apiVersion: v1
kind: ConfigMap
metadata:
  name: apolo-ejabberd-config
  namespace: apolo
data:
  ejabberd.yml: |
    define_macro:
      HOST: "chat.apolo.c2et.net"
      ADMIN: "admin@chat.apolo.c2et.net"

    hosts:
      - "@HOST@"

    loglevel: info

    certfiles:
      - /home/ejabberd/conf/chat.pem

    # Usamos bundle de CAs del sistema
    ca_file: "/etc/ssl/certs/ca-certificates.crt"

    auth_method: [external]
    extauth_program: "/usr/local/bin/auth"
    extauth_pool_size: 3
    auth_use_cache: false

    listen:
      -
        port: 5222
        ip: "::"
        module: ejabberd_c2s
        max_stanza_size: 262144
        shaper: c2s_shaper
        access: c2s
        starttls_required: true
      -
        port: 5223
        ip: "::"
        module: ejabberd_c2s
        max_stanza_size: 262144
        shaper: c2s_shaper
        access: c2s
        tls: true
      -
        port: 5269
        ip: "::"
        module: ejabberd_s2s_in
        max_stanza_size: 524288
        shaper: s2s_shaper
      -
        port: 5443
        ip: "::"
        module: ejabberd_http
        tls: true
        request_handlers:
          /admin: ejabberd_web_admin
          /api: mod_http_api
          /bosh: mod_bosh
          /captcha: ejabberd_captcha
          /upload: mod_http_upload
          /ws: ejabberd_http_ws
          /oauth: ejabberd_oauth
      -
        port: 5280
        ip: "::"
        module: ejabberd_http
        request_handlers:
          /admin: ejabberd_web_admin
          /api: mod_http_api
          /bosh: mod_bosh
          /ws: ejabberd_http_ws
      -
        port: 1880
        ip: "::"
        module: ejabberd_http
        request_handlers:
          /: ejabberd_web_admin
      -
        port: 1883
        ip: "::"
        module: mod_mqtt
        backlog: 1000

    s2s_use_starttls: optional

    acl:
      local:
        user_regexp: ""
      loopback:
        ip:
          - 127.0.0.0/8
          - ::1/128
      admin:
        - user: "admin@chat.apolo.c2et.net"

    access_rules:
      local:
        allow: local
      c2s:
        deny: blocked
        allow: all
      announce:
        allow: admin
      configure:
        allow: admin
      muc_create:
        allow: local
      pubsub_createnode:
        allow: local
      trusted_network:
        allow: loopback

    api_permissions:
      "ejabberd API":
        from: mod_http_api
        who: admin
        what:
          - "*"
      "console commands":
        from: ejabberd_ctl
        who: all
        what: "*"
      "webadmin commands":
        from: ejabberd_web_admin
        who: admin
        what: "*"
      "admin access":
        who:
          access:
            allow:
              - acl: loopback
              - acl: admin
          oauth:
            scope: "ejabberd:admin"
            access:
              allow:
                - acl: loopback
                - acl: admin
        what:
          - "*"
          - "!stop"
          - "!start"
      "public commands":
        who:
          ip: 127.0.0.1/8
        what:
          - status
          - connected_users_number

    shaper:
      normal:
        rate: 3000
        burst_size: 20000
      fast: 100000

    shaper_rules:
      max_user_sessions: 10
      max_user_offline_messages:
        5000: admin
        100: all
      c2s_shaper:
        none: admin
        normal: all
      s2s_shaper: fast
      max_s2s_connections: 1

    modules:
      mod_adhoc: {}
      mod_admin_extra: {}
      mod_announce:
        access: announce
      mod_avatar: {}
      mod_blocking: {}
      mod_bosh: {}
      mod_caps: {}
      mod_carboncopy: {}
      mod_client_state: {}
      mod_configure: {}
      mod_disco: {}
      mod_fail2ban:
        c2s_max_auth_failures: 7
        c2s_auth_ban_lifetime: 3600
      mod_http_api: {}
      mod_http_upload:
        put_url: https://@HOST@:5443/upload
        custom_headers:
          "Access-Control-Allow-Origin": "https://@HOST@"
          "Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS"
          "Access-Control-Allow-Headers": "Content-Type,Authorization"
      mod_last: {}
      mod_mam:
        assume_mam_usage: true
        default: always
      mod_mqtt: {}
      mod_muc:
        host: "muc.@HOST@"
        access:
          - allow
        access_admin:
          - allow: admin
        access_create: muc_create
        access_persistent: muc_create
        access_mam:
          - allow
        default_room_options:
          allow_subscription: true
          mam: true
          persistent: true
      mod_muc_admin: {}
      mod_muc_occupantid: {}
      mod_offline:
        access_max_user_messages: max_user_offline_messages
      mod_ping: {}
      mod_privacy: {}
      mod_private: {}
      mod_proxy65:
        access: local
        max_connections: 5
        port: 7777
      mod_pubsub:
        access_createnode: pubsub_createnode
        plugins:
          - flat
          - pep
        force_node_config:
          storage:bookmarks:
            access_model: whitelist
      mod_push: {}
      mod_push_keepalive: {}
      mod_register:
        ip_access: trusted_network
        welcome_message:
          subject: "Welcome to @HOST@"
          body: "Hi.\n\nWelcome to XRF Chat.\n\n"
        registration_watchers:
          - "admin@chat.apolo.c2et.net"
      mod_roster:
        versioning: true
      mod_sip: {}
      mod_s2s_bidi: {}
      mod_s2s_dialback: {}
      mod_shared_roster: {}
      mod_stream_mgmt:
        resend_on_timeout: if_offline
      mod_vcard: {}
      mod_vcard_xupdate: {}
      mod_version:
        show_os: false