Add ejabberd post

1 files changed, 124 insertions, 0 deletions

diff --git a/_posts/2023-06-25-ejabberd-setup.md b/_posts/2023-06-25-ejabberd-setup.md
new file mode 100644
index 0000000..c1267fc
--- /dev/null
+++ b/_posts/2023-06-25-ejabberd-setup.md
@@ -0,0 +1,124 @@
+---
+layout: post
+title: Tech Adventures - Setting up ejabberd under Debian
+date: 2023-06-25 15:25 +0200
+categories: tech
+lang: en
+---
+
+Preliminary
+-----------
+
+**Important** This is *not* intended to be an installation guide. Just the
+description of my journey. If you're actually looking for sane information on
+how to setup ejabberd, you should maybe look somewhere else.  (See bottom of
+this post for a link to German instructions.)
+
+The journey begins
+------------------
+
+Recently, I had the urge to set up a messaging server.  Actually, I wanted to go
+with one of the [Matrix](https://matrix.org/) servers. But "to get started", I
+decided to set up [ejabberd](https://ejabberd.im) first.
+
+Why ejabberd? I tried to set up Prosody quite some time ago, probably before The
+Pandemic hit.  I don't remember it too fondly. I may have gotten better in the
+meantime.
+
+The process was done on a recently updated Debian Bookworm. I wanted to figure
+things out by myself as much as possible.
+
+- First off: Add the necessary DNS records. The
+  [Prosody Docs](https://prosody.im/doc/dns) were the first thing I found.
+  I skipped the TLS-only stuff.
+- `apt install ejabberd`
+- `ejabberdctl register <adminuser> <domain> <password>`
+  - Error message that the domain was not found? huh?
+  - `nano /etc/ejabberd/ejabberd.yml` and add my domain to
+    the `hosts` lists.
+  - Reload or restart the service
+  - Repeat the command. Success! Yay!
+- Take a look at the web interface: https://127.0.0.1:5280.
+  - Log in with the created user. It fails.
+  - Append the `@domain` part, as the user name alone won't do it.
+    It works. Yay.
+  - "Man, I wouldn't have thought this was gonna be so easy! Hah!".
+  - Little did I know...
+- Use [acme.sh](https://github.com/acmesh-official/acme.sh) to generate the
+  certificates. See the instructions in their readme.
+  - My setup was somewhat more complicated since I am already running a web
+    server on the machine running ejabberd. If I didn't run a web server there, I
+    could've used the built-in acme plugin in ejabberd. Shoot :( I ended up using
+    the automated DNS mode.
+  - I naively started with the domains uvok.de and xmpp.uvok.de. The latter wouldn't
+    even be used actively. It was just so I could distinguish the certificate files.
+- I started out installing the certificates in `/etc/ejabberd/certs/`.
+  However, I was getting warning messages on service startup
+  that the certificates were empty ("... Permission error?").
+  Upon pondering on this, I decided to put the certificates in
+  `/var/lib/ejabberd/certs/`. This is the "home" directory of
+  the ejabberd user. Access problems solved. (1)
+- Getting an warning message
+  `Invalid certificate in /var/lib/ejabberd/certs/fullchain.pem: at line 57: certificate is signed by unknown CA`
+  on server startup. This puzzled me a lot.
+  - Line 57 was the line where the actual server certificate started.
+    The lines above were the Let's Encrypt X1 root and the R3 intermediate.
+    See [their docs](https://letsencrypt.org/certificates/) for details.
+  - At this point, I also tried some `openssl verify` calls on the PEM file itself.
+    But I didn't know the correct options to use (`-CAfile`, `-CApath`, `-untrusted`???).
+- As an intermediate step, I tried setting the `ca_file` config value
+  in `ejabberd.yml`. The warning was gone. Yay.
+  - But then I realized I forgot to add some subdomains to the cert.
+    So I added them (reissue, reinstall, restart). Suddenly, the warning was back. :(
+  - For my setup, I added the `xmpp.<dom>`, `pubsub.<dom>`, `conference.<dom>` domains,
+    where `<dom>` is `uvok.de`.
+- **However**. I then realized that setting `ca_file` was properly not a good idea.
+  This would *probably* prevent me from contacting servers not using Let's Encrypt.
+  So I removed the setting.
+  - specifically, I explicitly set it to
+    `ca_file: '/etc/ssl/certs/ca-certificates.crt'`. I don't know yet if this is necessary.
+- Add an exception to the firewall. (`ufw allow XMPP`).
+- These warnings made me nervous. So I decided to check the actual TLS connection from my PC.
+  - I know I could do `openssl s_client -starttls xmpp (server)`. But this didn't return a certificate.
+  - From HTTPS, I know to send the `-servername`. But this option didn't help.
+  - Upon some searching, I found the correct magic incantation was
+  `openssl s_client -xmpphost uvok.de -starttls xmpp  -connect srv.uvok.de:5222`.
+  This was necessary due to the fact that uvok.de is a different machine than the XMPP server.
+- Finally, I created a user account. Again, on command line.
+  The Debian install has very sane and safe defaults. It disables registrations via XMPP
+  clients by default. Exactly what I want :).
+  Also, MUC ("Group Chats") creation is limited to server members.
+- Opened up Gajim, added the account. It worked. Yay!
+- Next up, I still have a stale account on jabber.org, so to check whether
+  server-to-server connections work, I added my old account as a contact. And this worked as well.
+
+(1) The final config section is
+
+    certfiles:
+      - /var/lib/ejabberd/certs/fullchain.pem
+      - /var/lib/ejabberd/certs/key.pem
+
+Current state of my server
+--------------------------
+
+- The warning
+  `Invalid certificate in /var/lib/ejabberd/certs/fullchain.pem: at line 57: certificate is signed by unknown CA`
+  still appears on server start. Shoot. But I don't know what to do about it.
+- vCards with Gajim don't seem to be working. I have no idea why.
+- I don't particularly care for file exchange / upload. For that, I would need to add another
+  subdomain and twiddle with the config, I guess.
+
+Final remark
+------------
+
+For a **German** guide on how to setup ejabberd, you may want to look
+at the [Kuketz Blog](https://www.kuketz-blog.de/ejabberd-installation-und-betrieb-eines-xmpp-servers/).
+I only found this blog post after I was mostly finished with my setup.
+
+<hr/>
+
+Thanks also for all the people who helped me during setup on Mastodon <3.
+I don't know if they want to be named / listed here, so I rather won't.
+
+<hr/>
+