xmpp.nix

{ pkgs, config, ... }:

{

  /* XMPP */

  services.prosody = {
    enable = true;
    xmppComplianceSuite = false;
    virtualHosts."internal" = {
      enabled = true;
      domain = "xmpp.typeclasses.com";
      ssl.cert = "/var/lib/acme/xmpp.typeclasses.com/fullchain.pem";
      ssl.key = "/var/lib/acme/xmpp.typeclasses.com/key.pem";
    };
  };

  networking.firewall.allowedTCPPorts = [ 5222 ];

  environment.systemPackages = [ pkgs.prosody ];


  /* Crypto */

  services.nginx.virtualHosts."xmpp.typeclasses.com" = {
    forceSSL = true;
    enableACME = true;
    locations."/".proxyPass = "http://localhost:5280";
  };

  security.acme.certs."xmpp.typeclasses.com" = {
    reloadServices = [ "prosody.service" ];
    group = config.services.prosody.group;
  };

  users.users.nginx.extraGroups = [ config.services.prosody.group ];

}