monitoring: probe XMPP c2s with a plain connect

blackbox_exporter matches query_response line by line, and ejabberd
writes its stream features and <proceed/> without newlines, so the
STARTTLS dialogue always timed out and the probe alert fired while
XMPP was fine. Port 5222 gets a TCP connect; the certificate is still
checked through direct TLS on 5223.

Assisted-by: Claude:opus-5-5

ansible/roles/monitoring/defaults/main.yaml

@@ -16,7 +16,9 @@ monitoring_probes:
   - { name: forgejo, target: "https://git.asxp.io/", module: http_2xx }
   - { name: s3, target: "https://s3.asxp.io/", module: http_up }
   - { name: sillytavern, target: "http://{{ asxpio_services_wireguard_ip }}:8000/", module: http_up }
-  - { name: xmpp c2s starttls, target: "xmpp.asxp.io:5222", module: xmpp_starttls }
+  # blackbox matches responses line by line and ejabberd sends no newlines,
+  # so a STARTTLS dialogue times out: plain connect here, TLS on 5223.
+  - { name: xmpp c2s, target: "xmpp.asxp.io:5222", module: tcp_connect }
   - { name: xmpp c2s tls, target: "xmpp.asxp.io:5223", module: tls_connect }
   - { name: xmpp s2s, target: "xmpp.asxp.io:5269", module: tcp_connect }
   - { name: turn, target: "xmpp.asxp.io:3478", module: tcp_connect }

ansible/roles/monitoring/templates/blackbox.yml.j2

@@ -25,14 +25,3 @@ modules:
     tcp:
       preferred_ip_protocol: ip4
   # XMPP client port: stream header, STARTTLS, then the certificate
-  xmpp_starttls:
-    prober: tcp
-    timeout: 10s
-    tcp:
-      preferred_ip_protocol: ip4
-      query_response:
-        - send: "<?xml version='1.0'?><stream:stream to='asxp.io' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' version='1.0'>"
-        - expect: "urn:ietf:params:xml:ns:xmpp-tls"
-        - send: "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>"
-        - expect: "<proceed"
-        - starttls: true