ansible: run the asxp.io XMPP server on asxpio-services

ejabberd, apushd and the tackygram gateway ran on the temporary
claude-test-xmpp server, a separate CX23 billed on its own. Move them
to asxpio-services, which has the room now that Fossils is gone, and
manage them like the other stacks.

Compose follows anotherim-server's compose.yaml and
compose.tackygram.yaml with CERTS=files; image versions are variables
so they can be tracked. The TURN and call addresses come from the
host's public IP instead of a hand-edited env file. Secrets, keys and
the certificate stay on the host under /opt/xmpp/state as data and are
covered by the restic backup.

Assisted-by: Claude:opus-5-5

ansible/inventory/group_vars/services_servers/xmpp.yaml

@@ -0,0 +1,14 @@
+---
+# another.im XMPP server for asxp.io: ejabberd, apushd (push), tackygram
+# (Telegram gateway). Upstream: https://dev.another.im/another-im/anotherim-server
+xmpp_domain: asxp.io
+
+# renovate: datasource=docker depName=dev.another.im/another-im/anotherim-server
+xmpp_ejabberd_version: "2026.11.07"
+# renovate: datasource=docker depName=dev.another.im/another-im/apushd
+xmpp_apushd_version: "0.2"
+# renovate: datasource=docker depName=dev.another.im/another-im/tackygram
+xmpp_tackygram_version: "0.4.1"
+
+xmpp_upload_url: https://hel1.your-objectstorage.com/asxpio-xmpp-public/
+xmpp_tackygram_call_ports: "50000-50099"

ansible/roles/xmpp/tasks/main.yaml

@@ -0,0 +1,20 @@
+---
+# Compose and settings are managed here. The secrets and keys stay on the
+# host as data, like a game world, and are covered by the restic backup:
+#   state/secrets.env          ejabberd secrets
+#   state/certs/server.pem     TLS certificate (asxp.io, conference., xmpp.)
+#   state/apushd/              push settings and VAPID key
+#   state/tackygram/{env,key}  gateway credentials and master key
+# Data: volumes xmpp_database, xmpp_tackygram.
+- name: Deploy XMPP
+  ansible.builtin.include_role:
+    name: docker_service
+  vars:
+    service_name: xmpp
+    service_base_path: "{{ services_base_path }}/xmpp"
+    service_directories:
+      - { path: state, mode: "0700" }
+    service_templates:
+      - { src: docker-compose.yml.j2, dest: docker-compose.yml }
+      - { src: settings.env.j2, dest: settings.env }
+    health_check_port: 5222

ansible/roles/xmpp/templates/docker-compose.yml.j2

@@ -0,0 +1,54 @@
+# Managed by Ansible (role xmpp). After compose.yaml and
+# compose.tackygram.yaml of anotherim-server, CERTS=files.
+services:
+  ejabberd:
+    image: dev.another.im/another-im/anotherim-server:{{ xmpp_ejabberd_version }}
+    env_file:
+      - settings.env
+      - state/secrets.env
+    ports:
+      - "5222:5222"                   # clients, STARTTLS
+      - "5223:5223"                   # clients, direct TLS
+      - "5269:5269"                   # other servers
+      - "5443:5443"                   # WebSocket, host-meta
+      - "8448:8448"                   # Matrix federation
+      - "3478:3478/udp"               # STUN and TURN
+      - "3478:3478/tcp"
+      - "49160-49199:49160-49199/udp" # TURN relay
+      - "7777:7777"                   # SOCKS5 bytestreams proxy
+      - "{{ xmpp_tackygram_call_ports }}:{{ xmpp_tackygram_call_ports }}/udp" # gateway calls
+    volumes:
+      - database:/opt/ejabberd/database
+      - logs:/opt/ejabberd/logs
+      - ./state/certs:/opt/ejabberd/conf/certs:ro
+    restart: unless-stopped
+
+  # Push App Server and Telegram gateway share ejabberd's network
+  # namespace: they reach its component port on 127.0.0.1 only.
+  apushd:
+    image: dev.another.im/another-im/apushd:{{ xmpp_apushd_version }}
+    network_mode: service:ejabberd
+    depends_on: [ejabberd]
+    volumes:
+      - ./state/apushd:/etc/apushd:ro
+    restart: unless-stopped
+
+  tackygram:
+    image: dev.another.im/another-im/tackygram:{{ xmpp_tackygram_version }}
+    network_mode: service:ejabberd
+    depends_on: [ejabberd]
+    env_file:
+      - state/tackygram/env
+    environment:
+      CREDENTIALS_DIRECTORY: /run/credentials
+      TACKYGRAM_CALL_IP: "{{ public_ip }}"
+      TACKYGRAM_CALL_PORTS: "{{ xmpp_tackygram_call_ports }}"
+    volumes:
+      - tackygram:/var/lib/tackygram
+      - ./state/tackygram/key:/run/credentials/gateway-key:ro
+    restart: unless-stopped
+
+volumes:
+  database:
+  logs:
+  tackygram:

ansible/roles/xmpp/templates/settings.env.j2

@@ -0,0 +1,6 @@
+EJABBERD_MACRO_XMPP_DOMAIN={{ xmpp_domain }}
+EJABBERD_MACRO_TURN_IP={{ public_ip }}
+EJABBERD_MACRO_POW_DIFFICULTY=6
+EJABBERD_MACRO_REGISTRATION_TIMEOUT=600
+EJABBERD_MACRO_UPLOAD_URL={{ xmpp_upload_url }}
+EJABBERD_MACRO_ACME_URL=https://acme-v02.api.letsencrypt.org/directory

ansible/site.yaml

@@ -27,7 +27,9 @@
   roles:
     - { role: sillytavern, tags: [sillytavern] }
     - { role: minecraft, tags: [minecraft] }
-    - { role: minecraft_fossils, tags: [minecraft_fossils] }  # retired: stops it
+    - { role: minecraft_fossils, tags: [minecraft_fossils] }  # retired: stops it, before xmpp needs the RAM
+    - { role: xmpp, tags: [xmpp] }
+    - { role: xray, tags: [xray] }
 
 # Late: restarting Forgejo briefly cuts the runner off from its job log
 - name: Forgejo