XMPP Service Operators - 2024-04-04

> im sure there is a better way to handle it, thats just how i set it up in a pinch, and it certainly does need improvement. im still yet to get moparisthebest's xmpp-proxy set up properly with prosody. tried before, but couldnt seem to get it to work properly. I don't see how a reverse proxy is useful here ↺

reverse proxies became widely used in web because of no ability to use ports other than 443

with SRV record support for XMPP, adding a single point of failure (a reverse proxy) when service records can specify different ports for different servers seems counter productive

but whatever floats your boat 🙂

I guess its useful for load balancing

yes thats the point

how many users do you have O.O

for XMPP? not many, yet. i dont know an exact number.

i havent really tried to "advertise" my service or anything. i did try to put it on list.jabber.at (i think thats it), but i think it blocks Tor or something. it would not send me a confirmation email or message.

I see no reason for this

it just seems like additional latency, points of failure

you can do all this with SRV records no?

and more powerful too

I dont know.

i will look into it though

SRV weight is well the weighting on being picked

and SRV priority for priority

define main servers, and failover servers for example

and as for latency, it probably adds like 5ms of latency, at most.

idk I guess moparisthebest would have to explain why use his xmpp-proxy

but I don't see why SRV can't do it all

Seems flakey to use SRV for load balancing.

> Seems flakey to use SRV for load balancing. flakey? ↺

Just doesn't seem it should be used for that purpose.

i know what srv records are, but ive never had a reason to look into them or even use them. so im not sure exactly what they are capable of when it comes to load balancing. i will take your advice and look into it, however.

> i know what srv records are, but ive never had a reason to look into them or even use them. so im not sure exactly what they are capable of when it comes to load balancing. i will take your advice and look into it, however. SRV was designed for that purpose... ↺

I see.

well not designed specifically for the purpose, but it was thought out

https://datatracker.ietf.org/doc/html/rfc2782

> Just doesn't seem it should be used for that purpose. any benchmarks or proof of this? can't eliminate an option without solid proof it doesn't work ↺

like i said though, the only reason i set this up in the first place was to mitigate some DDoS attacks from a certain group of people. hence why the backend isnt even hidden on XMPP when connecting to other servers. there was just some script kiddies trying to troll.

and the solution seemed to work pretty well.

they were not able to take down every server at once.

or any of them, for that matter, since their HTTP flood was being distributed across all servers and seemingly none of them got overwhelmed.

ah this (https://datatracker.ietf.org/doc/html/rfc6120#section-3.2.3) answers why rewtkid didn't use srv

like i said though, the setup is definetly not as good as it could be, but it got the job done in a pinch

although funny thing is moparisthebest was the one which worte https://xmpp.org/extensions/xep-0368.html

> like i said though, the setup is definetly not as good as it could be, but it got the job done in a pinch why not just KISS ↺

it is pretty simple, its just HAProxy, nginx reverse proxies, and A records.

but multiple XMPP servers?

there is only one xmpp server, which runs on the backend server. each reverse proxy server forwards the requests to the same XMPP server.

oh.

Yeah, lol

that seems very overcomplicated...

not really, its pretty trivial to accomplish with HAProxy

whatever floats your boat I guess

does it store logs though 😉 (seen as you have a no log policy hehe)

nope

also moparisthebest, sorry to disturb, but for xmpp-proxy, it seemingly sends traffic to the backend server in plaintext from what i understand. this might pose a security risk, in some cases. are there any workarounds for this that you can recommend?

from*

i do want to use it, seems very useful for what im trying to accomplish here. but that is one thing that sets me off about using it.

really all im trying to do is proxy S2S connections. if anyone has any solutions of recommendations, please let me know. i am running prosody, for the record.

rewtkid: currently it is plaintext between xmpp-proxy and the backend server because they are meant to run on the same machine or trusted network, preferably over a Unix socket even... If you have a use case where that should be encrypted it's trivial I think...

hmm, could maybe use HAProxy with PROXY protocol. but that would only proxy inbound connections, not outbound connections.

maybe it would be possible to use something like socat and open a TLS socket to the backend server, then have both sides send connections to socat's listener, instead of directly to the other machine?

And if haproxy does TLS then sasl external auth won't work and you need that for incoming s2s, and indeed no outgoing, you can join xmpp:xmpp-proxy@code.moparisthe.best?join if you have more questions

Yes you could run xmpp-proxy over stunnel/socat

I see, might try that later on then. if i have more questions ill pop into your chat

not sure if I can ask here.. I would like to show my webchat (I have a conversejs prosody module and a Movim instance) in search.jabber.network, but I don't know how

roughnecks, https://search.jabber.network/docs/operators scroll down to features

thanks jonas’

would that be ok if my webclient only accepts connections from my server?

Wouldn't that defy the purpose. And confuse 90% of the people pressing the link?

guess so :)

roughnecks, what do you mean by "accepts connections only from your server"?

that you can't connect if your account is not from my server

oh

no that's totally sensible

but "Join via web" expects that it's an anonymous thing

so without login

For your own users, I think it would be best if you announce your xmpp we client in some other way. Maybe on your homepage

okay then, nevermind

hi

Hey, im new to xmpp and trying to figure it out on pidgin with otr. does anyone want to give me thier usrname so i can see if its working..

Hi, welcome! Pidgin with OTR is not a great place to start. I recommend checking out the guides at https://joinjabber.org

OTR is a very old encryption method and very few people would be able to talk to you using it

So you reccomend OMEMO?

It has been removed from most XMPP software, replaced by OMEMO. However Pidgin's XMPP support is currently very out of date.

im trying to setup xmpp with encry[tion on tailsos which comes with pidgin...

I will check out that link, thanks.

yoyoyo, I highly recommend giving Gajim.org a try. It works great on linux

Stix (loqi) looks like a good option, thx

Stix (loqi) thx for the recomendation. I was able to set it up through Tor on TailsOS. much better ui then pidgin also

Great! Just make sure you're using the up to date version of gajim 1.8.4

im using 1.7.3

i downloaded it using sudo apt install gajim

is that alright?

https://packages.debian.org/search?keywords=gajim

im on stable, i guess thats why..

try a newer version

Latest gajim is in stable-backports

As I know there is an own repo for TailOS ? Maybe they stay on 1.7.3 ?