ci: run Renovate from asxpi/renovate

Renovate now runs from its own repository for every repo, with the
shared rules in its preset. Extend that preset here and keep only what
is specific to this repo (the Ansible var manager, the Paper JRE, the
runner and nix notes); drop the workflow that ran it for iac alone.

Assisted-by: Claude:opus-5-5

nixos/hosts/asxpio-services/xmpp.nix

@@ -0,0 +1,134 @@
+# another.im XMPP server for asxp.io: ejabberd, apushd (push), tackygram
+# (Telegram gateway). After compose.yaml and compose.tackygram.yaml of
+# https://dev.another.im/another-im/anotherim-server, CERTS=files.
+#
+# Secrets and keys are host data in /opt/xmpp/state, like a game world,
+# and are covered by the restic backup:
+#   secrets.env          ejabberd secrets
+#   certs/server.pem     TLS certificate (asxp.io, conference., xmpp.)
+#   apushd/              push settings and VAPID key
+#   tackygram/{env,key}  gateway credentials and master key
+# Data: Docker volumes xmpp_database, xmpp_tackygram.
+{ config, pkgs, ... }:
+let
+  # renovate: datasource=docker depName=dev.another.im/another-im/anotherim-server
+  ejabberdVersion = "2026.11.07";
+  # renovate: datasource=docker depName=dev.another.im/another-im/apushd
+  apushdVersion = "0.2";
+  # renovate: datasource=docker depName=dev.another.im/another-im/tackygram
+  tackygramVersion = "0.4.3";
+
+  domain = "asxp.io";
+  publicIp = "46.62.228.216";
+  state = "/opt/xmpp/state";
+
+  tcpPorts = [
+    5222 # clients, STARTTLS
+    5223 # clients, direct TLS
+    5269 # other servers
+    5443 # WebSocket, host-meta
+    8448 # Matrix federation
+    3478 # STUN and TURN
+    7777 # SOCKS5 bytestreams proxy
+  ];
+  turnRelay = {
+    from = 49160;
+    to = 49199;
+  };
+  gatewayCalls = {
+    from = 50000;
+    to = 50099;
+  };
+  range = r: "${toString r.from}-${toString r.to}";
+
+  needsData.unitConfig.ConditionPathExists = "/opt/.restored";
+in
+{
+  virtualisation.oci-containers.containers = {
+    xmpp-ejabberd = {
+      image = "dev.another.im/another-im/anotherim-server:${ejabberdVersion}";
+      environment = {
+        EJABBERD_MACRO_XMPP_DOMAIN = domain;
+        EJABBERD_MACRO_TURN_IP = publicIp;
+        EJABBERD_MACRO_POW_DIFFICULTY = "6";
+        EJABBERD_MACRO_REGISTRATION_TIMEOUT = "600";
+        EJABBERD_MACRO_UPLOAD_URL = "https://hel1.your-objectstorage.com/asxpio-xmpp-public/";
+        EJABBERD_MACRO_ACME_URL = "https://acme-v02.api.letsencrypt.org/directory";
+      };
+      environmentFiles = [ "${state}/secrets.env" ];
+      ports =
+        map (p: "${toString p}:${toString p}") tcpPorts
+        ++ [
+          "3478:3478/udp"
+          "${range turnRelay}:${range turnRelay}/udp"
+          "${range gatewayCalls}:${range gatewayCalls}/udp"
+        ];
+      volumes = [
+        "xmpp_database:/opt/ejabberd/database"
+        "xmpp_logs:/opt/ejabberd/logs"
+        "${state}/certs:/opt/ejabberd/conf/certs:ro"
+      ];
+    };
+
+    # Push App Server and Telegram gateway share ejabberd's network
+    # namespace: they reach its component port on 127.0.0.1 only. They
+    # restart with it, since the namespace is gone when it stops.
+    xmpp-apushd = {
+      image = "dev.another.im/another-im/apushd:${apushdVersion}";
+      dependsOn = [ "xmpp-ejabberd" ];
+      networks = [ "container:xmpp-ejabberd" ];
+      volumes = [ "${state}/apushd:/etc/apushd:ro" ];
+    };
+
+    xmpp-tackygram = {
+      image = "dev.another.im/another-im/tackygram:${tackygramVersion}";
+      dependsOn = [ "xmpp-ejabberd" ];
+      networks = [ "container:xmpp-ejabberd" ];
+      environmentFiles = [ "${state}/tackygram/env" ];
+      environment = {
+        CREDENTIALS_DIRECTORY = "/run/credentials";
+        TACKYGRAM_CALL_IP = publicIp;
+        TACKYGRAM_CALL_PORTS = range gatewayCalls;
+      };
+      volumes = [
+        "xmpp_tackygram:/var/lib/tackygram"
+        "${state}/tackygram/key:/run/credentials/gateway-key:ro"
+      ];
+    };
+  };
+
+  systemd.services = {
+    docker-xmpp-ejabberd = needsData;
+    docker-xmpp-apushd = needsData;
+    docker-xmpp-tackygram = needsData;
+  };
+
+  # For IPv6; see containers.nix
+  networking.firewall = {
+    allowedTCPPorts = tcpPorts;
+    allowedUDPPorts = [ 3478 ];
+    allowedUDPPortRanges = [
+      turnRelay
+      gatewayCalls
+    ];
+  };
+
+  systemd.tmpfiles.rules = [ "d ${state} 0700 root root -" ];
+
+  # ejabberd's Mnesia through its own backup command, its SQLite through
+  # the online backup API
+  asxpio.backup = {
+    paths = [
+      "/var/lib/docker/volumes/xmpp_database"
+      "/var/lib/docker/volumes/xmpp_tackygram"
+    ];
+    hookPackages = [
+      config.virtualisation.docker.package
+      pkgs.sqlite
+    ];
+    preHooks = [
+      "docker exec xmpp-ejabberd ejabberdctl backup /opt/ejabberd/database/nightly.backup"
+      ''sqlite3 /var/lib/docker/volumes/xmpp_database/_data/ejabberd.sqlite ".backup '$STAGE/ejabberd.sqlite'"''
+    ];
+  };
+}