From f07eb950302d84c03d793982b9fe27839fceab22 Mon Sep 17 00:00:00 2001 From: Sergei Poljanski Date: Thu, 12 Nov 2026 20:56:42 +0400 Subject: [PATCH] ansible: run the asxp.io XMPP server on asxpio-services ejabberd, apushd and the tackygram gateway ran on the temporary claude-test-xmpp server, a separate CX23 billed on its own. Move them to asxpio-services, which has the room now that Fossils is gone, and manage them like the other stacks. Compose follows anotherim-server's compose.yaml and compose.tackygram.yaml with CERTS=files; image versions are variables so they can be tracked. The TURN and call addresses come from the host's public IP instead of a hand-edited env file. Secrets, keys and the certificate stay on the host under /opt/xmpp/state as data and are covered by the restic backup. Assisted-by: Claude:opus-5-5 --- .../group_vars/services_servers/xmpp.yaml | 14 +++++ ansible/roles/xmpp/tasks/main.yaml | 20 +++++++ .../xmpp/templates/docker-compose.yml.j2 | 54 +++++++++++++++++++ ansible/roles/xmpp/templates/settings.env.j2 | 6 +++ ansible/site.yaml | 4 +- 5 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 ansible/inventory/group_vars/services_servers/xmpp.yaml create mode 100644 ansible/roles/xmpp/tasks/main.yaml create mode 100644 ansible/roles/xmpp/templates/docker-compose.yml.j2 create mode 100644 ansible/roles/xmpp/templates/settings.env.j2 diff --git a/ansible/inventory/group_vars/services_servers/xmpp.yaml b/ansible/inventory/group_vars/services_servers/xmpp.yaml new file mode 100644 index 0000000..ec2ea5c --- /dev/null +++ b/ansible/inventory/group_vars/services_servers/xmpp.yaml @@ -0,0 +1,14 @@ +--- +# another.im XMPP server for asxp.io: ejabberd, apushd (push), tackygram +# (Telegram gateway). Upstream: https://dev.another.im/another-im/anotherim-server +xmpp_domain: asxp.io + +# renovate: datasource=docker depName=dev.another.im/another-im/anotherim-server +xmpp_ejabberd_version: "2026.11.07" +# renovate: datasource=docker depName=dev.another.im/another-im/apushd +xmpp_apushd_version: "0.2" +# renovate: datasource=docker depName=dev.another.im/another-im/tackygram +xmpp_tackygram_version: "0.4.1" + +xmpp_upload_url: https://hel1.your-objectstorage.com/asxpio-xmpp-public/ +xmpp_tackygram_call_ports: "50000-50099" diff --git a/ansible/roles/xmpp/tasks/main.yaml b/ansible/roles/xmpp/tasks/main.yaml new file mode 100644 index 0000000..77d9c6b --- /dev/null +++ b/ansible/roles/xmpp/tasks/main.yaml @@ -0,0 +1,20 @@ +--- +# Compose and settings are managed here. The secrets and keys stay on the +# host as data, like a game world, and are covered by the restic backup: +# state/secrets.env ejabberd secrets +# state/certs/server.pem TLS certificate (asxp.io, conference., xmpp.) +# state/apushd/ push settings and VAPID key +# state/tackygram/{env,key} gateway credentials and master key +# Data: volumes xmpp_database, xmpp_tackygram. +- name: Deploy XMPP + ansible.builtin.include_role: + name: docker_service + vars: + service_name: xmpp + service_base_path: "{{ services_base_path }}/xmpp" + service_directories: + - { path: state, mode: "0700" } + service_templates: + - { src: docker-compose.yml.j2, dest: docker-compose.yml } + - { src: settings.env.j2, dest: settings.env } + health_check_port: 5222 diff --git a/ansible/roles/xmpp/templates/docker-compose.yml.j2 b/ansible/roles/xmpp/templates/docker-compose.yml.j2 new file mode 100644 index 0000000..cc0c148 --- /dev/null +++ b/ansible/roles/xmpp/templates/docker-compose.yml.j2 @@ -0,0 +1,54 @@ +# Managed by Ansible (role xmpp). After compose.yaml and +# compose.tackygram.yaml of anotherim-server, CERTS=files. +services: + ejabberd: + image: dev.another.im/another-im/anotherim-server:{{ xmpp_ejabberd_version }} + env_file: + - settings.env + - state/secrets.env + ports: + - "5222:5222" # clients, STARTTLS + - "5223:5223" # clients, direct TLS + - "5269:5269" # other servers + - "5443:5443" # WebSocket, host-meta + - "8448:8448" # Matrix federation + - "3478:3478/udp" # STUN and TURN + - "3478:3478/tcp" + - "49160-49199:49160-49199/udp" # TURN relay + - "7777:7777" # SOCKS5 bytestreams proxy + - "{{ xmpp_tackygram_call_ports }}:{{ xmpp_tackygram_call_ports }}/udp" # gateway calls + volumes: + - database:/opt/ejabberd/database + - logs:/opt/ejabberd/logs + - ./state/certs:/opt/ejabberd/conf/certs:ro + restart: unless-stopped + + # Push App Server and Telegram gateway share ejabberd's network + # namespace: they reach its component port on 127.0.0.1 only. + apushd: + image: dev.another.im/another-im/apushd:{{ xmpp_apushd_version }} + network_mode: service:ejabberd + depends_on: [ejabberd] + volumes: + - ./state/apushd:/etc/apushd:ro + restart: unless-stopped + + tackygram: + image: dev.another.im/another-im/tackygram:{{ xmpp_tackygram_version }} + network_mode: service:ejabberd + depends_on: [ejabberd] + env_file: + - state/tackygram/env + environment: + CREDENTIALS_DIRECTORY: /run/credentials + TACKYGRAM_CALL_IP: "{{ public_ip }}" + TACKYGRAM_CALL_PORTS: "{{ xmpp_tackygram_call_ports }}" + volumes: + - tackygram:/var/lib/tackygram + - ./state/tackygram/key:/run/credentials/gateway-key:ro + restart: unless-stopped + +volumes: + database: + logs: + tackygram: diff --git a/ansible/roles/xmpp/templates/settings.env.j2 b/ansible/roles/xmpp/templates/settings.env.j2 new file mode 100644 index 0000000..cf87eec --- /dev/null +++ b/ansible/roles/xmpp/templates/settings.env.j2 @@ -0,0 +1,6 @@ +EJABBERD_MACRO_XMPP_DOMAIN={{ xmpp_domain }} +EJABBERD_MACRO_TURN_IP={{ public_ip }} +EJABBERD_MACRO_POW_DIFFICULTY=6 +EJABBERD_MACRO_REGISTRATION_TIMEOUT=600 +EJABBERD_MACRO_UPLOAD_URL={{ xmpp_upload_url }} +EJABBERD_MACRO_ACME_URL=https://acme-v02.api.letsencrypt.org/directory diff --git a/ansible/site.yaml b/ansible/site.yaml index 1c7eb1b..9cb1e44 100644 --- a/ansible/site.yaml +++ b/ansible/site.yaml @@ -27,7 +27,9 @@ roles: - { role: sillytavern, tags: [sillytavern] } - { role: minecraft, tags: [minecraft] } - - { role: minecraft_fossils, tags: [minecraft_fossils] } # retired: stops it + - { role: minecraft_fossils, tags: [minecraft_fossils] } # retired: stops it, before xmpp needs the RAM + - { role: xmpp, tags: [xmpp] } + - { role: xray, tags: [xray] } # Late: restarting Forgejo briefly cuts the runner off from its job log - name: Forgejo