# Prosody Photo Uploads - Trent's Blog
Trent's blog of mostly technical documentations.

Skip to content

# Prosody Photo Uploads

date: 2021-01-25

## Introduction

Install prosody on Debian 10 with photoupload, postgresql database, and letsencrypt certs.

## DNS

- Log into your dns provider and create A and AAAA records for xmpp.example.com
- Log into your dns provider and create A and AAAA records for xmppupload.example.com

## FireWall

Incidentally, you definitely do want to use a non-standard ssh port for connecting over the internet.

I would suggest that a firewall is important, because I couldn't figure out how to completely disable port 5280 for the http protocol, in the clear, in the prosody config.

### ports

- `80/tcp`, `443/tcp` for certbot
- `4444/tcp` i.e. port 4444 for ssh
- `5222/tcp` for xmpp-client
- `5269/tcp` for xmpp-server
- `5281/tcp` for https connections to prosody for uploads and photos

### FireWall with UFW

- `ufw allow http`
- `ufw allow https`
- `ufw allow xmpp-client`
- `ufw allow xmpp-server`
- `ufw allow 5281/tcp`
- `ufw allow 4444/tcp` i.e. if 4444 for ssh
- `ufw enable` to start the firewall

## Postgresql Database

### Install the postgresql database.

    apt-get install postgresql postgresql-contrib

Log into the psql command line.

    sudo -u postgres psql

Create prosody database

    postgres=# CREATE DATABASE prosody;

Creat prosody user

    postgres=# CREATE ROLE prosody WITH LOGIN;

Set password for user

    postgres=# \password prosody

Quit `psql`

    postgres=# \q

### allow authentication in `pg_hba.conf`

To connect to postgresql via unix socket

    # /etc/postgresql/11/main/pg_hba.conf
    # make sure this line is above
    local   prosody         prosody                                 md5

    # make sure this line is below
    local   all             all                                     peer

or i.e. through a wireguard tunnel

    # /etc/postgresql/11/main/pg_hba.conf
    # where 10.0.22.5 is the ip address of the machine that prosody will run on
    host    prosody         prosody         10.0.22.5/32            md5

and then restart postgresql

    systemctl restart postgresql

## Prosody

### Install Prosody

    apt install prosody prosody-modules lua-dbi-postgresql

### Configure Prosody

backup the prosody config file

    cp /etc/prosody/prosody.cfg.lua /etc/prosody/prosody.cfg.lua.bak

if you want to disable advertising version and uptime, allow message archives, and disallow registration, change this

    -- /etc/prosody/prosody.cfg.lua
    modules_enabled = {

        ...

        -- Nice to have
          "version"; -- Replies to server version requests
          "uptime"; -- Report how long server has been running
          "time"; -- Let others know the time here on this server
          "ping"; -- Replies to XMPP pings with pongs
          "register"; -- Allow users to register on this server using a client and change passwords
          --"mam"; -- Store messages in an archive and allow users to access it
          --"csi_simple"; -- Simple Mobile optimizations

        ...
    }

to this

    -- /etc/prosody/prosody.cfg.lua
    modules_enabled = {

        ...

        -- Nice to have
          --"version"; -- Replies to server version requests
          --"uptime"; -- Report how long server has been running
          "time"; -- Let others know the time here on this server
          "ping"; -- Replies to XMPP pings with pongs
          --"register"; -- Allow users to register on this server using a client and change passwords
          "mam"; -- Store messages in an archive and allow users to access it
          --"csi_simple"; -- Simple Mobile optimizations

        ...
    }

to force certificate authentication for server-to-server connections, make the following edit around line 123

    -- /etc/prosody/prosody.cfg.lua
    -- Force certificate authentication for server-to-server connections?

    -- change this
    s2s_secure_auth = false
    -- to this
    s2s_secure_auth = true

around line 147 enable sql

    -- /etc/prosody/prosody.cfg.lua

    -- change this
    --storage = "sql"

    -- to this
    storage = "sql"

and describe the database connection

    -- /etc/prosody/prosody.cfg.lua

    -- change this
    --sql = {
      driver = "PostgreSQL",
      database = "prosody",
      username = "prosody",
      password = "secret",
      host = "localhost"
    }

    -- to this
    sql = {
      driver = "PostgreSQL",
      database = "prosody",
      username = "prosody",
      password = "secret",
      host = "localhost"
    }

    -- or to use a unix socket in Debian 10
    sql = {
      driver = "PostgreSQL",
      database = "prosody",
      username = "prosody",
      password = "secret",
      host = "/var/run/postgresql"
    }

somewhere around line 196, describe the certificate file for the upoad subdomain

    -- /etc/prosody/prosody.cfg.lua

    -- change this
    --https_certificate = "/etc/prosody/certs/localhost.crt"

    -- to this
    https_certificate = "/etc/prosody/certs/xmppupload.example.com.crt"

somewhere around line 210 describe your virtualhost

    -- /etc/prosody/prosody.cfg.lua
    VirtualHost "xmpp.example.com"

    disco_items = {
        {"xmppupload.example.com"},
    }

add the following to the end of the file

    -- /etc/prosody/prosody.cfg.lua
    Component "xmppupload.example.com" "http_upload"

and then restart prosody

    systemctl restart prososdy

## Certbot

install certbot

    apt install certbot

get certificates

    certbot certonly -d xmpp.example.com
    certbot certonly -d xmppupload.example.com

import the certificates into prosody and restart prosody

    prosodyctl --root cert import /etc/letsencrypt/live
    systemctl restart prosody

create the following renewal-hook for letsencrypt

    #!/bin/bash
    # /etc/letsencrypt/renewal-hooks/deploy/prosody_deploy_hook

    prosodyctl --root cert import /etc/letsencrypt/live