Cloudron Forum

I wanted to keep using the account that has the app dev badge
Also may have lost access to the old one over the years.

@girish I consider this app ready for Beta submission to cloudron app store.

@murgero movim looks interesting, I can totally see it as another app on cloudron. XMPP allows for 3rd party web clients over BOSH/websockets. I would set up CORS on prosody for this, if not already supported.

@murgero If you want to use JIDs like murgero@chat.example.com - no special instructions, it works as is.

If you want your JID to be murgero@example.com - currently you must choose example.com as cloudron app domain, otherwise it won't work.

XMPP allows you to have JIDs on a different server than where A-record is pointing to, see https://www.rfc-editor.org/rfc/rfc6120#section-3.2.1

Notice that the server must present a valid CA-trusted TLS certificate for example.com in this set up, not it's own chat.example.com.

Currently prosody.cfg.lua is not set up to handle other domains except the one that the app is installed as. For me it does not make sense to implement the config handling unless I have a way to provide no-manual-actions experience.

Feel free to contribute though.

@jdaviescoates as I posted on 18 Jul 2018, 20:23:

I have packaged this as https://git.cloudron.io/synchrone/jabber-app

@murgero the blockers for my dream-world Jabber app on Cloudron are not related to configuring prosody. It's done already and I for one am using the current jabber-app daily.

The remaining issues are related to lack of interfaces to editing DNS (SRV, TXT) records from inside cloudron apps. That is going to affect any XMPP implementation.

I appreciate your feedback, but please look into the actual limitations instead of jumping to between shiny end-user brandings.

@murgero I have. From what i see - it does not have the actual web client, just the management interface.

As for the XMPP server itself - it is in fact prosody, so nothing special there.

Why?

Ok, certificates are in place (thanks @girish) so now jabber-app is in a useable state with server-to-server communication, AND mutli-user chatrooms support.

One problem is that when we limit MUC room creation to local users only (so random people off the internet won't be able to create public rooms on your conference.example.com) - prosody expects your local JIDs to be user@example.com, not user@chat.example.com.

I have side-stepped this by defaulting jabber-app's conference subdomain to conference.chat.example.com, and not conference.example.com. So it's possible misconfiguration by the end user will result in the MUC component not being functional.

Another problem is, I would like to be able to use cloudron's apex domain as my JID host (syn@example.com, not syn@chat.example.com)

That requires 2 things:

• DNS management to add SRV records (we can probably have the users manually do that with a generated instruction)
• Access to the TLS certificate for apex domain
  • alternatively, TLS-proxied ports 5223/5270, although I'm not certain what is the state of Direct TLS adoption among clients/server implementations these days

then a small patch for prosofy.cfg.lua should enable those upper-level VirtualHosts, and it's done.

@girish sure. This has waited for years. Can wait another couple months

Also can you please rename this topic into "Prosody + Converse.js" ? Kaiwa is long since unmaintained and even forks have also dried up.

@girish in my provisional implementation I am using the key from httpPort for a predictable certificate/key locations.

given:

"httpPorts": {
    "CONFERENCE_DOMAIN": {
      "title": "Conference Service Domain",
      "description": "XEP-0045 domain",
      "containerPort": 5280,
      "defaultValue": "conference.chat"
    }
  },

the expected paths by convention are:

ssl = {
        certificate = "/etc/certs/secondary/CONFERENCE_DOMAIN.cert";
        key = "/etc/certs/secondary/CONFERENCE_DOMAIN.key";
    }

but I do not insist on this method. I would be perfectly fine with listing that directory to find out which domains exist, as well as environment variable based paths per a predictable httpPorts key.

So each feature is in it's own subdomain, is it?

not necessarily. E.g file uploads and proxy65 turned out to not need their own TLS certificates.

However, XMPP components that participate in federation MUST authenticate themselves for server-to-server communication via TLS. In my current configuration there is a Multi-User chat component that acts as it's own entity under "conference.chat.example.com" and must present a CA-trusted TLS certificate for that domain. Same goes for pubsub service.

This is necessary because other XMPP servers will expect to talk to "conference.chat.example.com" on port 5269 or 5222 with STARTTLS.

I do not expect many more components to be there. In total under 5 in the scope of this app. There may be a different XMPP Transports app that will have it's own configuration, but right now I'm focused on getting the core functionality.

As to why Jitsi is working ... I would need to check that code, but perhaps they do not do server-to-server xmpp ? Everything would happily work within the boundaries of the single prosody server, but outside world XMPP federation wouldn't work.

@nebulon that feature is already implemented. Has been there since cloudron 6.2.0 as far as I can see

Now that cloudron has custom secondary domains feature, some apps that require their own TLS on subdomains (like XMPP servers) are made possible.

Here is a patch that expands TLS addon to support this:
https://git.cloudron.io/synchrone/box/-/commit/575247af0610dd6cc76142fe697e5415b256427b

This will help the following prospective apps to provide a sufficient level of XMPP support, as verifying TLS on their TCP ports under subdomain names is mandatory nowadays:

https://forum.cloudron.io/topic/7755/openfire-xmpp-server
https://forum.cloudron.io/topic/2486/ejabberd-robust-scalable-and-extensible-realtime-server-using-xmpp-mqtt-and-sip/12
https://forum.cloudron.io/topic/4188/snikket-server-your-own-messaging-server-in-a-box/9
https://forum.cloudron.io/topic/1234/prosody-kaiwa/5

Okay, 4 years later, we now have a fairly good prosody 0.12 release (March-June 2022).

Components like Multi-User Chat, and Proxy65 for file uploads require their own TLS certificates, which is now sort of possible via Secondary Domains aka "httpPorts" introduced in December 2021.

The only thing missing is accessing those TLS certs via tls add-on. It should work if you just upload your certs to /app/data/certs as well though.

@jdaviescoates: converse.js gets served on the frontend, yes. There is also a fully featured Prosody.im installation, so it's a fully-featured xmpp/jabber server, and you can use any compatible client app with it.

I have finished packaging it.

https://git.cloudron.io/synchrone/mastodon-app

The app needs a minimum of 640 MB of RAM to start up and stabilize. After it, the memory consumption seems to go down a bit, but cloudron will still require that much for it.

It is available for testing under <your-cloudron>/#/appstore/org.joinmastodon.cloudronapp?version=2.6.1