tests

test-ak eguneratu
lehenetsitako aldagaiak zuzenean cfg.lua fitxategietan txertatu.
2026-08-02 13:31:05 +02:00 · 2026-07-30 23:09:51 +02:00 · 2026-07-30 23:09:23 +02:00 · 2026-01-15 22:26:59 +01:00 · 2026-01-15 22:22:15 +01:00 · 2026-01-02 16:54:32 +01:00
28 changed files with 239 additions and 237 deletions
@@ -1,6 +1,6 @@
 data/*
 certs/
-matterbrige/*.t*
+extras/matterbridge/*.t*
 tests/certs/
 tests/venv/
 tests/__pycache__/
@@ -1,5 +1,44 @@
 # Changelog

+## Unreleased 2024-05-05
+
+### Adjust config
+
+* Replace deprecated legacy_ssl with c2s_direct_tls.
+* Removed use_libevent = true. This means the default is now used which is epoll.
+
+### Test
+
+Added a test to check that no deprecated config settings are used.
+
+## v 1.3.3
+
+* Updated to LuaRocks 3.12.2
+* Updated to Lua 5.4
+* Updated to Prosody 0.12.5
+* Removed unused luarocks
+
+## v1.3.2
+
+* Added Firewall module with optional custom blacklist
+
+## v1.3.1
+
+* Added optional Firewall module for testing
+
+### Breaking Change
+
+Switched from [http_upload](https://modules.prosody.im/mod_http_upload) to [http_file_share](https://prosody.im/doc/modules/mod_http_file_share).
+This means that previous uploads will NOT work after upgrading.
+ENV variable `HTTP_UPLOAD_FILE_SIZE_LIMIT` was removed.
+
+The new module uses the following variables:
+
+* HTTP_FILE_SHARE_SIZE_LIMIT
+* HTTP_FILE_SHARE_DAILY_QUOTA
+
+See [readme.md](readme.md) for explanations and defaults.
+
 ## v1.3.0

 * Update to Debian Bookworm
@@ -4,11 +4,11 @@ ARG BUILD_DATE
 ARG VCS_REF
 ARG VERSION

-ARG LUAROCKS_VERSION=3.9.2
-ARG PROSODY_VERSION=0.12.4
+ARG LUAROCKS_VERSION=3.12.2
+ARG PROSODY_VERSION=0.12.5

-ARG LUAROCKS_SHA256="bca6e4ecc02c203e070acdb5f586045d45c078896f6236eb46aa33ccd9b94edb"
-ARG PROSODY_DOWNLOAD_SHA256="47d712273c2f29558c412f6cdaec073260bbc26b7dda243db580330183d65856"
+ARG LUAROCKS_SHA256="b0e0c85205841ddd7be485f53d6125766d18a81d226588d2366931e9a1484492"
+ARG PROSODY_DOWNLOAD_SHA256="778fb7707a0f10399595ba7ab9c66dd2a2288c0ae3a7fe4ab78f97d462bd399f"

 LABEL luarocks.version="${LUAROCKS_VERSION}"
 LABEL org.opencontainers.image.authors="Wproject Garapenak"
@@ -30,7 +30,8 @@ RUN apt-get update \
      libidn2-0 \
      libpq-dev \
      libsqlite3-0 \
-      lua5.2 \
+      lua5.4 \
+      liblua5.4-dev \
      lua-bitop \
      lua-dbi-mysql \
      lua-dbi-postgresql \
@@ -73,7 +74,7 @@ RUN buildDeps='gcc git libc6-dev libidn2-dev liblua5.2-dev libsqlite3-dev libssl
 && make bootstrap \
 && cd / && rm -r /usr/src/luarocks \
 \
- && luarocks install luaevent \
+ # && luarocks install luaevent \
 && luarocks install luadbi \
 `#&& luarocks install luadbi-mysql MYSQL_INCDIR=/usr/include/mariadb/` \
 && luarocks install luadbi-sqlite3 \
@@ -90,7 +91,7 @@ RUN groupadd -r prosody \
 RUN mkdir -p /var/run/prosody/ \
 && chown prosody:prosody /var/run/prosody/

-ENV __FLUSH_LOG yes
+ENV __FLUSH_LOG=yes

 VOLUME ["/usr/local/var/lib/prosody"]

@@ -110,10 +111,12 @@ RUN download-prosody-modules.bash \
        filter_chatstates `# disable "X is typing" type messages` \
        smacks `# stream management (XEP-0198)` \
        throttle_presence `# presence throttling in CSI` \
-        http_upload `# file sharing (XEP-0363)` \
        vcard_muc `# XEP-0153: vCard-Based Avatar (MUC)` \
+ #&& docker-prosody-module-pre-install.bash \
+	firewall `# anti-spam firewall` \
 && rm -rf "/usr/src/prosody-modules"
 RUN echo "TLS_REQCERT allow" >> /etc/ldap/ldap.conf
+
 USER prosody

 ENTRYPOINT ["/entrypoint.bash"]
@@ -1,5 +1,7 @@
 plugin_paths = { "/usr/local/lib/prosody/custom-modules/" };

+-- table of enabled modules
+-- local mods_enabled = {
 modules_enabled = {
    -- Generally required
    "roster"; -- Allow users to have a roster. Recommended ;)
@@ -32,7 +34,7 @@ modules_enabled = {
    --"admin_telnet"; -- Opens telnet console interface on localhost port 5582

    -- HTTP modules
-    --"bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
+    "bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
    --"http_files"; -- Serve static files from a directory over HTTP

    -- Other specific functionality
@@ -47,6 +49,8 @@ modules_enabled = {
    "server_contact_info"; -- This module lets you advertise various contact addresses for your XMPP service via XEP-0157.
 };

+-- modules_enabled = mods_enabled;
+
 -- These modules are auto-loaded, but should you want
 -- to disable them then uncomment them here:
 modules_disabled = {
@@ -1,8 +1,8 @@
 default_storage = "sql"

 sql = {
-  driver = os.getenv("DB_DRIVER");
-  database = os.getenv("DB_DATABASE");
+  driver = os.getenv("DB_DRIVER") or "SQLite3";
+  database = os.getenv("DB_DATABASE") or "prosody.sqlite";
  host = os.getenv("DB_HOST");
  port = os.getenv("DB_PORT");
  username = os.getenv("DB_USERNAME");
@@ -21,11 +21,13 @@ storage = {
 archive_expires_after = "1y"

 -- bandwith limits
-limits = {
-    c2s = {
-        rate = "10kb/s";
-    };
-    s2sin = {
-        rate = "30kb/s";
-    };
-}
+--limits = {
+    --c2s = {
+        --rate = "10kb/s";
+    --};
+    --s2sin = {
+        --rate = "30kb/s";
+    --};
+--}
+
+http_max_content_size = os.getenv("HTTP_MAX_CONTENT_SIZE") or 1024 * 1024 * 10 -- Default is 10MB
@@ -1,8 +1,11 @@
 local stringy = require "stringy"

-e2e_policy_chat = os.getenv("E2E_POLICY_CHAT")
-e2e_policy_muc = os.getenv("E2E_POLICY_MUC")
-e2e_policy_whitelist = stringy.split(os.getenv("E2E_POLICY_WHITELIST"), ", ")
+e2e_policy_chat = os.getenv("E2E_POLICY_CHAT") or "required"
+e2e_policy_muc = os.getenv("E2E_POLICY_MUC") or "required"
+
+local whitelist = os.getenv("E2E_POLICY_WHITELIST") or ""
+e2e_policy_whitelist = stringy.split(whitelist, ", ")
+
 e2e_policy_message_optional_chat = "For security reasons, OMEMO, OTR or PGP encryption is STRONGLY recommended for conversations on this server."
 e2e_policy_message_required_chat = "For security reasons, OMEMO, OTR or PGP encryption is required for conversations on this server."
 e2e_policy_message_optional_muc = "For security reasons, OMEMO, OTR or PGP encryption is STRONGLY recommended for MUC on this server."
@@ -1,12 +1,29 @@
 local stringy = require "stringy"
+local function _split(s, sep)
+	if not s then return nil; end
+	sep = sep or ",";
+	local parts = {};
+	for part in s:gmatch("[^"..sep.."]+") do
+		parts[#parts+1] = part;
+	end
+	return parts;
+end
+
+local domain = os.getenv("DOMAIN")
+local abuse = os.getenv("SERVER_CONTACT_INFO_ABUSE") or "xmpp:abuse@" .. domain
+local admin = os.getenv("SERVER_CONTACT_INFO_ADMIN") or "xmpp:admin@" .. domain
+local feedback = os.getenv("SERVER_CONTACT_INFO_FEEDBACK") or "xmpp:feedback@" .. domain
+local sales = os.getenv("SERVER_CONTACT_INFO_SALES") or "xmpp:sales@" .. domain
+local security = os.getenv("SERVER_CONTACT_INFO_SECURITY") or "xmpp:security@" .. domain
+local support = os.getenv("SERVER_CONTACT_INFO_SUPPORT") or "xmpp:support@" .. domain

 contact_info = {
-  abuse = stringy.split(os.getenv("SERVER_CONTACT_INFO_ABUSE"), ", ");
-  admin = stringy.split(os.getenv("SERVER_CONTACT_INFO_ADMIN"), ", ");
-  feedback = stringy.split(os.getenv("SERVER_CONTACT_INFO_FEEDBACK"), ", ");
-  sales = stringy.split(os.getenv("SERVER_CONTACT_INFO_SALES"), ", ");
-  security = stringy.split(os.getenv("SERVER_CONTACT_INFO_SECURITY"), ", ");
-  support = stringy.split(os.getenv("SERVER_CONTACT_INFO_SUPPORT"), ", ");
+  abuse = _split(abuse, ", ");
+  admin = _split(admin, ", ");
+  feedback = _split(feedback, ", ");
+  sales = _split(sales, ", ");
+  security = _split(security, ", ");
+  support = _split(support, ", ");
 }

 welcome_message = "Kaixo $username, ongi etorri $host IM zerbitzura! Mesedez irakurri itzazu ondorengo <a href='https://lainoa.eus/terms/tos.html'>Erabilpen baldintzak</a>."
@@ -1,16 +1,15 @@
 local domain = os.getenv("DOMAIN")
-local domain_http_upload = os.getenv("DOMAIN_HTTP_UPLOAD")
-local domain_muc = os.getenv("DOMAIN_MUC")
-local domain_proxy = os.getenv("DOMAIN_PROXY")
-local domain_pubsub = os.getenv("DOMAIN_PUBSUB")
-
+local domain_http_upload = os.getenv("DOMAIN_HTTP_UPLOAD") or "upload." .. domain
+local domain_muc = os.getenv("DOMAIN_MUC") or "conference." .. domain
+local domain_proxy = os.getenv("DOMAIN_PROXY") or "proxy." .. domain
+local domain_pubsub = os.getenv("DOMAIN_PUBSUB") or "pubsub." .. domain
 -- XEP-0368: SRV records for XMPP over TLS
 -- https://compliance.conversations.im/test/xep0368/
-legacy_ssl_ssl = {
+c2s_direct_tls_ssl = {
    certificate = "certs/" .. domain .. "/fullchain.pem";
 	key = "certs/" .. domain .. "/privkey.pem";
 }
-legacy_ssl_ports = { 5223 }
+c2s_direct_tls_ports = { 5223 }

 -- https://prosody.im/doc/certificates#service_certificates
 -- https://prosody.im/doc/ports#ssl_configuration
@@ -21,9 +20,12 @@ https_ssl = {

 VirtualHost (domain)

-- Set up a http file upload because proxy65 is not working in muc
-Component (domain_http_upload) "http_upload"
-	http_upload_expire_after = 60 * 60 * 24 * 7 -- a week in seconds
+-- Set up a http file upload 
+Component (domain_http_upload) "http_file_share"
+	http_file_share_expires_after = 60 * 60 * 24 * 7 -- a week in seconds
+	local size_limit = os.getenv("HTTP_FILE_SHARE_SIZE_LIMIT") or 10 * 1024 * 1024 -- Default is 10MB
+	http_file_share_size_limit = size_limit
+	http_file_share_daily_quota = os.getenv("HTTP_FILE_SHARE_DAILY_QUOTA") or 10 * size_limit -- Default is 10x the size limit

 Component (domain_muc) "muc"
 	name = "Prosody Chatrooms"
@@ -1,28 +1,6 @@
 #!/bin/bash
 set -e

-export ALLOW_REGISTRATION=${ALLOW_REGISTRATION:-true}
-export DOMAIN_HTTP_UPLOAD=${DOMAIN_HTTP_UPLOAD:-"upload.$DOMAIN"}
-export DOMAIN_MUC=${DOMAIN_MUC:-"conference.$DOMAIN"}
-export DOMAIN_PROXY=${DOMAIN_PROXY:-"proxy.$DOMAIN"}
-export DOMAIN_PUBSUB=${DOMAIN_PUBSUB:-"pubsub.$DOMAIN"}
-export DB_DRIVER=${DB_DRIVER:-"SQLite3"}
-export DB_DATABASE=${DB_DATABASE:-"prosody.sqlite"}
-export E2E_POLICY_CHAT=${E2E_POLICY_CHAT:-"required"}
-export E2E_POLICY_MUC=${E2E_POLICY_MUC:-"required"}
-export E2E_POLICY_WHITELIST=${E2E_POLICY_WHITELIST:-""}
-export LOG_LEVEL=${LOG_LEVEL:-"info"}
-export C2S_REQUIRE_ENCRYPTION=${C2S_REQUIRE_ENCRYPTION:-true}
-export S2S_REQUIRE_ENCRYPTION=${S2S_REQUIRE_ENCRYPTION:-true}
-export S2S_SECURE_AUTH=${S2S_SECURE_AUTH:-true}
-export SERVER_CONTACT_INFO_ABUSE=${SERVER_CONTACT_INFO_ABUSE:-"xmpp:abuse@$DOMAIN"}
-export SERVER_CONTACT_INFO_ADMIN=${SERVER_CONTACT_INFO_ADMIN:-"xmpp:admin@$DOMAIN"}
-export SERVER_CONTACT_INFO_FEEDBACK=${SERVER_CONTACT_INFO_FEEDBACK:-"xmpp:feedback@$DOMAIN"}
-export SERVER_CONTACT_INFO_SALES=${SERVER_CONTACT_INFO_SALES:-"xmpp:sales@$DOMAIN"}
-export SERVER_CONTACT_INFO_SECURITY=${SERVER_CONTACT_INFO_SECURITY:-"xmpp:security@$DOMAIN"}
-export SERVER_CONTACT_INFO_SUPPORT=${SERVER_CONTACT_INFO_SUPPORT:-"xmpp:support@$DOMAIN"}
-export PROSODY_ADMINS=${PROSODY_ADMINS:-""}
-
 if [[ "$1" != "prosody" ]]; then
    exec prosodyctl $*
    exit 0;
@@ -46,4 +46,10 @@ for ext in $exts; do
 		new_config=$(cat "${config}" | module="${ext}" perl -0pe 's/(modules_enabled[ ]*=[ ]*{[^}]*)};/$1\n\t"$ENV{module}";\n};/')
 		echo "${new_config}" > "${config}"
 	fi
+	# firewall module configuration
+    	if [ "$ext" == "firewall" ] ; then
+        	echo " - setting up mod_${ext}"
+        	new_config=$(cat "${config}" | echo -e "\nlocal spam_blocklist = os.getenv(\"SPAM_BLOCKLIST\") and \"/usr/local/etc/prosody/firewall/\" .. os.getenv(\"SPAM_BLOCKLIST\") or \"module:scripts/spam-blocklists.pfw\"\n\nfirewall_scripts = {\n\t\"module:scripts/spam-blocking.pfw\";\n\tspam_blocklist;\n};")
+        	echo "${new_config}" >> "${config}"
+    	fi
 done
@@ -4,6 +4,7 @@ set -e
 dir="/usr/src/prosody-modules"

 mkdir -p "${dir}"
-wget https://hg.prosody.im/prosody-modules/archive/tip.tar.gz
+wget https://hg.prosody.im/prosody-modules/archive/233691533318.tar.gz -O tip.tar.gz
+#wget https://hg.prosody.im/prosody-modules/archive/tip.tar.gz
 tar -xzf tip.tar.gz -C "${dir}" --strip-components=1
 rm tip.tar.gz
@@ -0,0 +1,22 @@
+bashtel.ru
+creep.im
+darkengine.biz
+default.rs
+exploit.im
+hiddenlizard.org
+jabber.bitactive.com
+jabber.cd
+jabber.cz
+jabber.freenet.de
+jabber.ipredator.se
+jabber.npw.net
+jabber.sampo.ru
+jabbim.pl
+labas.biz
+otr.chat
+paranoid.scarab.name
+rassnet.org
+safetyjabber.com
+sj.ms
+trashserver.net
+xmpp.bytesund.biz
@@ -0,0 +1,21 @@
+# This script depends on spam-blocking.pfw also being loaded
+# Any traffic that is not explicitly blocked or allowed by other
+# rules will be checked against the JabberSPAM server blocklist
+
+%LIST blocklist: file:/usr/local/etc/prosody/firewall/blacklist.txt
+#%LIST blocklist: https://cdn.jsdelivr.net/gh/jabberspam/blacklist/blacklist.txt
+
+::user/spam_handle_unknown_custom
+
+CHECK LIST: blocklist contains $<@from|host>
+BOUNCE=policy-violation (Your server is blocked due to spam)
+
+::user/spam_check_muc_invite_custom
+
+# Check the server we received the invitation from
+CHECK LIST: blocklist contains $<@from|host>
+BOUNCE=policy-violation (Your server is blocked due to spam)
+
+# Check the inviter's JID against the blocklist, too
+CHECK LIST: blocklist contains $<{http://jabber.org/protocol/muc#user}x/invite@from|host>
+BOUNCE=policy-violation (Your server is blocked due to spam)
@@ -1,84 +0,0 @@
-#https://github.com/42wim/matterbridge
-
-###################################################################
-#XMPP section - berriketak
-###################################################################
-[xmpp]
-[xmpp.telegram_berriketak]
-#Server="lainoa.eus:5222"
-Server="server:5222"
-#Jid="admin@lainoa.eus"
-Jid="admin@lainoa.eus"
-#Password="sagastarri996X"
-Password="sagastarri996"
-Muc="conference.lainoa.eus"
-Nick="Admin"
-SkipTLSVerify=true
-#IgnoreNicks="ircspammer1 ircspammer2"
-#RemoteNickFormat="[{NICK}] "
-RemoteNickFormat="{TENGO}({PROTOCOL}) "
-ShowJoinPart=false
-
-###################################################################
-#telegram section - berriketak
-###################################################################
-[telegram]
-[telegram.berriket_xmppBot]
-Token="434963747:AAHRbJAw9oN30b9KdjWacnyYyHS22r056SM" #token berriket_xmppBot
-MessageFormat="HTMLNick"
-EditDisable=false
-EditSuffix=" (edited)"
-IgnoreNicks="spammer1 spammer2"
-RemoteNickFormat="{NICK}: "
-ShowJoinPart=false
-UseInsecureURL=true
-MediaConvertWebPToPNG=true
-DisableWebPagePreview=false
-
-[tengo]
-#RemoteNickFormat="remotenickformat.tengo"
-RemoteNickFormat="/etc/matterbridge/nicks.tengo"
-#InMessage="/etc/matterbridge/in.tengo"
-OutMessage="/etc/matterbridge/out.tengo"
-
-###################################################################
-#gateway section
-###################################################################
-[[gateway]]
-name="gateway_berriketak"
-enable=true
-
-	[[gateway.inout]]
-	account="xmpp.telegram_berriketak"
-	channel="berriketak"
-        #channel="test"
-
-	[[gateway.inout]]
-	account="telegram.berriket_xmppBot"
-	channel="-183435536" #Telegram berriketak taldearen ID-a
-
-[[gateway]]
-name="test"
-enable=true
-
-        [[gateway.inout]]
-        account="xmpp.telegram_berriketak"
-        channel="test"
-
-        [[gateway.inout]]
-        account="telegram.berriket_xmppBot"
-        #channel="-241666435" #Telegram xmpp_test taldearen ID-a
-	channel="-1001617641457"
-
-#[[gateway]]
-#name="etxekok"
-#enable=true
-
-#        [[gateway.inout]]
-#        account="xmpp.telegram_berriketak"
-#        channel="etxekok"
-
-#        [[gateway.inout]]
-#        account="telegram.berriket_xmppBot"
-#        channel="-523032" #Telegram etxekok taldearen ID-a
-
@@ -1,5 +0,0 @@
-/*Customize nicks from X to XMPP*/
-result = nick
-if(nick == "Nekane Nekane") {
-   result = "Amona Nekane"
-}
@@ -1,30 +0,0 @@
-text := import("text")
-fmt := import("fmt")
-
-fmt.println(msgText)
-
-if(inProtocol == "telegram"){
-	if text.index(msgText, "https") > 1 {
-		media_array := text.re_split(":", msgText, 2)
-		fmt.println(media_array)    
-		if len(media_array) > 1 {
-			//TG desktop
-			media := text.trim_prefix(media_array[1]," ")
-			//msgText=media
-			bold := "**"+media+"**"
-			//link := "[link]("+media+")"
-			//msgText =link
-			msgText = text.re_replace("MEDIA", bold, msgText)
-			//msgText="![Tux, the Linux mascot]("+media+")"
-			//msgText=text.re_replace("matterbridge",msgText,"matterbridge (https://github.com/42wim/matterbridge)")
-		}else{
-			//TG android
-			msgText="https:"+media_array[0]
-		}
-
-	}
-}else{
-	//capitalize + bold
-        msgUsername = "<strong>"+text.title(msgUsername)+"</strong>"
-	msgText = msgText
-}
@@ -3,17 +3,16 @@

 local stringy = require "stringy"

-admins = stringy.split(os.getenv("PROSODY_ADMINS"), ", ");
+local prosody_admins = os.getenv("PROSODY_ADMINS") or "";
+admins = stringy.split(prosody_admins, ", ");

 pidfile = "/var/run/prosody/prosody.pid"

-use_libevent = true; -- improves performance
+allow_registration = os.getenv("ALLOW_REGISTRATION") or "true";

-allow_registration = os.getenv("ALLOW_REGISTRATION");
-
-c2s_require_encryption = os.getenv("C2S_REQUIRE_ENCRYPTION");
-s2s_require_encryption = os.getenv("S2S_REQUIRE_ENCRYPTION");
-s2s_secure_auth = os.getenv("S2S_SECURE_AUTH");
+c2s_require_encryption = os.getenv("C2S_REQUIRE_ENCRYPTION") or "true";
+s2s_require_encryption = os.getenv("S2S_REQUIRE_ENCRYPTION") or "true";
+s2s_secure_auth = os.getenv("S2S_SECURE_AUTH") or "true";

 authentication = os.getenv("AUTHENTICATION") or "internal_hashed";

@@ -28,7 +27,7 @@ ldap_mode = os.getenv("LDAP_MODE") or "bind";
 ldap_admin_filter = os.getenv("LDAP_ADMIN_FILTER") or "";

 log = {
-    {levels = {min = os.getenv("LOG_LEVEL")}, to = "console"};
+    {levels = {min = os.getenv("LOG_LEVEL") or "info"}, to = "console"};
 };

 Include "conf.d/*.cfg.lua";
@@ -54,6 +54,7 @@ While Conversations got everything set-up out-of-the-box, Gajim was used with th
 * Secure by default
  * SSL certificate required
  * End-to-end encryption required (using [OMEMO](https://conversations.im/omemo/) or [OTR](https://en.wikipedia.org/wiki/Off-the-Record_Messaging))
+  * Anti-spam filter (based on the pre-installed [Firewall](https://modules.prosody.im/mod_firewall) module)
 * Data storage
  * SQLite message store
  * Configured file upload and image sharing
@@ -157,11 +158,9 @@ docker build -t prosody/xmpp .
 Next I recommend using a ```docker-compose.yml``` file:

 ```yaml
-version: '3.7'
-
 services:
  server:
-    image: sarasmiseth/prosody:latest
+    image: prosody/xmpp:latest
    restart: unless-stopped
    ports:
      - "5000:5000"
@@ -176,9 +175,9 @@ services:
      - ./data:/usr/local/var/lib/prosody
 ```

-Boot it via: ```docker-compose up -d```.
+Boot it via: ```docker compose up -d```.

-Inspect logs: ```docker-compose logs -f```.
+Inspect logs: ```docker compose logs -f```.

 ### Volumes permissions

@@ -228,6 +227,9 @@ sudo chown 999:999 ./data
 | **DB_PORT**                      | Port on which the database is listening                                                                              | *optional*                                   |                            |
 | **DB_USERNAME**                  | The username to authenticate to the database                                                                         | *optional*                                   |                            |
 | **DB_PASSWORD**                  | The password to authenticate to the database                                                                         | *optional*                                   |                            |
+| **HTTP_MAX_CONTENT_SIZE**        | Max http content size in bytes                                                                                       | *optional*                                   | 10485760                   |
+| **HTTP_FILE_SHARE_SIZE_LIMIT**   | Max http file share size in bytes                                                                                    | *optional*                                   | 10485760                   |
+| **HTTP_FILE_SHARE_DAILY_QUOTA**  | Daily quota in bytes                                                                                                 | *optional*                                   | 10 times share size limit  |
 | **E2E_POLICY_CHAT**              | Policy for chat messages. Possible values: "none", "optional" and "required".                                        | *optional*                                   | "required"                 |
 | **E2E_POLICY_MUC**               | Policy for MUC messages. Possible values: "none", "optional" and "required".                                         | *optional*                                   | "required"                 |
 | **E2E_POLICY_WHITELIST**         | Make this module ignore messages sent to and from this JIDs or MUCs.                                                 | *optional*                                   | ""                         |
@@ -242,6 +244,8 @@ sudo chown 999:999 ./data
 | **SERVER_CONTACT_INFO_SECURITY** | A list of strings. Each string should be an URI. See [here](https://prosody.im/doc/modules/mod_server_contact_info). | *optional*                                   | "xmpp:security@**DOMAIN**" |
 | **SERVER_CONTACT_INFO_SUPPORT**  | A list of strings. Each string should be an URI. See [here](https://prosody.im/doc/modules/mod_server_contact_info). | *optional*                                   | "xmpp:support@**DOMAIN**"  |
 | **PROSODY_ADMINS**               | Specify who is an administrator. List of adresses. Eg. "me@example.com", "admin@example.net"                         | *optional*                                   | ""                         |
+| **ENABLE_FIREWALL**              | Enable Firewall module                                                                                               | *optional*                                   | false                      |
+| **SPAM_BLOCKLIST**               | Blacklist to use with Firewall module. Eg. "custom-blocklist.pfw"                                                    | *optional*                                   |                       |

 #### DNS

@@ -262,7 +266,7 @@ There is a helper script that eases installing additional prosody modules: ```do

 It downloads the current [prosody-modules](https://hg.prosody.im/prosody-modules/) repository. The specified modules are copied and its name is added to the ```modules_enabled``` variable within ```conf.d/01-modules.cfg.lua```.

-There is also ```docker-prosody-module-copy``` which copies the specified modules but does not add them to the ```modules_enabled``` variable within ```conf.d/01-modules.cfg.lua```.
+There is also ```docker-prosody-module-pre-install.bash``` which downloads the specified modules but does not add them to the ```modules_enabled``` variable within ```conf.d/01-modules.cfg.lua```. In fact, this script is in charge of pre-installing the Firewall module.

 If you need additional configuration just overwrite the respective _cfg.lua_ file or add new ones.

@@ -277,16 +281,16 @@ prosodyctl mod_storage_sql upgrade

 ## Matterbridge

-To enable bridges using **Matterbridge** simply add the service in the docker-compose.yml file. Then you need to add _toml_ config file in ```matterbridge``` directory spedifying protocols and gateways. Check [documentation](https://github.com/42wim/matterbridge#readme).
+To enable bridges using **Matterbridge** simply add the service in the docker-compose.yml file. Then you need to add _toml_ config file in ```matterbridge``` directory spedifying protocols and gateways. Check the [documentation](https://github.com/42wim/matterbridge#readme) for more information.

 ``` yaml
  matterbridge:
    image: 42wim/matterbridge:latest
    restart: unless-stopped
    volumes:
-    - ./matterbridge/matterbridge.toml:/etc/matterbridge/matterbridge.toml:ro
-    - ./matterbridge/nicks.tengo:/etc/matterbridge/nicks.tengo:ro
-    - ./matterbridge/out.tengo:/etc/matterbridge/out.tengo:ro
+    - ./extras/matterbridge/matterbridge.toml:/etc/matterbridge/matterbridge.toml:ro
+    - ./extras/matterbridge/nicks.tengo:/etc/matterbridge/nicks.tengo:ro
+    - ./extras/matterbridge/out.tengo:/etc/matterbridge/out.tengo:ro
    depends_on:
      - server

@@ -1,5 +1,3 @@
-version: "3.9"
-
 services:
  prosody:
    image: prosody
@@ -19,7 +19,7 @@ registerTestUser() {
    local userName="$1"
    local containerName="$2"
    echo "Registering TestUser '$userName' in container '$containerName'"
-    sudo docker compose exec "$containerName" /bin/bash -c "/entrypoint.bash register $userName example.com 12345678"
+    sudo docker compose exec "$containerName" /bin/bash -c "prosodyctl register $userName example.com 12345678"
 }

 registerTestUsers() {
@@ -32,8 +32,7 @@ registerTestUsers() {

 runTests() {
    local containerName="$1"
-    python --version \
-    && python3 --version \
+    python3 --version \
    && python3 -m venv venv \
    && source venv/bin/activate \
    && python --version \
@@ -42,12 +41,19 @@ runTests() {
    && pytest \
    && deactivate \
    && sleep 5 \
-    && sudo docker-compose logs "$containerName" \
+    && sudo docker compose logs "$containerName" \
    && export batsContainerName="$containerName" \
    && ./bats/bats-core/bin/bats tests.bats \
    && ./bats/bats-core/bin/bats tests-"$containerName".bats
 }

+checkConfig() {
+    local containerName="$1"
+    sudo docker compose up -d "$containerName"
+    sudo docker compose exec -T "$containerName" prosodyctl check config || true
+    sudo docker compose down
+}
+
 generateCert "example.com"
 generateCert "conference.example.com"
 generateCert "proxy.example.com"
@@ -56,22 +62,25 @@ generateCert "upload.example.com"

 # Run tests for first container with postgres
 # Start postgres first and wait for 10 seconds before starting prosody.
-sudo docker-compose down
-sudo docker-compose up -d postgres
+sudo docker compose down
+sudo docker compose up -d postgres
 sleep 10
-sudo docker-compose up -d prosody_postgres
-
+sudo docker compose up -d prosody_postgres
 registerTestUsers prosody_postgres
 runTests prosody_postgres
-sudo docker-compose down
+sudo docker compose down

 # Run tests for second container with SQLite
-sudo docker-compose up -d prosody
+sudo docker compose up -d prosody
+sleep 5
 registerTestUsers prosody
 runTests prosody
-sudo docker-compose down
+sudo docker compose down

 # Run tests for prosody with ldap
-sudo docker-compose up -d prosody_ldap
+sudo docker compose up -d prosody_ldap
 runTests prosody_ldap
-sudo docker-compose down
+sudo docker compose down
+
+# Check server config
+checkConfig prosody
@@ -4,7 +4,7 @@ load 'bats/bats-support/load'
 load 'bats/bats-assert/load'

@test "Should use sqlite" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Connecting to \[SQLite3\] \/usr\/local\/var\/lib\/prosody\/prosody\.sqlite\.\.\.\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"Connecting to \[SQLite3\] \/usr\/local\/var\/lib\/prosody\/prosody\.sqlite\.\.\.\""
  assert_success
  assert_output
 }
@@ -4,13 +4,13 @@ load 'bats/bats-support/load'
 load 'bats/bats-assert/load'

@test "Should use sqlite" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Connecting to \[SQLite3\] \/usr\/local\/var\/lib\/prosody\/prosody\.sqlite\.\.\.\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"Connecting to \[SQLite3\] \/usr\/local\/var\/lib\/prosody\/prosody\.sqlite\.\.\.\""
  assert_success
  assert_output
 }

@test "Should use ldap" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Host 'example.com' now set to use user provider 'ldap'\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"Host 'example.com' now set to use user provider 'ldap'\""
  assert_success
  assert_output
 }
@@ -4,7 +4,7 @@ load 'bats/bats-support/load'
 load 'bats/bats-assert/load'

@test "Should use postgres" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Connecting to \[PostgreSQL\] prosody\.\.\.\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"Connecting to \[PostgreSQL\] prosody\.\.\.\""
  assert_success
  assert_output
 }
@@ -4,85 +4,95 @@ load 'bats/bats-support/load'
 load 'bats/bats-assert/load'

@test "Should send 5 messages" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Received\[c2s\]: <message\" | wc -l"
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"Received\[c2s\]: <message\" | wc -l"
  assert_success
  assert_output "5"
 }

@test "Should select certificate for example.com" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Certificates loaded\" | grep \" example.com:tls\" | wc -l"
+  run bash -c "sudo docker compose logs $batsContainerName | grep \"Certificates loaded\" | grep \" example.com:tls\" | wc -l"
  assert_success
  assert_output "1"
 }

@test "Should select certificate for conference.example.com" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"conference.example.com:tls\" | wc -l"
+  run bash -c "sudo docker compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"conference.example.com:tls\" | wc -l"
  assert_success
  assert_output "1"
 }

@test "Should select certificate for proxy.example.com" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"proxy.example.com:tls\" | wc -l"
+  run bash -c "sudo docker compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"proxy.example.com:tls\" | wc -l"
  assert_success
  assert_output "1"
 }

@test "Should select certificate for pubsub.example.com" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"pubsub.example.com:tls\" | wc -l"
+  run bash -c "sudo docker compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"pubsub.example.com:tls\" | wc -l"
  assert_success
  assert_output "1"
 }

@test "Should select certificate for upload.example.com" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"upload.example.com:tls\" | wc -l"
+  run bash -c "sudo docker compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"upload.example.com:tls\" | wc -l"
  assert_success
  assert_output "1"
 }

@test "Should log error for user with wrong password" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Session closed by remote with error: undefined-condition (user intervention: authentication failed: authentication aborted by user)\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep \"Session closed by remote with error: undefined-condition (user intervention: authentication failed: authentication aborted by user)\""
  assert_success
  assert_output
 }

@test "Should activate s2s" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Activated service 's2s' on (\[::\]:5269|\[\*\]:5269), (\[::\]:5269|\[\*\]:5269)\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"Activated service 's2s' on (\[::\]:5269|\[\*\]:5269), (\[::\]:5269|\[\*\]:5269)\""
  assert_success
  assert_output
 }

@test "Should activate c2s" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Activated service 'c2s' on (\[::\]:5222|\[\*\]:5222), (\[::\]:5222|\[\*\]:5222)\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"Activated service 'c2s' on (\[::\]:5222|\[\*\]:5222), (\[::\]:5222|\[\*\]:5222)\""
  assert_success
  assert_output
 }

-@test "Should activate legacy_ssl" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Activated service 'legacy_ssl' on (\[::\]:5223|\[\*\]:5223), (\[::\]:5223|\[\*\]:5223)\""
+@test "Should activate c2s_direct_tls" {
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"Activated service 'c2s_direct_tls' on (\[::\]:5223|\[\*\]:5223), (\[::\]:5223|\[\*\]:5223)\""
  assert_success
  assert_output
 }

@test "Should activate proxy65" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Activated service 'proxy65' on (\[::\]:5000|\[\*\]:5000), (\[::\]:5000|\[\*\]:5000)\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"Activated service 'proxy65' on (\[::\]:5000|\[\*\]:5000), (\[::\]:5000|\[\*\]:5000)\""
  assert_success
  assert_output
 }

@test "Should activate https" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Activated service 'https' on (\[::\]:5281|\[\*\]:5281), (\[::\]:5281|\[\*\]:5281)\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"Activated service 'https' on (\[::\]:5281|\[\*\]:5281), (\[::\]:5281|\[\*\]:5281)\""
  assert_success
  assert_output
 }

@test "Should load module cloud_notify" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep \"example.com:cloud_notify.*info.*Module loaded\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep \"example.com:cloud_notify.*info.*Module loaded\""
  assert_success
  assert_output
 }

@test "Should show upload URL" {
-  run bash -c "sudo docker-compose logs $batsContainerName | grep \"URL: <https:\/\/upload.example.com:5281\/upload> - Ensure this can be reached by users\""
+  run bash -c "sudo docker compose logs $batsContainerName | grep \"Serving 'file_share' at https:\/\/upload.example.com:5281\/file_share\""
  assert_success
  assert_output
 }
+
+@test "Should not use deprecated config" {
+  run bash -c "sudo docker compose exec $batsContainerName /bin/bash -c \"/entrypoint.bash check\" | grep 'deprecated' -A 3"
+  assert_failure
+}
+
+@test "Should not have warnings in log" {
+  run bash -c "sudo docker compose logs $batsContainerName | grep -E \"warn\""
+  assert_failure
+}
Author	SHA1	Message	Date
aitzol	49ba7afb98	tests	2026-08-02 13:31:05 +02:00
aitzol	da4f72dff4	test-ak eguneratu	2026-07-30 23:09:51 +02:00
aitzol	0c19a78a41	lehenetsitako aldagaiak zuzenean cfg.lua fitxategietan txertatu.	2026-07-30 23:09:23 +02:00
aitzol	3a7fb92b52	Merge pull request 'blacklist update' (#2 ) from dev into main Reviewed-on: #2	2026-01-15 22:26:59 +01:00
aitzol	211174c798	blacklist update	2026-01-15 22:22:15 +01:00
aitzol	14d51c26fc	Merge pull request 'Lua 5.4, Luarocks 3.12.2 and Prosody 0.12.5' (#1 ) from dev into main Reviewed-on: #1	2026-01-02 16:54:32 +01:00
aitzol	c859ea8aeb	Lua 5.4, Luarocks 3.12.2 and Prosody 0.12.5	2026-01-02 16:51:53 +01:00
aitzol	bce1639d25	bats	2024-05-05 17:12:45 +02:00
aitzol	0de34e5f74	2024-05-05 eguneraketa	2024-05-05 16:47:07 +02:00
aitzol	4857ee42e9	2024-05-05 eguneraketa	2024-05-05 16:45:21 +02:00
aitzol	da5371f30f	2024-05-05 eguneraketa	2024-05-05 16:40:57 +02:00
aitzol	73838d1aa5	fixed firewall scripts	2024-03-04 09:09:14 +01:00
aitzol	917824e3a9	v1.3.2	2024-03-01 23:17:00 +01:00
aitzol	c55a135d24	readme	2024-03-01 21:12:20 +01:00
aitzol	38674d073b	readme	2024-03-01 19:08:03 +01:00
aitzol	cedeabd6a8	v1.3.2	2024-03-01 17:21:11 +01:00
aitzol	95b4b5da6e	v1.3.2	2024-03-01 17:16:00 +01:00
aitzol	e7fa66e938	v1.3.2	2024-03-01 17:09:43 +01:00
aitzol	d8d9fd9e67	v1.3.1	2024-03-01 13:06:06 +01:00