saklas: setup prosody

The last service that needed to be setup from the previous VPS.

1 files changed, 25 insertions, 2 deletions

diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
index e8a79f6..a1eb3b5 100644
--- a/hosts/saklas/default.nix
+++ b/hosts/saklas/default.nix
@@ -38,7 +38,7 @@
     wireless.enable = false;
 
     firewall = {
-      allowedTCPPorts = [ 22 80 443 ];
+      allowedTCPPorts = [ 22 80 443 5222 5269 ];
       allowedUDPPorts = [ 3478 51820 ];
     };
   };
@@ -52,7 +52,7 @@
         "95.217.18.52/32"
         "2a01:4f9:c010:a653::1/64"
       ];
-      dns = [ "9.9.9.9" ];
+      dns = [ "185.12.64.1" "185.12.64.2" ];
       routes = [
         { Destination = "172.31.1.1"; }
         { Gateway = "172.31.1.1"; GatewayOnLink = true; }
@@ -131,6 +131,12 @@
         "vinbiz.ca".extraDomainNames = [ "*.vinbiz.ca" ];
         "vineetk.net".extraDomainNames = [ "*.vineetk.net" ];
         "13f0.net".extraDomainNames = [ "*.13f0.net" ];
+
+        "xmpp.vineetk.net" = {
+          group = config.services.prosody.group;
+          extraDomainNames = [ "vineetk.net" "muc.vineetk.net" "u.vineetk.net" ];
+          reloadServices = [ "prosody" ];
+        };
       };
     };
 
@@ -176,6 +182,23 @@
       openFirewall = true;
     };
 
+    # XMPP
+    prosody = {
+      enable = true;
+
+      admins = [ "vin@vineetk.net" ];
+      httpFileShare.domain = "u.vineetk.net";
+
+      ssl.cert = config.security.acme.certs."xmpp.vineetk.net".directory + "/full.pem";
+      ssl.key = config.security.acme.certs."xmpp.vineetk.net".directory + "/key.pem";
+
+      muc = [{ domain = "muc.vineetk.net"; }];
+      virtualHosts.vineetk = {
+        domain = "vineetk.net";
+        enabled = true;
+      };
+    };
+
     # web server and reverse proxy
     nginx = {
       enable = true;