Inferencium/cfg
1
0
Fork 0
Code Issues Activity

Optimise encryption. Add TLS certificates. Remove ACME.

Browse Source
This commit is contained in:
inference 2023-02-19 22:13:27 +00:00
parent 069a0a14d9
commit 756a4ef943
Signed by: inference
SSH Key Fingerprint: SHA256:9Pl0nZ2UJacgm+IeEtLSZ4FOESgP1eKCtRflfPfdX9M
1 changed files with 36 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
server/xb000-0/ejabberd/ejabberd.yml
View File

@ -4,7 +4,7 @@
# Copyright 2022-2023 Jake Winters # Copyright 2022-2023 Jake Winters
# SPDX-License-Identifier: GPL-3.0-or-later # SPDX-License-Identifier: GPL-3.0-or-later
# Version: 3.0.0.4 # Version: 4.0.0.5
# Hosts # Hosts
@ -30,19 +30,8 @@ auth_scram_hash: sha256
### having passwords created using SHA-256. ### having passwords created using SHA-256.
#auth_scram_hash: sha512 #auth_scram_hash: sha512
## Client-to-Server
c2s_ciphers:
- "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
c2s_protocol_options:
- no_sslv2
- no_sslv3
- no_tlsv1
- no_tlsv1_1
- no_compression
- cipher_server_preferences
c2s_tls_compression: false
## Server-to-Server ## Server-to-Server
s2s_dhfile: "/etc/ssl/inferencium.net/dh-3072.pem"
s2s_ciphers: s2s_ciphers:
- "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256" - "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
s2s_protocol_options: s2s_protocol_options:
@ -50,7 +39,6 @@ s2s_protocol_options:
- no_sslv3 - no_sslv3
- no_tlsv1 - no_tlsv1
- no_tlsv1_1 - no_tlsv1_1
- no_compression
- cipher_server_preferences - cipher_server_preferences
s2s_use_starttls: required s2s_use_starttls: required
s2s_tls_compression: false s2s_tls_compression: false
@ -63,31 +51,60 @@ loglevel: info
hide_sensitive_log_data: true hide_sensitive_log_data: true
# Certificates # Certificates
ca_file: "/etc/ssl/certs/ca-certificates.crt"
certfiles: certfiles:
- "/etc/ejabberd/certs/*/*.pem" ## dissensionclub.net
- "/etc/ssl/dissensionclub.net/ejabberd.pem"
## inferencium.net
- "/etc/ssl/inferencium.net/ejabberd.pem"
- "/etc/ssl/hfu.xmpp.inferencium.net/ejabberd.pem"
- "/etc/ssl/muc.xmpp.inferencium.net/ejabberd.pem"
- "/etc/ssl/xmpp.inferencium.net/ejabberd.pem"
listen: listen:
- -
port: 5222 port: 5222
ip: "::" ip: "::"
module: ejabberd_c2s module: ejabberd_c2s
dhfile: "/etc/ssl/inferencium.net/dh-3072.pem"
protocol_options:
- no_sslv2
- no_sslv3
- no_tlsv1
- no_tlsv1_1
ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
starttls: true
starttls_required: true
tls_compression: false
max_stanza_size: 262144 max_stanza_size: 262144
shaper: c2s_shaper shaper: c2s_shaper
access: c2s access: c2s
starttls_required: true
- -
port: 5223 port: 5223
ip: "::" ip: "::"
tls: true
module: ejabberd_c2s module: ejabberd_c2s
dhfile: "/etc/ssl/inferencium.net/dh-3072.pem"
tls: true
protocol_options:
- no_sslv2
- no_sslv3
- no_tlsv1
- no_tlsv1_1
ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
tls_compression: false
max_stanza_size: 262144 max_stanza_size: 262144
shaper: c2s_shaper shaper: c2s_shaper
access: c2s access: c2s
starttls_required: true
- -
port: 5269 port: 5269
ip: "::" ip: "::"
module: ejabberd_s2s_in module: ejabberd_s2s_in
tls: true
protocol_options:
- no_sslv2
- no_sslv3
- no_tlsv1
- no_tlsv1_1
max_stanza_size: 524288 max_stanza_size: 524288
- -
port: 5443 port: 5443
@ -113,7 +130,6 @@ listen:
module: ejabberd_http module: ejabberd_http
request_handlers: request_handlers:
/admin: ejabberd_web_admin /admin: ejabberd_web_admin
/.well-known/acme-challenge: ejabberd_acme
- -
port: 3478 port: 3478
ip: "::" ip: "::"