2 ###' ejabberd configuration file
6 ### The parameters used in this configuration file are explained in more detail
7 ### in the ejabberd Installation and Operation Guide.
8 ### Please consult the Guide in case of doubts, it is included with
9 ### your copy of ejabberd, and is also available online at
10 ### http://www.process-one.net/en/ejabberd/docs/
12 ### The configuration file is written in YAML.
13 ### Refer to http://en.wikipedia.org/wiki/YAML for the brief description.
14 ### However, ejabberd treats different literals as different types:
16 ### - unquoted or single-quoted strings. They are called "atoms".
17 ### Example: dog, 'Jupiter', '3.14159', YELLOW
19 ### - numeric literals. Example: 3, -45.0, .0
21 ### - quoted or folded strings.
22 ### Examples of quoted string: "Lizzard", "orange".
23 ### Example of folded string:
24 ### > Art thou not Romeo,
31 ## loglevel: Verbosity of log files generated by ejabberd.
32 ## 0: No ejabberd log at all (not recommended)
42 ## rotation: Disable ejabberd's internal log rotation, as the Debian package
48 ## overload protection: If you want to limit the number of messages per second
49 ## allowed from error_logger, which is a good idea if you want to avoid a flood
50 ## of messages when system is overloaded, you can set a limit.
51 ## 100 is ejabberd's default.
55 ## watchdog_admins: Only useful for developers: if an ejabberd process
56 ## consumes a lot of memory, send live notifications to these XMPP
60 ## - "bob@example.com"
66 ## net_ticktime: Specifies net_kernel tick time in seconds. This options must have
67 ## identical value on all nodes, and in most cases shouldn't be changed at all from
76 ## hosts: Domains served by ejabberd.
77 ## You can define one or several, for example:
87 ## route_subdomains: Delegate subdomains to other XMPP servers.
88 ## For example, if this ejabberd serves example.org and you want
89 ## to allow communication with an XMPP server called im.example.org.
91 ## route_subdomains: s2s
96 ## List all available PEM files containing certificates for your domains,
97 ## chains of certificates or certificate keys. Full chains will be built
98 ## automatically by ejabberd.
101 - "/etc/ejabberd/ejabberd.pem"
103 ## If your system provides only a single CA file (CentOS/FreeBSD):
104 ## ca_file: "/etc/ssl/certs/ca-bundle.pem"
106 ###. =================
107 ###' TLS configuration
109 ## Note that the following configuration is the default
110 ## configuration of the TLS driver, so you don't need to
114 'TLS_CIPHERS': "HIGH:!aNULL:!eNULL:!3DES:@STRENGTH"
118 - "cipher_server_preference"
120 ## 'DH_FILE': "/path/to/dhparams.pem" # generated with: openssl dhparam -out dhparams.pem 2048
122 ## c2s_dhfile: 'DH_FILE'
123 ## s2s_dhfile: 'DH_FILE'
124 c2s_ciphers: 'TLS_CIPHERS'
125 s2s_ciphers: 'TLS_CIPHERS'
126 c2s_protocol_options: 'TLS_OPTIONS'
127 s2s_protocol_options: 'TLS_OPTIONS'
133 ## listen: The ports ejabberd will listen on, which service each is handled
134 ## by and what options to start it with.
141 starttls_required: true
142 protocol_options: 'TLS_OPTIONS'
143 max_stanza_size: 65536
149 module: ejabberd_s2s_in
153 module: ejabberd_http
155 "/ws": ejabberd_http_ws
158 ## "/pub/archive": mod_http_fileserver
163 protocol_options: 'TLS_OPTIONS'
166 ## ejabberd_service: Interact with external components (transports, ...)
171 ## module: ejabberd_service
177 ## message: "outgoing"
178 ## presence: "roster"
181 ## filtering: ["node"]
182 ## "http://jabber.org/protocol/pubsub":
185 ## "icq.example.org":
186 ## password: "secret"
187 ## "sms.example.org":
188 ## password: "secret"
191 ## ejabberd_stun: Handles STUN Binding requests
196 ## module: ejabberd_stun
199 ## To handle XML-RPC requests that provide admin credentials:
204 ## module: ejabberd_xmlrpc
213 ## To enable secure http upload
218 ## module: ejabberd_http
220 ## "": mod_http_upload
222 ## protocol_options: 'TLS_OPTIONS'
224 ## ciphers: 'TLS_CIPHERS'
226 ## Disabling digest-md5 SASL authentication. digest-md5 requires plain-text
227 ## password storage (see auth_password_format option).
228 disable_sasl_mechanisms: "digest-md5"
230 ###. ==================
231 ###' S2S GLOBAL OPTIONS
234 ## s2s_use_starttls: Enable STARTTLS for S2S connections.
235 ## Allowed values are: false, optional or required
236 ## You must specify 'certfiles' option
238 s2s_use_starttls: required
241 ## S2S whitelist or blacklist
243 ## Default s2s policy for undefined hosts.
248 ## Outgoing S2S options
250 ## Preferred address families (which to try first) and connect timeout
253 ## outgoing_s2s_families:
256 ## outgoing_s2s_timeout: 190
262 ## auth_method: Method used to authenticate the users.
263 ## The default method is the internal.
264 ## If you want to use a different method,
265 ## comment this line and enable the correct ones.
267 auth_method: internal
270 ## Store the plain passwords or hashed for SCRAM:
271 ## auth_password_format: plain
272 auth_password_format: scram
274 ## Define the FQDN if ejabberd doesn't detect it:
275 ## fqdn: "server3.example.com"
278 ## Authentication using external script
279 ## Make sure the script is executable by ejabberd.
281 ## auth_method: external
282 ## extauth_program: "/path/to/authentication/script"
285 ## Authentication using SQL
286 ## Remember to setup a database in the next section.
291 ## Authentication using PAM
294 ## pam_service: "pamservicename"
297 ## Authentication using LDAP
301 ## List of LDAP servers:
305 ## Encryption of connection to LDAP servers:
306 ## ldap_encrypt: none
309 ## Port to connect to on LDAP servers:
314 ## ldap_rootdn: "dc=example,dc=com"
316 ## Password of LDAP manager:
317 ## ldap_password: "******"
319 ## Search base of LDAP directory:
320 ## ldap_base: "dc=example,dc=com"
322 ## LDAP attribute that holds user ID:
324 ## - "mail": "%u@mail.example.org"
327 ## ldap_filter: "(objectClass=shadowAccount)"
330 ## Anonymous login support:
331 ## auth_method: anonymous
332 ## anonymous_protocol: sasl_anon | login_anon | both
333 ## allow_multiple_connections: true | false
336 ## "public.example.org":
337 ## auth_method: anonymous
338 ## allow_multiple_connections: false
339 ## anonymous_protocol: sasl_anon
341 ## To use both anonymous and internal authentication:
344 ## "public.example.org":
352 ## ejabberd by default uses the internal Mnesia database,
353 ## so you do not necessarily need this section.
354 ## This section provides configuration examples in case
355 ## you want to use other database backends.
356 ## Please consult the ejabberd Guide for details on database creation.
362 ## sql_server: "server"
363 ## sql_database: "database"
364 ## sql_username: "username"
365 ## sql_password: "password"
367 ## If you want to specify the port:
371 ## PostgreSQL server:
374 ## sql_server: "server"
375 ## sql_database: "database"
376 ## sql_username: "username"
377 ## sql_password: "password"
379 ## If you want to specify the port:
382 ## If you use PostgreSQL, have a large database, and need a
383 ## faster but inexact replacement for "select count(*) from users"
385 ## pgsql_users_number_estimate: true
391 ## sql_database: "/path/to/database.db"
394 ## ODBC compatible or MSSQL server:
397 ## sql_server: "DSN=ejabberd;UID=ejabberd;PWD=ejabberd"
400 ## Number of connections to open to the database for each virtual host
405 ## Interval to make a dummy SQL request to keep the connections to the
406 ## database alive. Specify in seconds: for example 28800 means 8 hours
408 ## sql_keepalive_interval: undefined
415 ## The "normal" shaper limits traffic speed to 1000 B/s
420 ## The "fast" shaper limits traffic speed to 50000 B/s
425 ## This option specifies the maximum number of elements in the queue
426 ## of the FSM. Refer to the documentation for details.
430 ###. ====================
431 ###' ACCESS CONTROL LISTS
434 ## The 'admin' ACL grants administrative privileges to XMPP accounts.
435 ## You can put here as many accounts as you want.
446 ## - "baduser@example.org"
449 ## Local users: don't modify this.
455 ## More examples of ACLs
462 ## - "aleksey@jabber.ru"
464 ## user_regexp: "^test"
465 ## user_glob: "test*"
474 - "::FFFF:127.0.0.1/128"
481 ## - "xmpp.zombie.org"
485 ## Define specific ACLs in a virtual host.
492 ## - "bob-local@localhost"
498 ## Maximum number of simultaneous sessions allowed for a single user:
499 max_user_sessions: 10
500 ## Maximum number of offline messages that users can have:
501 max_user_offline_messages:
504 ## For C2S connections, all users except admins use the "normal" shaper
508 ## All S2S connections use the "fast" shaper
514 ## This rule allows access only for local users:
517 ## Only non-blocked users can use c2s connections:
521 ## Only admins can send announcement messages:
524 ## Only admins can use the configuration interface:
527 ## Only accounts of the local ejabberd server can create rooms:
530 ## Only accounts on the local ejabberd server can create Pubsub nodes:
533 ## In-band registration allows registration of any possible username.
534 ## To disable in-band registration, replace 'allow' with 'deny'.
537 ## Only allow to register from localhost
540 ## Do not establish S2S connections with bad servers
541 ## If you enable this you also have to uncomment "s2s_access: s2s"
544 ## - ip: "XXX.XXX.XXX.XXX/32"
546 ## - ip: "XXX.XXX.XXX.XXX/32"
553 ## This section allows you to define who and using what method
554 ## can execute commands offered by ejabberd.
556 ## By default "console commands" section allow executing all commands
557 ## issued using ejabberdctl command, and "admin access" section allows
558 ## users in admin acl that connect from 127.0.0.1 to execute all
559 ## commands except start and stop with any available access method
560 ## (ejabberdctl, http-api, xmlrpc depending what is enabled on server).
562 ## If you remove "console commands" there will be one added by
563 ## default allowing executing all commands, but if you just change
564 ## permissions in it, version from config file will be used instead
580 - scope: "ejabberd:admin"
594 - "connected_users_number"
596 ## By default the frequency of account registrations from the same IP
597 ## is limited to 1 account every 10 minutes. To disable, specify: infinity
598 ## registration_timeout: 600
601 ## Define specific Access Rules in a virtual host.
612 ###. ================
613 ###' DEFAULT LANGUAGE
616 ## language: Default language used for server messages.
621 ## Set a different default language in a virtual host.
631 ## Full path to a script that generates the image.
633 ## captcha_cmd: "/usr/share/ejabberd/captcha.sh"
636 ## Host for the URL and port where ejabberd listens for CAPTCHA requests.
638 ## captcha_host: "example.org:5280"
641 ## Limit CAPTCHA calls per minute for JID/IP to avoid DoS.
648 ## In order to use the acme certificate acquiring through "Let's Encrypt"
649 ## an http listener has to be configured to listen to port 80 so that
650 ## the authorization challenges posed by "Let's Encrypt" can be solved.
652 ## A simple way of doing this would be to add the following in the listening
653 ## section and to configure port forwarding from 80 to 5281 either via NAT
654 ## (for ipv4 only) or using frontends such as haproxy/nginx/sslh/etc.
658 ## module: ejabberd_http
662 ## A contact mail that the ACME Certificate Authority can contact in case of
663 ## an authorization issue, such as a server-initiated certificate revocation.
664 ## It is not mandatory to provide an email address but it is highly suggested.
665 contact: "mailto:example-admin@example.com"
668 ## The ACME Certificate Authority URL.
669 ## This could either be:
670 ## - https://acme-v01.api.letsencrypt.org - (Default) for the production CA
671 ## - https://acme-staging.api.letsencrypt.org - for the staging CA
672 ## - http://localhost:4000 - for a local version of the CA
673 ca_url: "https://acme-v01.api.letsencrypt.org"
679 ## Modules enabled in all ejabberd virtual hosts.
684 mod_announce: # recommends mod_adhoc
686 mod_blocking: {} # requires mod_privacy
690 mod_configure: {} # requires mod_adhoc
691 ## mod_delegation: {} # for xep0356
696 ## mod_http_fileserver:
697 ## docroot: "/var/www"
698 ## accesslog: "/var/log/ejabberd/access.log"
700 ## # docroot: "@HOME@/upload"
701 ## put_url: "https://@HOST@:5444"
702 ## thumbnail: false # otherwise needs the identify command from ImageMagick installed
703 ## mod_http_upload_quota:
706 ## XEP-0313: Message Archive Management
707 ## You might want to setup a SQL backend for MAM because the mnesia database is
708 ## limited to 2GB which might be exceeded on large servers
709 ## mod_mam: {} # for xep0313, mnesia is limited to 2GB, better use an SQL backend
711 ## host: "conference.@HOST@"
716 access_create: muc_create
717 access_persistent: muc_create
722 access_max_user_messages: max_user_offline_messages
731 access_createnode: pubsub_createnode
732 ## reduces resource comsumption, but XEP incompliant
733 ignore_pep_from_offline: true
734 ## XEP compliant, but increases resource comsumption
735 ## ignore_pep_from_offline: false
736 last_item_cache: false
740 - "pep" # pep requires mod_caps
742 mod_push_keepalive: {}
745 ## Protect In-Band account registrations with CAPTCHA.
747 ## captcha_protected: true
749 ## Set the minimum informational entropy for passwords.
751 ## password_strength: 32
753 ## After successful registration, the user receives
754 ## a message with this subject and body.
757 ## subject: "Welcome!"
760 ## Welcome to this XMPP server.
762 ## When a user registers, send a notification to
763 ## these XMPP accounts.
765 ## registration_watchers:
766 ## - "admin1@example.org"
768 ## Only clients in the server machine can register accounts
770 ## ip_access: trusted_network
772 ## Local c2s or remote s2s users cannot register accounts
778 mod_shared_roster: {}
783 mod_vcard_xupdate: {}
784 ## Convert all avatars posted by Android clients from WebP to JPEG
785 ## mod_avatar: # this module needs compile option --enable-graphics
790 resend_on_timeout: if_offline
791 ## Non-SASL Authentication (XEP-0078) is now disabled by default
792 ## because it's obsoleted and is used mostly by abandoned
794 ## mod_legacy_auth: {}
795 ## The module for S2S dialback (XEP-0220). Please note that you cannot
796 ## rely solely on dialback if you want to federate with other servers,
797 ## because a lot of servers have dialback disabled and instead rely on
798 ## PKIX authentication. Make sure you have proper certificates installed
799 ## and check your accessibility at https://check.messaging.one/
804 ## Enable modules with custom options in a specific virtual host
810 ## host: "mirror.localhost"
813 ## Enable modules management via ejabberdctl for installation and
814 ## uninstallation of public/private contributed modules
815 ## (enabled by default)
818 allow_contrib_modules: true
825 ### vim: set filetype=yaml tabstop=8 foldmarker=###',###. foldmethod=marker: