iac/nixos/hosts/asxpio-services/xmpp.nix

# another.im XMPP server for asxp.io: ejabberd, apushd (push), tackygram
# (Telegram gateway). After compose.yaml and compose.tackygram.yaml of
# https://dev.another.im/another-im/anotherim-server, CERTS=files.
#
# Secrets and keys are host data in /opt/xmpp/state, like a game world,
# and are covered by the restic backup:
#   secrets.env          ejabberd secrets
#   certs/server.pem     TLS certificate (asxp.io, conference., xmpp.)
#   apushd/              push settings and VAPID key
#   tackygram/{env,key}  gateway credentials and master key
# Data: Docker volumes xmpp_database, xmpp_tackygram.
{ config, pkgs, ... }:
let
  # renovate: datasource=docker depName=dev.another.im/another-im/anotherim-server
  ejabberdVersion = "2026.11.07";
  # renovate: datasource=docker depName=dev.another.im/another-im/apushd
  apushdVersion = "0.2";
  # renovate: datasource=docker depName=dev.another.im/another-im/tackygram
  tackygramVersion = "0.4.3";

  domain = "asxp.io";
  publicIp = "46.62.228.216";
  state = "/opt/xmpp/state";

  tcpPorts = [
    5222 # clients, STARTTLS
    5223 # clients, direct TLS
    5269 # other servers
    5443 # WebSocket, host-meta
    8448 # Matrix federation
    3478 # STUN and TURN
    7777 # SOCKS5 bytestreams proxy
  ];
  turnRelay = {
    from = 49160;
    to = 49199;
  };
  gatewayCalls = {
    from = 50000;
    to = 50099;
  };
  range = r: "${toString r.from}-${toString r.to}";

  needsData.unitConfig.ConditionPathExists = "/opt/.restored";
in
{
  virtualisation.oci-containers.containers = {
    xmpp-ejabberd = {
      image = "dev.another.im/another-im/anotherim-server:${ejabberdVersion}";
      environment = {
        EJABBERD_MACRO_XMPP_DOMAIN = domain;
        EJABBERD_MACRO_TURN_IP = publicIp;
        EJABBERD_MACRO_POW_DIFFICULTY = "6";
        EJABBERD_MACRO_REGISTRATION_TIMEOUT = "600";
        EJABBERD_MACRO_UPLOAD_URL = "https://hel1.your-objectstorage.com/asxpio-xmpp-public/";
        EJABBERD_MACRO_ACME_URL = "https://acme-v02.api.letsencrypt.org/directory";
      };
      environmentFiles = [ "${state}/secrets.env" ];
      ports =
        map (p: "${toString p}:${toString p}") tcpPorts
        ++ [
          "3478:3478/udp"
          "${range turnRelay}:${range turnRelay}/udp"
          "${range gatewayCalls}:${range gatewayCalls}/udp"
        ];
      volumes = [
        "xmpp_database:/opt/ejabberd/database"
        "xmpp_logs:/opt/ejabberd/logs"
        "${state}/certs:/opt/ejabberd/conf/certs:ro"
      ];
    };

    # Push App Server and Telegram gateway share ejabberd's network
    # namespace: they reach its component port on 127.0.0.1 only. They
    # restart with it, since the namespace is gone when it stops.
    xmpp-apushd = {
      image = "dev.another.im/another-im/apushd:${apushdVersion}";
      dependsOn = [ "xmpp-ejabberd" ];
      networks = [ "container:xmpp-ejabberd" ];
      volumes = [ "${state}/apushd:/etc/apushd:ro" ];
    };

    xmpp-tackygram = {
      image = "dev.another.im/another-im/tackygram:${tackygramVersion}";
      dependsOn = [ "xmpp-ejabberd" ];
      networks = [ "container:xmpp-ejabberd" ];
      environmentFiles = [ "${state}/tackygram/env" ];
      environment = {
        CREDENTIALS_DIRECTORY = "/run/credentials";
        TACKYGRAM_CALL_IP = publicIp;
        TACKYGRAM_CALL_PORTS = range gatewayCalls;
      };
      volumes = [
        "xmpp_tackygram:/var/lib/tackygram"
        "${state}/tackygram/key:/run/credentials/gateway-key:ro"
      ];
    };
  };

  systemd.services = {
    docker-xmpp-ejabberd = needsData;
    docker-xmpp-apushd = needsData;
    docker-xmpp-tackygram = needsData;
  };

  # For IPv6; see containers.nix
  networking.firewall = {
    allowedTCPPorts = tcpPorts;
    allowedUDPPorts = [ 3478 ];
    allowedUDPPortRanges = [
      turnRelay
      gatewayCalls
    ];
  };

  systemd.tmpfiles.rules = [ "d ${state} 0700 root root -" ];

  # ejabberd's Mnesia through its own backup command, its SQLite through
  # the online backup API
  asxpio.backup = {
    paths = [
      "/var/lib/docker/volumes/xmpp_database"
      "/var/lib/docker/volumes/xmpp_tackygram"
    ];
    hookPackages = [
      config.virtualisation.docker.package
      pkgs.sqlite
    ];
    preHooks = [
      "docker exec xmpp-ejabberd ejabberdctl backup /opt/ejabberd/database/nightly.backup"
      ''sqlite3 /var/lib/docker/volumes/xmpp_database/_data/ejabberd.sqlite ".backup '$STAGE/ejabberd.sqlite'"''
    ];
  };
}