From 3197f5fc16ac7b2b73ca4ef3d193b55c54f9e923 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Fri, 13 Nov 2026 06:59:31 +0400
Subject: [PATCH] monitoring: probe XMPP c2s with a plain connect

blackbox_exporter matches query_response line by line, and ejabberd
writes its stream features and <proceed/> without newlines, so the
STARTTLS dialogue always timed out and the probe alert fired while
XMPP was fine. Port 5222 gets a TCP connect; the certificate is still
checked through direct TLS on 5223.

Assisted-by: Claude:opus-5-5
---
 ansible/roles/monitoring/defaults/main.yaml        |  4 +++-
 ansible/roles/monitoring/templates/blackbox.yml.j2 | 11 -----------
 2 files changed, 3 insertions(+), 12 deletions(-)

diff --git a/ansible/roles/monitoring/defaults/main.yaml b/ansible/roles/monitoring/defaults/main.yaml
index 293e704..5cd27c7 100644
--- a/ansible/roles/monitoring/defaults/main.yaml
+++ b/ansible/roles/monitoring/defaults/main.yaml
@@ -16,7 +16,9 @@ monitoring_probes:
   - { name: forgejo, target: "https://git.asxp.io/", module: http_2xx }
   - { name: s3, target: "https://s3.asxp.io/", module: http_up }
   - { name: sillytavern, target: "http://{{ asxpio_services_wireguard_ip }}:8000/", module: http_up }
-  - { name: xmpp c2s starttls, target: "xmpp.asxp.io:5222", module: xmpp_starttls }
+  # blackbox matches responses line by line and ejabberd sends no newlines,
+  # so a STARTTLS dialogue times out: plain connect here, TLS on 5223.
+  - { name: xmpp c2s, target: "xmpp.asxp.io:5222", module: tcp_connect }
   - { name: xmpp c2s tls, target: "xmpp.asxp.io:5223", module: tls_connect }
   - { name: xmpp s2s, target: "xmpp.asxp.io:5269", module: tcp_connect }
   - { name: turn, target: "xmpp.asxp.io:3478", module: tcp_connect }
diff --git a/ansible/roles/monitoring/templates/blackbox.yml.j2 b/ansible/roles/monitoring/templates/blackbox.yml.j2
index 402c3eb..27c3bc3 100644
--- a/ansible/roles/monitoring/templates/blackbox.yml.j2
+++ b/ansible/roles/monitoring/templates/blackbox.yml.j2
@@ -25,14 +25,3 @@ modules:
     tcp:
       preferred_ip_protocol: ip4
   # XMPP client port: stream header, STARTTLS, then the certificate
-  xmpp_starttls:
-    prober: tcp
-    timeout: 10s
-    tcp:
-      preferred_ip_protocol: ip4
-      query_response:
-        - send: "<?xml version='1.0'?><stream:stream to='asxp.io' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' version='1.0'>"
-        - expect: "urn:ietf:params:xml:ns:xmpp-tls"
-        - send: "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>"
-        - expect: "<proceed"
-        - starttls: true