - ${ optionalString (cfg.ssl != null) (createSSLOptsStr cfg.ssl) } - admins = { ${lib.concatStringsSep ", " (map (n: "\"${n}\"") cfg.admins) } }; + admins = ${toLua cfg.admins} + + -- we already build with libevent, so we can just enable it for a more performant server + use_libevent = true modules_enabled = { ${ lib.concatStringsSep "\n\ \ " (lib.mapAttrsToList - (name: val: optionalString val ''"${name}";'') + (name: val: optionalString val "${toLua name};") cfg.modules) } - ${ optionalString cfg.allowRegistration "\"register\"\;" } - - ${ lib.concatStringsSep "\n" (map (x: "\"${x}\";") cfg.extraModules)} - - "posix"; + ${ lib.concatStringsSep "\n" (map (x: "${toLua x};") cfg.extraModules)} }; + allow_registration = ${toLua cfg.allowRegistration} + + c2s_require_encryption = ${toLua cfg.c2sRequireEncryption} + + s2s_require_encryption = ${toLua cfg.s2sRequireEncryption} + + s2s_secure_auth = ${toLua cfg.s2sSecureAuth} + + s2s_insecure_domains = ${toLua cfg.s2sInsecureDomains} + + s2s_secure_domains = ${toLua cfg.s2sSecureDomains} + + ${ cfg.extraConfig } ${ lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: '' diff --git a/pkgs/servers/xmpp/prosody/default.nix b/pkgs/servers/xmpp/prosody/default.nix index b0e3492c0da1..eb3e858ac4dc 100644 --- a/pkgs/servers/xmpp/prosody/default.nix +++ b/pkgs/servers/xmpp/prosody/default.nix @@ -1,14 +1,12 @@ { stdenv, fetchurl, libidn, openssl, makeWrapper, fetchhg , lua5, luasocket, luasec, luaexpat, luafilesystem, luabitop , withLibevent ? true, luaevent ? null -, withZlib ? true, luazlib ? null , withDBI ? true, luadbi ? null # use withExtraLibs to add additional dependencies of community modules , withExtraLibs ? [ ] , withCommunityModules ? [ ] }: assert withLibevent -> luaevent != null; -assert withZlib -> luazlib != null; assert withDBI -> luadbi != null; with stdenv.lib; @@ -16,7 +14,6 @@ with stdenv.lib; let libs = [ luasocket luasec luaexpat luafilesystem luabitop ] ++ optional withLibevent luaevent - ++ optional withZlib luazlib ++ optional withDBI luadbi ++ withExtraLibs; getPath = lib : type : "${lib}/lib/lua/${lua5.luaversion}/?.${type};${lib}/share/lua/${lua5.luaversion}/?.${type}"; @@ -27,12 +24,12 @@ let in stdenv.mkDerivation rec { - version = "0.9.12"; + version = "0.10.0"; name = "prosody-${version}"; src = fetchurl { url = "http://prosody.im/downloads/source/${name}.tar.gz"; - sha256 = "139yxqpinajl32ryrybvilh54ddb1q6s0ajjhlcs4a0rnwia6n8s"; + sha256 = "1644jy5dk46vahmh6nna36s79k8k668sbi3qamjb4q3c4m3y853l"; }; communityModules = fetchhg { @@ -65,7 +62,7 @@ stdenv.mkDerivation rec { meta = { description = "Open-source XMPP application server written in Lua"; license = licenses.mit; - homepage = http://www.prosody.im; + homepage = https://prosody.im; platforms = platforms.linux; maintainers = [ ]; }; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index e267a460d0d8..924058cc0919 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -12225,8 +12225,9 @@ with pkgs; hyp = callPackage ../servers/http/hyp/default.nix { }; prosody = callPackage ../servers/xmpp/prosody { - lua5 = lua5_1; - inherit (lua51Packages) luasocket luasec luaexpat luafilesystem luabitop luaevent luazlib luadbi; + # _compat can probably be removed on next minor version after 0.10.0 + lua5 = lua5_2_compat; + inherit (lua52Packages) luasocket luasec luaexpat luafilesystem luabitop luaevent luadbi; }; biboumi = callPackage ../servers/xmpp/biboumi { };