Description: adjust ejabberd.yml.example to sane defaults
 ejabberd's default configuration needs to be altered to be
 useful on Debian systems
Author: Philipp Huebner <debalance@debian.org>
Forwarded: not-needed

Index: ejabberd/ejabberd.yml.example
===================================================================
--- ejabberd.orig/ejabberd.yml.example
+++ ejabberd/ejabberd.yml.example
@@ -14,15 +14,47 @@
 ### Refer to http://en.wikipedia.org/wiki/YAML for the brief description.
 ###
 
-hosts:
-  - localhost
 
+# loglevel: Verbosity of log files generated by ejabberd
 loglevel: info
 
-## If you already have certificates, list them here
-# certfiles:
-#  - /etc/letsencrypt/live/domain.tld/fullchain.pem
-#  - /etc/letsencrypt/live/domain.tld/privkey.pem
+# rotation: Disable ejabberd's internal log rotation, as the Debian package
+# uses logrotate(8).
+log_rotate_count: 0
+
+# hosts: Domains served by ejabberd.
+# You can define one or several, for example:
+# hosts:
+#   - "example.net"
+#   - "example.com"
+#   - "example.org"
+
+hosts:
+  - localhost
+
+certfiles:
+  - "/etc/ejabberd/ejabberd.pem"
+#  - /etc/letsencrypt/live/localhost/fullchain.pem
+#  - /etc/letsencrypt/live/localhost/privkey.pem
+
+# TLS configuration
+define_macro:
+  'TLS_CIPHERS': "HIGH:!aNULL:!eNULL:!3DES:@STRENGTH"
+  'TLS_OPTIONS':
+    - "no_sslv3"
+    - "no_tlsv1"
+    - "no_tlsv1_1"
+    - "cipher_server_preference"
+    - "no_compression"
+    # 'DH_FILE': "/path/to/dhparams.pem"
+    # generated with: openssl dhparam -out dhparams.pem 2048
+
+c2s_ciphers: 'TLS_CIPHERS'
+s2s_ciphers: 'TLS_CIPHERS'
+c2s_protocol_options: 'TLS_OPTIONS'
+s2s_protocol_options: 'TLS_OPTIONS'
+# c2s_dhfile: 'DH_FILE'
+# s2s_dhfile: 'DH_FILE'
 
 listen:
   -
@@ -33,6 +65,7 @@ listen:
     shaper: c2s_shaper
     access: c2s
     starttls_required: true
+    protocol_options: 'TLS_OPTIONS'
   -
     port: 5223
     ip: "::"
@@ -41,6 +74,7 @@ listen:
     shaper: c2s_shaper
     access: c2s
     tls: true
+    protocol_options: 'TLS_OPTIONS'
   -
     port: 5269
     ip: "::"
@@ -52,17 +86,19 @@ listen:
     ip: "::"
     module: ejabberd_http
     tls: true
+    protocol_options: 'TLS_OPTIONS'
     request_handlers:
-      /admin: ejabberd_web_admin
       /api: mod_http_api
       /bosh: mod_bosh
-      /captcha: ejabberd_captcha
-      /upload: mod_http_upload
+      ## /captcha: ejabberd_captcha
+      ## /upload: mod_http_upload
       /ws: ejabberd_http_ws
   -
     port: 5280
     ip: "::"
     module: ejabberd_http
+    tls: true
+    protocol_options: 'TLS_OPTIONS'
     request_handlers:
       /admin: ejabberd_web_admin
       /.well-known/acme-challenge: ejabberd_acme
@@ -82,9 +118,26 @@ listen:
     module: mod_mqtt
     backlog: 1000
 
-s2s_use_starttls: optional
+
+## Disabling digest-md5 SASL authentication. digest-md5 requires plain-text
+## password storage (see auth_password_format option).
+disable_sasl_mechanisms:
+  - "digest-md5"
+  - "X-OAUTH2"
+
+s2s_use_starttls: required
+
+## Store the plain passwords or hashed for SCRAM:
+auth_password_format: scram
+
+## Full path to a script that generates the image.
+## captcha_cmd: "/usr/share/ejabberd/captcha.sh"
 
 acl:
+  ## admin:
+  ##   user:
+  ##     - "aleksey@localhost"
+  ##     - "ermine@example.org"
   local:
     user_regexp: ""
   loopback:
@@ -145,7 +198,7 @@ shaper:
   normal:
     rate: 3000
     burst_size: 20000
-  fast: 100000
+  fast: 200000
 
 shaper_rules:
   max_user_sessions: 10
@@ -169,23 +222,24 @@ modules:
   mod_carboncopy: {}
   mod_client_state: {}
   mod_configure: {}
+  ## mod_delegation: {}   # for xep0356
   mod_disco: {}
   mod_fail2ban: {}
   mod_http_api: {}
-  mod_http_upload:
-    put_url: https://@HOST@:5443/upload
-    custom_headers:
-      "Access-Control-Allow-Origin": "https://@HOST@"
-      "Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS"
-      "Access-Control-Allow-Headers": "Content-Type"
+  ## mod_http_upload:
+  ##   put_url: https://@HOST@:5443/upload
+  ##   custom_headers:
+  ##     "Access-Control-Allow-Origin": "https://@HOST@"
+  ##     "Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS"
+  ##     "Access-Control-Allow-Headers": "Content-Type"
   mod_last: {}
-  mod_mam:
-    ## Mnesia is limited to 2GB, better to use an SQL backend
-    ## For small servers SQLite is a good fit and is very easy
-    ## to configure. Uncomment this when you have SQL configured:
-    ## db_type: sql
-    assume_mam_usage: true
-    default: always
+  ## mod_mam:
+  ##   ## Mnesia is limited to 2GB, better to use an SQL backend
+  ##   ## For small servers SQLite is a good fit and is very easy
+  ##   ## to configure. Uncomment this when you have SQL configured:
+  ##   ## db_type: sql
+  ##   assume_mam_usage: true
+  ##   default: always
   mod_mqtt: {}
   mod_muc:
     access:
@@ -202,41 +256,47 @@ modules:
   mod_offline:
     access_max_user_messages: max_user_offline_messages
   mod_ping: {}
+  mod_pres_counter:
+    count: 5
+    interval: 60
   mod_privacy: {}
   mod_private: {}
-  mod_proxy65:
-    access: local
-    max_connections: 5
+  ## mod_proxy65:
+  ##   access: local
+  ##   max_connections: 5
   mod_pubsub:
     access_createnode: pubsub_createnode
     plugins:
       - flat
       - pep
     force_node_config:
+      "eu.siacs.conversations.axolotl.*":
+        access_model: open
       ## Avoid buggy clients to make their bookmarks public
       storage:bookmarks:
         access_model: whitelist
   mod_push: {}
   mod_push_keepalive: {}
-  mod_register:
-    ## Only accept registration requests from the "trusted"
-    ## network (see access_rules section above).
-    ## Think twice before enabling registration from any
-    ## address. See the Jabber SPAM Manifesto for details:
-    ## https://github.com/ge0rg/jabber-spam-fighting-manifesto
-    ip_access: trusted_network
+  ## mod_register:
+  ##   ## Only accept registration requests from the "trusted"
+  ##   ## network (see access_rules section above).
+  ##   ## Think twice before enabling registration from any
+  ##   ## address. See the Jabber SPAM Manifesto for details:
+  ##   ## https://github.com/ge0rg/jabber-spam-fighting-manifesto
+  ##   ip_access: trusted_network
   mod_roster:
     versioning: true
   mod_s2s_bidi: {}
   mod_s2s_dialback: {}
   mod_shared_roster: {}
+  mod_sic: {}
   mod_stream_mgmt:
     resend_on_timeout: if_offline
   mod_stun_disco: {}
-  mod_vcard: {}
+  mod_vcard:
+    search: false
   mod_vcard_xupdate: {}
-  mod_version:
-    show_os: false
+  mod_version: {}
 
 ### Local Variables:
 ### mode: yaml