mirror of https://github.com/jitsi/jitsi-meet
feat: Adds docs, config and scripts around the visitor mode. (#12658)
* feat: Moves handle of vnode from conferenceIQ stanza error to result. * feat: Handles redirected to visitor node event. * feat: Adds README and configurations. * squash: Drop comment. * copy edits * image fix * fix background for dark mode * fix the background * feat: Update s2soutinjection. * Update README commands formatting. * Update doc/extra-large-conference/README.md Co-authored-by: Saúl Ibarra Corretgé <saghul@jitsi.org> * squash: Creates a generateVisitorConfig helper. * squash: Moves the folder from doc. * squash: Update example. * squash: Drop config. * squash: Rename var to look like template. * squash: Fix plugins path. * squash: Fix sort order of import. * squash: Fix lint errors. Co-authored-by: scott boone <scott.e.boone@gmail.com> Co-authored-by: Scott Boone <scott.boone@8x8.com> Co-authored-by: Saúl Ibarra Corretgé <saghul@jitsi.org>pull/12680/head jitsi-meet_8153
Дамян Минков
2 years ago
committed by
GitHub
parent
3445c513ba
commit
9fbbe05d6c
@ -0,0 +1,88 @@ |
|||||||
|
WARNING: This is still a Work In Progress |
||||||
|
|
||||||
|
The final implementation may diverge. Currently, only the participants after a |
||||||
|
configured threshold will be just viewers (visitors) and there is no promotion |
||||||
|
mechanism to become a main participant yet. |
||||||
|
|
||||||
|
TODO: |
||||||
|
* Merge messaging between visitor nodes and main conference |
||||||
|
* Polls |
||||||
|
* Raise hand to be promoted to enter the main conference |
||||||
|
* Make sure it works with tenants. |
||||||
|
|
||||||
|
|
||||||
|
# Low-latency conference streaming to very large audiences |
||||||
|
|
||||||
|
To have a low-latency conference with a very large audience, the media and |
||||||
|
signaling load must be spread beyond what can be handled by a typical Jitsi |
||||||
|
installation. A call with 10k participants requires around 50 bridges on decent |
||||||
|
vms (8+ cores). The main participants of a conference with a very large |
||||||
|
audience will share a main prosody, like with normal conferences, and |
||||||
|
additional prosody vms are needed to support signaling to the audience. |
||||||
|
|
||||||
|
In the example configuration we use a 16 core machine. Eight of the cores are |
||||||
|
used for the main prosody and other services (nginx, jicofo, etc) and the other |
||||||
|
eight cores are used to run prosody services for visitors, i.e., "visitor |
||||||
|
prosodies". |
||||||
|
|
||||||
|
We consider 2000 participants per visitor node a safe value. So eight visitor |
||||||
|
prosodies will be enough for one 10k participants meeting. |
||||||
|
|
||||||
|
<img src="imgs/visitors-prosody.svg" alt="diagram of a central prosody connected to several visitor prosodies" width="500"/> |
||||||
|
|
||||||
|
# Configuration |
||||||
|
Use the `pre-configure.sh` script to configure your system, passing it the |
||||||
|
number of visitor prosodies to set up. |
||||||
|
`./pre-configure.sh 8` |
||||||
|
|
||||||
|
The script will add for each visitor prosody: |
||||||
|
- folders in `/etc/` |
||||||
|
- a systemd unit file in `/lib/systemd/system/` |
||||||
|
- a user for jicofo |
||||||
|
- a config entry in jicofo.conf |
||||||
|
|
||||||
|
Setting up configuration for the main prosody is a manual process: |
||||||
|
- Add to the enabled modules list in the general part (e.g. [here](https://github.com/bjc/prosody/blob/76bf6d511f851c7cde8a81257afaaae0fb7a4160/prosody.cfg.lua.dist#L33)): |
||||||
|
``` |
||||||
|
"s2s_bidi"; |
||||||
|
"certs_s2soutinjection"; |
||||||
|
"s2soutinjection"; |
||||||
|
"s2s_whitelist"; |
||||||
|
``` |
||||||
|
|
||||||
|
- Add the following config also in the general part (matching the number of prosodies you generated config for): |
||||||
|
``` |
||||||
|
-- targets must be IPs, not hostnames |
||||||
|
s2s_connect_overrides = { |
||||||
|
["conference.v1.meet.jitsi"] = { "127.0.0.1", 52691 }; |
||||||
|
["conference.v2.meet.jitsi"] = { "127.0.0.1", 52692 }; |
||||||
|
["conference.v3.meet.jitsi"] = { "127.0.0.1", 52693 }; |
||||||
|
["conference.v4.meet.jitsi"] = { "127.0.0.1", 52694 }; |
||||||
|
["conference.v5.meet.jitsi"] = { "127.0.0.1", 52695 }; |
||||||
|
["conference.v6.meet.jitsi"] = { "127.0.0.1", 52696 }; |
||||||
|
["conference.v7.meet.jitsi"] = { "127.0.0.1", 52697 }; |
||||||
|
["conference.v8.meet.jitsi"] = { "127.0.0.1", 52698 }; |
||||||
|
} |
||||||
|
-- allowed list of server-2-server connections |
||||||
|
s2s_whitelist = { |
||||||
|
"conference.v1.meet.jitsi", "conference.v2.meet.jitsi", "conference.v3.meet.jitsi", "conference.v4.meet.jitsi", |
||||||
|
"conference.v5.meet.jitsi", "conference.v6.meet.jitsi", "conference.v7.meet.jitsi", "conference.v8.meet.jitsi" |
||||||
|
}; |
||||||
|
``` |
||||||
|
|
||||||
|
- Make sure s2s is not in modules_disabled |
||||||
|
- Enable `"xxl_conference";` module under the main virtual host (e.g. [here](https://github.com/jitsi/jitsi-meet/blob/f42772ec5bcc87ff6de17423d36df9bcad6e770d/doc/debian/jitsi-meet-prosody/prosody.cfg.lua-jvb.example#L57)) |
||||||
|
|
||||||
|
After configuring you can set the maximum number of main participants, before |
||||||
|
redirecting to visitors. |
||||||
|
``` |
||||||
|
hocon -f /etc/jitsi/jicofo/jicofo.conf set "jicofo.visitors.max-participants" 30 |
||||||
|
``` |
||||||
|
Now restart prosody and jicofo |
||||||
|
``` |
||||||
|
service prosody restart |
||||||
|
service jicofo restart |
||||||
|
``` |
||||||
|
|
||||||
|
Now after the main 30 participants join, the rest will be visitors using the |
||||||
|
visitor nodes. |
||||||
|
After Width: | Height: | Size: 198 KiB |
@ -0,0 +1,51 @@ |
|||||||
|
#!/bin/bash |
||||||
|
|
||||||
|
SCRIPT_DIR=`dirname "$0"` |
||||||
|
cd $SCRIPT_DIR |
||||||
|
|
||||||
|
NUMBER_OF_INSTANCES=$1 |
||||||
|
|
||||||
|
if ! [[ $NUMBER_OF_INSTANCES =~ ^[0-9]+([.][0-9]+)?$ ]] ; then |
||||||
|
echo "error: Not a number param" >&2; |
||||||
|
exit 1 |
||||||
|
fi |
||||||
|
|
||||||
|
echo "Will configure $NUMBER_OF_INSTANCES number of visitor prosodies" |
||||||
|
set -e |
||||||
|
set -x |
||||||
|
|
||||||
|
# Configure prosody instances |
||||||
|
for (( i=1 ; i<=${NUMBER_OF_INSTANCES} ; i++ )); |
||||||
|
do |
||||||
|
cp prosody-v.service.template /lib/systemd/system/prosody-v${i}.service |
||||||
|
sed -i "s/vX/v${i}/g" /lib/systemd/system/prosody-v${i}.service |
||||||
|
mkdir /etc/prosody-v${i} |
||||||
|
ln -s /etc/prosody/certs /etc/prosody-v${i}/certs |
||||||
|
cp prosody.cfg.lua.visitor.template /etc/prosody-v${i}/prosody.cfg.lua |
||||||
|
sed -i "s/vX/v${i}/g" /etc/prosody-v${i}/prosody.cfg.lua |
||||||
|
done |
||||||
|
|
||||||
|
# Configure jicofo |
||||||
|
HOCON_CONFIG="/etc/jitsi/jicofo/jicofo.conf" |
||||||
|
hocon -f $HOCON_CONFIG set "jicofo.bridge.selection-strategy" "VisitorSelectionStrategy" |
||||||
|
hocon -f $HOCON_CONFIG set "jicofo.bridge.visitor-selection-strategy" "RegionBasedBridgeSelectionStrategy" |
||||||
|
hocon -f $HOCON_CONFIG set "jicofo.bridge.topology-strategy" "VisitorTopologyStrategy" |
||||||
|
|
||||||
|
PASS=$(hocon -f $HOCON_CONFIG get "jicofo.xmpp.client.password") |
||||||
|
for (( i=1 ; i<=${NUMBER_OF_INSTANCES} ; i++ )); |
||||||
|
do |
||||||
|
prosodyctl --config /etc/prosody-v${i}/prosody.cfg.lua register focus auth.meet.jitsi $PASS |
||||||
|
hocon -f $HOCON_CONFIG set "jicofo.xmpp.visitors.v${i}.enabled" true |
||||||
|
hocon -f $HOCON_CONFIG set "jicofo.xmpp.visitors.v${i}.conference-service" "conference.v${i}.meet.jitsi" |
||||||
|
hocon -f $HOCON_CONFIG set "jicofo.xmpp.visitors.v${i}.hostname" 127.0.0.1 |
||||||
|
hocon -f $HOCON_CONFIG set "jicofo.xmpp.visitors.v${i}.port" 5222${i} |
||||||
|
hocon -f $HOCON_CONFIG set "jicofo.xmpp.visitors.v${i}.domain" "auth.meet.jitsi" |
||||||
|
hocon -f $HOCON_CONFIG set "jicofo.xmpp.visitors.v${i}.password" "${PASS}" |
||||||
|
hocon -f $HOCON_CONFIG set "jicofo.xmpp.visitors.v${i}.disable-certificate-verification" true |
||||||
|
done |
||||||
|
|
||||||
|
for (( i=1 ; i<=${NUMBER_OF_INSTANCES} ; i++ )); |
||||||
|
do |
||||||
|
service prosody-v${i} restart |
||||||
|
done |
||||||
|
service jicofo restart |
||||||
@ -0,0 +1,46 @@ |
|||||||
|
[Unit] |
||||||
|
### see man systemd.unit |
||||||
|
Description=Prosody vX (visitor vX) JVB XMPP Server |
||||||
|
Documentation=https://prosody.im/doc |
||||||
|
|
||||||
|
Requires=network-online.target |
||||||
|
After=network-online.target network.target mariadb.service mysql.service postgresql.service |
||||||
|
Before=biboumi.service |
||||||
|
|
||||||
|
[Service] |
||||||
|
### see man systemd.service |
||||||
|
Type=simple |
||||||
|
|
||||||
|
# Start by executing the main executable |
||||||
|
# Note: -F option requires Prosody 0.11.5 or later |
||||||
|
ExecStart=/usr/bin/prosody --config /etc/prosody-vX/prosody.cfg.lua -F |
||||||
|
ExecReload=/bin/kill -HUP $MAINPID |
||||||
|
Restart=on-abnormal |
||||||
|
|
||||||
|
### see man systemd.exec |
||||||
|
User=prosody |
||||||
|
Group=prosody |
||||||
|
UMask=0027 |
||||||
|
|
||||||
|
RuntimeDirectory=prosody-vX |
||||||
|
ConfigurationDirectory=prosody-vX |
||||||
|
StateDirectory=prosody-vX |
||||||
|
StateDirectoryMode=0750 |
||||||
|
LogsDirectory=prosody-vX |
||||||
|
WorkingDirectory=~ |
||||||
|
|
||||||
|
# Set stdin to /dev/null since Prosody does not need it |
||||||
|
StandardInput=null |
||||||
|
|
||||||
|
# Direct stdout/-err to journald for use with log = "*stdout" |
||||||
|
StandardOutput=journal |
||||||
|
StandardError=inherit |
||||||
|
|
||||||
|
# Allow binding low ports |
||||||
|
AmbientCapabilities=CAP_NET_BIND_SERVICE |
||||||
|
|
||||||
|
[Install] |
||||||
|
### see man systemd.unit |
||||||
|
WantedBy=multi-user.target |
||||||
|
|
||||||
|
# vim: filetype=systemd |
||||||
@ -0,0 +1,121 @@ |
|||||||
|
---------- Server-wide settings ---------- |
||||||
|
s2s_ports = { 52691 }; |
||||||
|
c2s_ports = { 52221 } |
||||||
|
http_ports = { 52801 } |
||||||
|
https_ports = { 52811 } |
||||||
|
|
||||||
|
daemonize = true; |
||||||
|
|
||||||
|
-- we use a common jid for jicofo |
||||||
|
admins = { |
||||||
|
'focus@auth.meet.jitsi' |
||||||
|
} |
||||||
|
|
||||||
|
-- Enable use of native prosody 0.11 support for epoll over select |
||||||
|
network_backend = 'epoll'; |
||||||
|
network_settings = { |
||||||
|
tcp_backlog = 511; |
||||||
|
} |
||||||
|
|
||||||
|
modules_enabled = { |
||||||
|
'saslauth'; |
||||||
|
'tls'; |
||||||
|
'disco'; |
||||||
|
'posix'; |
||||||
|
|
||||||
|
'secure_interfaces'; |
||||||
|
|
||||||
|
-- jitsi |
||||||
|
'websocket'; |
||||||
|
'bosh'; |
||||||
|
's2s_bidi'; |
||||||
|
's2s_whitelist'; |
||||||
|
}; |
||||||
|
|
||||||
|
s2s_whitelist = {}; |
||||||
|
|
||||||
|
external_service_secret = '__turnSecret__'; |
||||||
|
|
||||||
|
external_services = { |
||||||
|
{ type = 'stun', host = 'jitmeet.example.com', port = 3478 }, |
||||||
|
{ type = 'turn', host = 'jitmeet.example.com', port = 3478, transport = 'udp', secret = true, ttl = 86400, algorithm = 'turn' }, |
||||||
|
{ type = 'turns', host = 'jitmeet.example.com', port = 5349, transport = 'tcp', secret = true, ttl = 86400, algorithm = 'turn' } |
||||||
|
}; |
||||||
|
|
||||||
|
muc_mapper_domain_base = 'vX.meet.jitsi'; |
||||||
|
|
||||||
|
-- https://prosody.im/doc/modules/mod_smacks |
||||||
|
smacks_max_unacked_stanzas = 5; |
||||||
|
smacks_hibernation_time = 60; |
||||||
|
-- this is dropped in 0.12 |
||||||
|
smacks_max_hibernated_sessions = 1; |
||||||
|
smacks_max_old_sessions = 1; |
||||||
|
|
||||||
|
unlimited_jids = { 'focus@auth.meet.jitsi' } |
||||||
|
limits = { |
||||||
|
c2s = { |
||||||
|
rate = '512kb/s'; |
||||||
|
}; |
||||||
|
} |
||||||
|
|
||||||
|
modules_disabled = { |
||||||
|
'offline'; |
||||||
|
'pubsub'; |
||||||
|
'register'; |
||||||
|
}; |
||||||
|
|
||||||
|
allow_registration = false; |
||||||
|
authentication = 'internal_hashed' |
||||||
|
storage = 'internal' |
||||||
|
log = { |
||||||
|
-- Log files (change 'info' to 'debug' for debug logs): |
||||||
|
info = '/var/log/prosody-vX/prosody.log'; |
||||||
|
error = '/var/log/prosody-vX/prosody.err'; |
||||||
|
} |
||||||
|
|
||||||
|
consider_websocket_secure = true; |
||||||
|
consider_bosh_secure = true; |
||||||
|
bosh_max_inactivity = 60; |
||||||
|
|
||||||
|
plugin_paths = { '/usr/share/jitsi-meet/prosody-plugins/' } |
||||||
|
|
||||||
|
----------- Virtual hosts ----------- |
||||||
|
VirtualHost 'vX.meet.jitsi' |
||||||
|
authentication = 'jitsi-anonymous' |
||||||
|
ssl = { |
||||||
|
key = '/etc/prosody/certs/jitmeet.example.com.key'; |
||||||
|
certificate = '/etc/prosody/certs/jitmeet.example.com.crt'; |
||||||
|
} |
||||||
|
modules_enabled = { |
||||||
|
'bosh'; |
||||||
|
'ping'; |
||||||
|
'external_services'; |
||||||
|
'smacks'; |
||||||
|
'jiconop'; |
||||||
|
} |
||||||
|
main_muc = 'conference.vX.meet.jitsi'; |
||||||
|
|
||||||
|
VirtualHost 'auth.meet.jitsi' |
||||||
|
modules_enabled = { |
||||||
|
'limits_exception'; |
||||||
|
'ping'; |
||||||
|
} |
||||||
|
authentication = 'internal_hashed' |
||||||
|
|
||||||
|
Component 'conference.vX.meet.jitsi' 'muc' |
||||||
|
storage = 'memory' |
||||||
|
muc_room_cache_size = 10000 |
||||||
|
restrict_room_creation = true |
||||||
|
modules_enabled = { |
||||||
|
'muc_hide_all'; |
||||||
|
'muc_domain_mapper'; |
||||||
|
'muc_meeting_id'; |
||||||
|
'fmuc'; |
||||||
|
} |
||||||
|
muc_room_default_presence_broadcast = { |
||||||
|
visitor = false; |
||||||
|
participant = true; |
||||||
|
moderator = true; |
||||||
|
}; |
||||||
|
muc_room_locking = false |
||||||
|
muc_room_default_public_jids = true |
||||||
@ -1,16 +0,0 @@ |
|||||||
-- validates all certificates, global module |
|
||||||
-- Warning: use this only for testing purposes as it will accept all kind of certificates for s2s connections |
|
||||||
-- you can use https://modules.prosody.im/mod_s2s_whitelist.html for whitelisting only certain destinations |
|
||||||
module:set_global(); |
|
||||||
|
|
||||||
function attach(event) |
|
||||||
local session = event.session; |
|
||||||
|
|
||||||
session.cert_chain_status = 'valid'; |
|
||||||
session.cert_identity_status = 'valid'; |
|
||||||
|
|
||||||
return true; |
|
||||||
end |
|
||||||
module:wrap_event('s2s-check-certificate', function (handlers, event_name, event_data) |
|
||||||
return attach(event_data); |
|
||||||
end); |
|
||||||
@ -0,0 +1,19 @@ |
|||||||
|
-- global module |
||||||
|
-- validates certificates for all hosts used for s2soutinjection |
||||||
|
module:set_global(); |
||||||
|
|
||||||
|
local s2s_overrides = module:get_option("s2s_connect_overrides"); |
||||||
|
|
||||||
|
function attach(event) |
||||||
|
local session = event.session; |
||||||
|
|
||||||
|
if s2s_overrides and s2s_overrides[event.host] then |
||||||
|
session.cert_chain_status = 'valid'; |
||||||
|
session.cert_identity_status = 'valid'; |
||||||
|
|
||||||
|
return true; |
||||||
|
end |
||||||
|
end |
||||||
|
module:wrap_event('s2s-check-certificate', function (handlers, event_name, event_data) |
||||||
|
return attach(event_data); |
||||||
|
end); |
||||||
@ -0,0 +1,20 @@ |
|||||||
|
-- Using version https://hg.prosody.im/prosody-modules/file/c1a8ce147885/mod_s2s_whitelist/mod_s2s_whitelist.lua |
||||||
|
local st = require "util.stanza"; |
||||||
|
|
||||||
|
local whitelist = module:get_option_inherited_set("s2s_whitelist", {}); |
||||||
|
|
||||||
|
module:hook("route/remote", function (event) |
||||||
|
if not whitelist:contains(event.to_host) then |
||||||
|
module:send(st.error_reply(event.stanza, "cancel", "not-allowed", "Communication with this domain is restricted")); |
||||||
|
return true; |
||||||
|
end |
||||||
|
end, 100); |
||||||
|
|
||||||
|
module:hook("s2s-stream-features", function (event) |
||||||
|
if not whitelist:contains(event.origin.from_host) then |
||||||
|
event.origin:close({ |
||||||
|
condition = "policy-violation"; |
||||||
|
text = "Communication with this domain is restricted"; |
||||||
|
}); |
||||||
|
end |
||||||
|
end, 1000); |
||||||
@ -0,0 +1,90 @@ |
|||||||
|
-- Using version https://hg.prosody.im/prosody-modules/file/4fb922aa0ace/mod_s2soutinjection/mod_s2soutinjection.lua |
||||||
|
local st = require"util.stanza"; |
||||||
|
local new_outgoing = require"core.s2smanager".new_outgoing; |
||||||
|
local bounce_sendq = module:depends"s2s".route_to_new_session.bounce_sendq; |
||||||
|
local initialize_filters = require "util.filters".initialize; |
||||||
|
|
||||||
|
local portmanager = require "core.portmanager"; |
||||||
|
|
||||||
|
local addclient = require "net.server".addclient; |
||||||
|
|
||||||
|
module:depends("s2s"); |
||||||
|
|
||||||
|
local sessions = module:shared("sessions"); |
||||||
|
|
||||||
|
local injected = module:get_option("s2s_connect_overrides"); |
||||||
|
|
||||||
|
-- The proxy_listener handles connection while still connecting to the proxy, |
||||||
|
-- then it hands them over to the normal listener (in mod_s2s) |
||||||
|
local proxy_listener = { default_port = nil, default_mode = "*a", default_interface = "*" }; |
||||||
|
|
||||||
|
function proxy_listener.onconnect(conn) |
||||||
|
local session = sessions[conn]; |
||||||
|
|
||||||
|
-- Now the real s2s listener can take over the connection. |
||||||
|
local listener = portmanager.get_service("s2s").listener; |
||||||
|
|
||||||
|
local log = session.log; |
||||||
|
|
||||||
|
local filter = initialize_filters(session); |
||||||
|
|
||||||
|
session.version = 1; |
||||||
|
|
||||||
|
session.sends2s = function (t) |
||||||
|
log("debug", "sending (s2s over proxy): %s", (t.top_tag and t:top_tag()) or t:match("^[^>]*>?")); |
||||||
|
if t.name then |
||||||
|
t = filter("stanzas/out", t); |
||||||
|
end |
||||||
|
if t then |
||||||
|
t = filter("bytes/out", tostring(t)); |
||||||
|
if t then |
||||||
|
return conn:write(tostring(t)); |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
session.open_stream = function () |
||||||
|
session.sends2s(st.stanza("stream:stream", { |
||||||
|
xmlns='jabber:server', ["xmlns:db"]='jabber:server:dialback', |
||||||
|
["xmlns:stream"]='http://etherx.jabber.org/streams', |
||||||
|
from=session.from_host, to=session.to_host, version='1.0', ["xml:lang"]='en'}):top_tag()); |
||||||
|
end |
||||||
|
|
||||||
|
conn.setlistener(conn, listener); |
||||||
|
|
||||||
|
listener.register_outgoing(conn, session); |
||||||
|
|
||||||
|
listener.onconnect(conn); |
||||||
|
end |
||||||
|
|
||||||
|
function proxy_listener.register_outgoing(conn, session) |
||||||
|
session.direction = "outgoing"; |
||||||
|
sessions[conn] = session; |
||||||
|
end |
||||||
|
|
||||||
|
function proxy_listener.ondisconnect(conn, err) |
||||||
|
sessions[conn] = nil; |
||||||
|
end |
||||||
|
|
||||||
|
module:hook("route/remote", function(event) |
||||||
|
local from_host, to_host, stanza = event.from_host, event.to_host, event.stanza; |
||||||
|
local inject = injected and injected[to_host]; |
||||||
|
if not inject then return end |
||||||
|
module:log("debug", "opening a new outgoing connection for this stanza"); |
||||||
|
local host_session = new_outgoing(from_host, to_host); |
||||||
|
|
||||||
|
-- Store in buffer |
||||||
|
host_session.bounce_sendq = bounce_sendq; |
||||||
|
host_session.sendq = { {tostring(stanza), stanza.attr.type ~= "error" and stanza.attr.type ~= "result" and st.reply(stanza)} }; |
||||||
|
host_session.log("debug", "stanza [%s] queued until connection complete", tostring(stanza.name)); |
||||||
|
|
||||||
|
local host, port = inject[1] or inject, tonumber(inject[2]) or 5269; |
||||||
|
|
||||||
|
local conn = addclient(host, port, proxy_listener, "*a"); |
||||||
|
|
||||||
|
proxy_listener.register_outgoing(conn, host_session); |
||||||
|
|
||||||
|
host_session.conn = conn; |
||||||
|
return true; |
||||||
|
end, -2); |
||||||
|
|
||||||
@ -0,0 +1,20 @@ |
|||||||
|
-- Using version https://hg.prosody.im/prosody-modules/file/6c806a99f802/mod_secure_interfaces/mod_secure_interfaces.lua |
||||||
|
local secure_interfaces = module:get_option_set("secure_interfaces", { "127.0.0.1", "::1" }); |
||||||
|
|
||||||
|
module:hook("stream-features", function (event) |
||||||
|
local session = event.origin; |
||||||
|
if session.type ~= "c2s_unauthed" then return; end |
||||||
|
local socket = session.conn:socket(); |
||||||
|
if not socket.getsockname then |
||||||
|
module:log("debug", "Unable to determine local address of incoming connection"); |
||||||
|
return; |
||||||
|
end |
||||||
|
local localip = socket:getsockname(); |
||||||
|
if secure_interfaces:contains(localip) then |
||||||
|
module:log("debug", "Marking session from %s to %s as secure", session.ip or "[?]", localip); |
||||||
|
session.secure = true; |
||||||
|
session.conn.starttls = false; |
||||||
|
else |
||||||
|
module:log("debug", "Not marking session from %s to %s as secure", session.ip or "[?]", localip); |
||||||
|
end |
||||||
|
end, 2500); |
||||||
Loading…
Reference in new issue