162 lines
7.4 KiB
Lua
162 lines
7.4 KiB
Lua
-- VirtualHost blocks fragment. See prosody.cfg.lua for the fragment layout.
|
|
|
|
VirtualHost "localhost"
|
|
authentication = "token"
|
|
app_id = "jitsi"
|
|
asap_key_server = "http://localhost:5280/test-observer/asap-keys"
|
|
signature_algorithm = "RS256"
|
|
allow_empty_token = true
|
|
|
|
-- Serve test_observer HTTP endpoints here so plain HTTP on port 5280 is
|
|
-- reachable. Component HTTP routes end up on HTTPS 5281 due to Prosody's
|
|
-- virtual-host routing, which does not match Host: localhost on port 5280.
|
|
modules_enabled = {
|
|
-- test-only: HTTP endpoints and census helpers
|
|
"test_observer_http";
|
|
"muc_size";
|
|
"muc_census";
|
|
-- Module order below follows prod (conference.8x8.vc VirtualHost) so that
|
|
-- same-priority hook execution order matches production.
|
|
-- Handles 'jitsi-add-identity' so components (room_metadata,
|
|
-- audio_translation, ...) can advertise a disco identity on this host.
|
|
"features_identity";
|
|
"conference_duration";
|
|
"filter_iq_rayo"; -- priority 1 on pre-iq/full; listed before filter_iq_jibri (matches prod)
|
|
"filter_iq_jibri";
|
|
"muc_lobby_rooms";
|
|
"jiconop";
|
|
"muc_kick_participant";
|
|
"muc_jigasi_invite";
|
|
-- Loaded here so that the global jitsi-access-ban-check event handler
|
|
-- is registered and mod_auth_token can fire it for token-authenticated
|
|
-- sessions. muc_prosody_jitsi_access_manager_url points at the mock
|
|
-- access manager served by mod_test_observer_http on the same host.
|
|
"muc_auth_ban";
|
|
-- test-only
|
|
"turncredentials_http";
|
|
-- Rewrites MUC JIDs between external subdomain form
|
|
-- (room@conference.sub.localhost) and internal bracket form
|
|
-- ([sub]room@conference.localhost) for all sessions on all hosts.
|
|
"muc_domain_mapper";
|
|
"persistent_lobby";
|
|
"system_chat_message";
|
|
-- test-only
|
|
"muc_password_check";
|
|
"muc_breakout_rooms";
|
|
}
|
|
|
|
-- mod_muc_password_check: verify Bearer tokens with the login ASAP key server.
|
|
enable_password_token_verification = true
|
|
|
|
shard_name = "test-shard"
|
|
region_name = "test-region"
|
|
release_number = "test-release"
|
|
|
|
-- mod_turncredentials_http (HTTP via external_services): port 3479.
|
|
external_services = {
|
|
{ type = "stun", host = "127.0.0.1", port = 3479 };
|
|
{ type = "turn", host = "127.0.0.1", port = 3479, secret = "http-turn-secret" };
|
|
}
|
|
|
|
-- Required by mod_muc_auth_ban: URL of the access manager to call.
|
|
-- Points at the mock endpoint served by mod_test_observer_http.
|
|
muc_prosody_jitsi_access_manager_url = "http://localhost:5280/test-observer/access-manager"
|
|
|
|
-- Required by mod_test_observer_http to locate the shared MUC data.
|
|
muc_mapper_domain_base = "localhost"
|
|
muc_mapper_domain_prefix = "conference"
|
|
|
|
-- Required by mod_conference_duration to find the MUC component.
|
|
-- Required by mod_muc_lobby_rooms.
|
|
-- Required by mod_muc_breakout_rooms.
|
|
main_muc = "conference.localhost"
|
|
lobby_muc = "lobby.conference.localhost"
|
|
breakout_rooms_muc = "breakout.conference.localhost"
|
|
|
|
-- Clients on whitelist.localhost bypass the lobby.
|
|
muc_lobby_whitelist = { "whitelist.localhost" }
|
|
|
|
-- VirtualHost for the focus (jicofo) test helper.
|
|
-- Clients authenticate with username "focus" and password "focussecret".
|
|
-- The account is pre-created in the Docker image (see Dockerfile).
|
|
-- focus@auth.localhost is listed in the global admins table, so it is exempt
|
|
-- from token_verification and can act as room owner on all MUC components.
|
|
VirtualHost "auth.localhost"
|
|
authentication = "internal_hashed"
|
|
-- @xmpp/sasl (v0.13) does not await async SASL responses; the SCRAM-SHA-1
|
|
-- mechanism in sasl-scram-sha-1 1.4+ is async, so the client sends an
|
|
-- empty client-final message which Prosody rejects as malformed-request.
|
|
-- Disable SCRAM and force PLAIN (safe on loopback in the test environment).
|
|
disable_sasl_mechanisms = { "SCRAM-SHA-1", "SCRAM-SHA-1-PLUS", "SCRAM-SHA-256", "SCRAM-SHA-256-PLUS" }
|
|
|
|
-- VirtualHost for Jibri (recorder) and transcriber accounts used by
|
|
-- mod_muc_cleanup_backend_services tests. Accounts on this domain get JIDs whose
|
|
-- bare form starts with 'recorder@recorder.' or 'transcriber@recorder.', satisfying
|
|
-- is_jibri() and is_transcriber() respectively.
|
|
-- recorder.localhost is added to muc_access_whitelist on the MUC component so
|
|
-- these clients bypass token_verification without needing JWT tokens.
|
|
VirtualHost "recorder.localhost"
|
|
authentication = "internal_hashed"
|
|
disable_sasl_mechanisms = { "SCRAM-SHA-1", "SCRAM-SHA-1-PLUS", "SCRAM-SHA-256", "SCRAM-SHA-256-PLUS" }
|
|
|
|
-- VirtualHost for HS256 (shared-secret) token auth tests and mod_presence_identity tests.
|
|
VirtualHost "hs256.localhost"
|
|
authentication = "token"
|
|
app_id = "jitsi"
|
|
app_secret = "testsecret"
|
|
signature_algorithm = "HS256"
|
|
allow_empty_token = false
|
|
modules_enabled = { "presence_identity" }
|
|
|
|
-- Second VirtualHost whose domain is listed in muc_access_whitelist on the
|
|
-- MUC component below. Clients connecting here get JIDs like
|
|
-- <random>@whitelist.localhost and are treated as whitelisted.
|
|
-- VirtualHost with room-claim patterns turned off (token_regex_enabled), used
|
|
-- to test that a token flagged with context.room.regex is refused rather than
|
|
-- matched. mod_token_verification reads token options from the PARENT host of
|
|
-- the MUC component, so the option must live here and not on the component.
|
|
-- muc_mapper_domain_base is set so that verify_room builds the MUC domain of
|
|
-- the paired component below, and not the global conference.localhost.
|
|
-- The host deliberately sits outside .localhost: mod_muc_domain_mapper is
|
|
-- enabled for every host and would read "conference.noregex.localhost" as the
|
|
-- multidomain form of "[noregex]room@conference.localhost", moving the room
|
|
-- off this component entirely.
|
|
VirtualHost "noregex.test"
|
|
authentication = "token"
|
|
app_id = "jitsi"
|
|
asap_key_server = "http://localhost:5280/test-observer/asap-keys"
|
|
signature_algorithm = "RS256"
|
|
allow_empty_token = true
|
|
token_regex_enabled = false
|
|
muc_mapper_domain_base = "noregex.test"
|
|
|
|
-- VirtualHost used by mod_auth_jitsi-anonymous tests.
|
|
VirtualHost "jitsi-anonymous.localhost"
|
|
authentication = "jitsi-anonymous"
|
|
|
|
-- VirtualHost used by mod_auth_jitsi-shared-secret tests.
|
|
VirtualHost "shared-secret.localhost"
|
|
authentication = "jitsi-shared-secret"
|
|
shared_secret = "topsecret"
|
|
shared_secret_prev = "oldsecret"
|
|
-- Disable SCRAM so Prosody only offers PLAIN. SCRAM requires per-user key
|
|
-- derivation which is incompatible with a shared-secret auth provider.
|
|
disable_sasl_mechanisms = { "SCRAM-SHA-1", "SCRAM-SHA-1-PLUS" }
|
|
|
|
VirtualHost "whitelist.localhost"
|
|
authentication = "anonymous"
|
|
|
|
-- VirtualHost for mod_trace tests, with otlp_endpoint configured so the
|
|
-- module is active. Points at the mock OTLP receiver served by
|
|
-- mod_test_observer_http on the main VirtualHost.
|
|
VirtualHost "trace.localhost"
|
|
authentication = "anonymous"
|
|
modules_enabled = { "trace" }
|
|
otlp_endpoint = "http://localhost:5280/test-observer/otlp-traces"
|
|
|
|
-- VirtualHost for mod_trace tests with otlp_endpoint left unset: the module
|
|
-- must log a warning and no-op rather than hook anything.
|
|
VirtualHost "trace-disabled.localhost"
|
|
authentication = "anonymous"
|
|
modules_enabled = { "trace" }
|