Conversations re-authenticated every 5-10 minutes (138 full logins in
two days) because no XEP-0198 module was loaded. Each reconnect re-ran
its OMEMO bootstrap and republished the PEP device list built from a
partial fetch, which dropped the desktop client's device id from the
list. Senders then encrypted to nobody, and Gajim showed "could not be
decrypted" until it reconnected and re-added itself.
smacks lets the session resume across network blips, csi_simple keeps
backgrounded clients quiet. Both ship with Prosody 0.12.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Jingle A/V (XEP-0166/0167/0176) needs a STUN/TURN server for NAT
traversal. Add coturn and advertise it to clients via XEP-0215.
- coturn container, host networking (a relay needs its full UDP port
range reachable, and Docker NAT hides the peer addresses coturn needs).
- mod_turn_external in Prosody to advertise the service and mint
time-limited credentials from a shared secret.
- Advertise UDP and TCP transports plus turns: on 5349, so clients on
UDP-blocking networks can still connect.
- Deny relaying to private ranges, so this is not an open proxy into
internal services.
TURN host is guschin.info rather than turn.guschin.info because only the
former is in the certificate SANs and turns: clients validate the name.
TURN_HOST/TURN_SECRET go in .env, which is gitignored and set per
deployment; TURN_SECRET must match static-auth-secret in turnserver.conf.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Users can now register as name@guschin.info or name@xmpp.guschin.info.
Added Let's Encrypt cert mounting and install for guschin.info domain.
Refactored entrypoint cert install into reusable function.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
VirtualHost changed from "guschin.info" to "xmpp.guschin.info" to match
the Let's Encrypt certificate. Moved certificates directive before
VirtualHost block. Removed misplaced default_realm and global ssl block.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
