← Back to home

>Prosody_

This guide is for installing Prosody, an XMPP server that is decentralized, fast, simple and FOSS. The version we will be using is 0.11.12 and in the end the user will have a private and only c2s server. These options are of course changeable after or during the installation.

Prerequisites

GNU/Linux system
VPS (recommended) or a home server
Domain name
Basic terminal knowledge

Installation

We install the main packages plus some extras for TLS encryption, A/V streaming, and file transfering. If you don’t care about these things you can skip them.

On Debian/Ubuntu:

apt install prosody prosody-modules python3-certbot-nginx coturn mercurial

prosody is the main package
prosody-modules are some extra packages for functionability
python3-certbot-nginx is for TLS encryption
coturn a STUN/TURN server that allows A/V streaming for users behind NAT
mercurial for installing community modules for the STUN/TURN server

Configuration

The server’s CFG file is at /etc/prosody/prosody.cfg.lua.

Admin, users and the domain name

...
admins = { "admin1@domain.org", "admin2@domain.org" }
...
VirtualHost = "domain.org"
...

Now from the terminal add some users:

prosodyctl adduser user@domain.org

The program will prompt for a password. To delete a user use the command deluser, and for changing passwords use passwd, both with the JID as an option.

Modules enabled/disabled, user registration

Search for the line modules_enabled and add the modules http_files (file transfer), turn_external (STUN/TURN server) and uncomment csi_simple and disco if they are commented. Under modules_disabled only leave s2s uncommented. Finally, check if in the following lines allow_registration is set to false, which is self explanatory.

File transfering

We will be configuring two components in the CFG file. You should add them after the VirtualHost section.

Component "upload.domain.org" "http_upload"

Right after we add http_upload_file_size_limit = 20971520 and http_upload_expire_after = 60 * 60 * 24 * 7, for limiting the file size and setting its expiration.

Now, in the global section (before VirtualHost) add:

-- HTTP/HTTPS ports
http_ports = { 5280 }
http_interfaces = { "*", "::" }

https_ports = { 5281 }
https_interfaces = { "*", "::" }

If it is your case, remember to configure your firewall accordingly.

After VirtualHost we add:

disco_items = {
	{ "upload.domain.org", "File Sharing Service" },
}

In the components section:

Component "proxy.domain.org" "proxy65"
proxy65_address = "domain.org"

There is no need to add proxy65 to the modules_enabled list. This component lets users behind NAT transfer files.

Coturn: The STUN/TURN server

Check if coturn is running:

systemctl status coturn

If not start it:

systemctl enable --now coturn

Next thing to do is downloading and setting the correct modules from the community repository using mercurial.

hg clone https://hg.prosody.im/prosody-modules/ prosody-modules

Now you can either copy (not recommended) the modules mod_turn_external.lua and mod_external_services.lua to /usr/lib/prosody/modules or create another folder for the community plugins that will be installed and create symlinks for them. For the second option, add the created folder to the plugins path in prosody.cfg.lua:

plugins_path { "usr/lib/prosody/modules", "enabled/plugins/folder" }

Create the symlinks from the community downloaded folder to your plugins enabled folder (it depends on where you downloaded those modules):

ln -s /downloadedfolder/mod_turn_external/mod_turn_external.lua /enabled/folder
ln -s /downloadedfolder/mod_external_services/mod_external_services.lua /enabled/folder

We edit the coturn cfg file that is located in /etc/turnserver.conf:

realm=turn.domain.org
static-auth-secret=yoursecretpassword

Finally uncomment use-auth-secret

We go back to our prosody.cfg.lua file. In the global section add:

turn_external_host = "turn.domain.org"
turn_external_secret = "yoursecretpassword"

VERY IMPORTANT: Certificates

We need to generate certificates for the domain and every subdomain we are using for our components. Also, we need to check for some configuration options that could be missing or commented.

First we generate:

certbot -d domain.org --nginx
certbot -d upload.domain.org --nginx
certbot -d proxy.domain.org --nginx
certbot -d turn.domain.org --nginx

The bot will give you some output in the terminal and prompt you for two options: select the second one every time.

Now, we need to import/install the certs to prosody:

prosodyctl --root cert import /etc/letsencrypt/live/

The TLS encryption for the file transfering module needs to be explicitly configured, and for that we edit prosody.cfg.lua and add to global:

https_ssl = {
	certificate = "/etc/prosody/certs/upload.domain.org.crt";
	key = "/etc/prosody/certs/upload.domain.org.key";
}

Pay attention to the extension names and double check that you got the right path and files for each line.

Inside the same file, check the following line and set it to true:

c2s_require_encryption = true

We are done with our file transfering configuration.

For the STUN/TURN server we also need to modify its CFG file /etc/turnserver.conf to set a path for our certs:

cert=/etc/letsencrypt/live/turn.domain.org/fullchain.pem
pkey=/etc/letsencrypt/live/turn.domain.org/privkey.pem

Done. You can check for errors using prosodyctl check. As a final note, I should add that if you are using a VPS you probably have a firewall working. There are some ports that need to be forwarded: 5280, 5281, 5222, 5322, 5000, 3478. If you are not using a firewall I recommend you using ufw and start from there.

Also, that this configuration is very personal. You can add more components (for example multichat groups). For that you should RTFM, which is always ideal.

Prosody Docs