configs: Coerce use_dane to boolean to avoid error

Allow overriding DNS resolver
Nice to have on its own, but also useful to point at a DNSSEC-capable resolver.
2026-03-06 13:13:06 +01:00 · 2026-03-03 20:23:03 +01:00 · 2026-03-03 20:21:59 +01:00 · 2026-03-03 17:54:37 +01:00 · 2026-02-27 16:22:02 +01:00 · 2026-02-27 16:21:33 +01:00
7 changed files with 1066 additions and 95 deletions
@@ -1,53 +1,42 @@
-################################################################################
-# Build a dockerfile for Prosody XMPP server
-# Based on ubuntu
-################################################################################
-
-FROM debian:9
+FROM debian:trixie-slim

 MAINTAINER Prosody Developers <developers@prosody.im>

-# Some dependencies in stretch are not suitable for Prosody 0.11.x, so add our repo
-RUN echo "deb http://packages.prosody.im/debian stretch main" > /etc/apt/sources.list.d/prosody.list
-ADD prosody_packages.gpg /etc/apt/trusted.gpg.d/prosody.gpg
+ARG PROSODY_PACKAGE=prosody-13.0
+ARG LUA_PACKAGE=lua5.4
+ARG BUILD_ID=
+
+ADD https://prosody.im/downloads/repos/trixie/prosody.sources /etc/apt/sources.list.d/prosody.sources

 # Install dependencies
 RUN apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-        lsb-base \
-        adduser \
-        libidn11 \
-        libssl1.1 \
-        lua-bitop \
-        lua-dbi-mysql \
-        lua-dbi-postgresql \
-        lua-dbi-sqlite3 \
-        lua-event \
-        lua-expat \
-        lua-filesystem \
-        lua-sec \
-        lua-socket \
-        lua-zlib \
-        lua5.1 \
-        lua5.2 \
-        openssl \
+        tini \
+        ${PROSODY_PACKAGE} \
+        ${LUA_PACKAGE} \
        ca-certificates \
-        ssl-cert \
+        dns-root-data \
+        lua-unbound \
+        lua-sec \
+        lua-readline \
+        lua-dbi-sqlite3 \
+        lua-dbi-postgresql \
+        lua-dbi-mysql \
+        luarocks \
+        lib${LUA_PACKAGE}-dev \
+        libjs-bootstrap4 libjs-jquery \
+    && update-alternatives --set lua-interpreter /usr/bin/${LUA_PACKAGE} \
    && rm -rf /var/lib/apt/lists/*

-# Install and configure prosody
-COPY ./prosody.deb /tmp/prosody.deb
-RUN dpkg -i /tmp/prosody.deb \
-    && sed -i '1s/^/daemonize = false;\n/' /etc/prosody/prosody.cfg.lua \
-    && perl -i -pe 'BEGIN{undef $/;} s/^log = {.*?^}$/log = {\n    {levels = {min = "info"}, to = "console"};\n}/smg' /etc/prosody/prosody.cfg.lua
-
-RUN mkdir -p /var/run/prosody && chown prosody:prosody /var/run/prosody
+RUN mkdir -p /etc/prosody/conf.d /var/run/prosody \
+ && chown prosody:prosody /etc/prosody/conf.d /var/run/prosody

 COPY ./entrypoint.sh /entrypoint.sh
 RUN chmod 755 /entrypoint.sh
-ENTRYPOINT ["/entrypoint.sh"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/entrypoint.sh"]
+
+COPY ./configs/${PROSODY_PACKAGE}.cfg.lua /etc/prosody/prosody.cfg.lua

 EXPOSE 80 443 5222 5269 5347 5280 5281
-USER prosody
 ENV __FLUSH_LOG yes
-CMD ["prosody"]
+CMD ["prosody", "-F"]
@@ -2,21 +2,16 @@

 This is the Prosody Docker image building repository. It is used by our build server to build and publish Docker images for stable releases and nightly builds.

-**Note:** Using this Dockerfile outside of our build server is not a supported use-case. There are many
-alternative Dockerfiles for Prosody available which can be used for this:
-
-  - [OpusVL/prosody-docker](https://github.com/OpusVL/prosody-docker/)
-  - [unclev/prosody-docker-extended](https://github.com/unclev/prosody-docker-extended)
-
 ## Published images

-For images please see here: [Prosody on Docker](https://hub.docker.com/r/prosody/prosody/).
+- **[Docker Hub image prosodyim/prosody](https://hub.docker.com/r/prosodyim/prosody): official images, up-to-date, automated builds.**
+- ~~[Docker Hub image prosody/prosody](https://hub.docker.com/r/prosody/prosody)~~: official images, outdated, manual builds.

 ## Running

-It works by copying in a recently built `deb` file and running the install on the system.
+It works by enabling the [prosody package repository](https://prosody.im/download/package_repository) and installing the selected Prosody package from there based on the `PROSODY_PACKAGE` build argument.

-Docker images are built off an __Debian 9 (stretch)__ base.
+Docker images are built off an __Debian 13 (trixie)__ base.

 ```bash
 docker run -d --name prosody -p 5222:5222 prosody/prosody
@@ -33,6 +28,7 @@ Any error from this script is ignored. Prosody will not check the user exists be
 The image exposes the following ports to the docker host:

 * __80__: HTTP port
+* __443__: HTTPS port
 * __5222__: c2s port
 * __5269__: s2s port
 * __5347__: XMPP component port
@@ -47,41 +43,77 @@ Volumes can be mounted at the following locations for adding in files:

 * __/etc/prosody__:
  * Prosody configuration file(s)
+* __/etc/prosody/certs__:
  * SSL certificates
-* __/var/log/prosody__:
-  * Log files for prosody - if not mounted these will be stored on the system
-  * Note: This location can be changed in the configuration, update to match
-  * Also note: The log directory on the host (/logs/prosody in the example below) must be writeable by the prosody user
-* __/usr/lib/prosody-modules__ (suggested):
+* __/etc/prosody/modules__:
  * Location for including additional modules
-  * Note: This needs to be included in your config file, see http://prosody.im/doc/installing_modules#paths
+* __/var/lib/prosody__:
+  * Location of data
+
+### Environment Variables
+
+* `DOMAIN`, `LOCAL`, `PASSWORD` - These three are used by `entrypoint.sh` to create an initial account `$LOCAL@$DOMAIN` with `$PASSWORD` as password.
+* `PROSODY_PLUGIN_PATHS` - Comma-separated list of additional paths to search for plugins. Defaults to `/etc/prosody/modules`.
+* `PROSODY_ADMINS` - Comma-separated list of user addresses treated as admins.
+* `PROSODY_ENABLE_MODULES` - Comma-separated list of additional plugins to load.
+* `PROSODY_DISABLE_MODULES` - Comma-separated list of modules to disable, e.g. for auto-enabled modules.
+* `PROSODY_TURN_HOST` - Hostname of TURN server
+* `PROSODY_TURN_PORT` - Port number of TURN server
+* `PROSODY_TURN_SECRET` - Shared secret for TURN
+* `PROSODY_TURN_TLS_PORT` -  Port number for STUN over TLS
+* `PROSODY_RETENTION_DAYS` - How many days worth of message archives and shared file to keep.
+* `PROSODY_DNS_RESOLVERS` - Comma-separated list of DNS resolvers to use instead of what `/etc/resolv.conf` points to.
+* `PROSODY_USE_DANE` - Whether to enable [DANE](https://prosody.im/doc/dane) (requires [DNSSEC](https://prosody.im/doc/dnssec) aware resolvers).
+* `PROSODY_S2S_SECURE_AUTH` - Whether to require that remote servers present valid certificates. Enabled by default.
+* `PROSODY_C2S_RATE_LIMIT` - Rate limit for client-to-server connections. Defaults to `10kb/s`.
+* `PROSODY_S2S_RATE_LIMIT` - Rate limit for server-to-server connections. Defaults to `30kb/s`.
+* `PROSODY_STORAGE` - [Storage driver](https://prosody.im/doc/storage) to use. Defaults to `internal`.
+* `PROSODY_SQL_DRIVER` - One of `SQLite3`, `PostgreSQL` or `MySQL`. Selects SQL backend when `PROSODY_STORAGE` is set to `sql`.
+* `PROSODY_SQL_DB` - Name of SQL database to use.
+* `PROSODY_SQL_HOST` - Hostname of SQL database to connect to (PostgreSQL and MySQL only).
+* `PROSODY_SQL_USERNAME`, `PROSODY_SQL_PASSWORD` - Credentials for connecting to SQL database.
+* `PROSODY_ARCHIVE_EXPIRY_DAYS` - When set, overrides `PROSODY_RETENTION_DAYS` for message archives.
+* `PROSODY_LOGLEVEL` - Log level, one of `debug`, `info`, `warn`, `error`. Defaults to `info`.
+* `PROSODY_STATISTICS` - [Statistics provider](https://prosody.im/doc/statistics) to use, e.g. `internal`. Default disabled.
+* `PROSODY_STATISTICS_INTERVAL` - Statistics collection interval. A number or the string `manual` for OpenMetrics-triggered collection. Defaults to `60`.
+* `PROSODY_CERTIFICATES` - Path to TLS certificates and private keys, relative to the config file. Defaults to `certs`, i.e.
+* `PROSODY_VIRTUAL_HOSTS` - Comma-separated list of domain names to initialize as hosts that provide user accounts. Defaults to the hostname of the container. `/etc/prosody/certs`.
+* `PROSODY_NETWORK_HOSTNAME` - Public domain name for use with e.g. HTTP. Defaults to the first entry in `PROSODY_VIRTUAL_HOSTS`.
+* `PROSODY_COMPONENTS` - Comma-separated list of _internal_ components in the form `name.example.com:type` where `type` can be e.g. `muc`, `http_file_share`.
+* `PROSODY_MUC_MODULES` - Comma-separated list of additional modules to enable on a MUC component.
+* `PROSODY_UPLOAD_EXPIRY_DAYS` - When set, overrides `PROSODY_RETENTION_DAYS` for uploaded files.
+* `PROSODY_UPLOAD_LIMIT_MB` - Size limit in MiB for individual uploaded files.
+* `PROSODY_UPLOAD_STORAGE_GB` - Total amount of storage available for file uploads.
+* `PROSODY_EXTERNAL_COMPONENTS` - Comma-separated list of _external_ components, in the form of `name.example.com:secret`.
+* `PROSODY_COMPONENT_SECRET` - Component shared secret if not provided as part of `PROSODY_EXTERNAL_COMPONENTS`.
+* `PROSODY_EXTRA_CONFIG` - Path to additional configuration file. Can contain wildcards. Defaults to `/etc/prosody/conf.d/*.cfg.lua`.
+

 ### Example

-```
-docker run -d \
+```bash
+docker run -it \
   -p 5222:5222 \
   -p 5269:5269 \
-   -p localhost:5347:5347 \
   -e LOCAL=romeo \
   -e DOMAIN=shakespeare.lit \
   -e PASSWORD=juliet4ever \
   -v /data/prosody/configuration:/etc/prosody \
   -v /logs/prosody:/var/log/prosody \
   -v /data/prosody/modules:/usr/lib/prosody-modules \
-   prosody/prosody:0.9
+   prosody/prosody:0.12
 ```

 ## Building

-Use the `build-docker.sh` script as follows:
-
 ```bash
-./build-docker.sh /path/to/built-image.deb version_tag [, ...version_tag2, ...]
+docker build --build-arg PROSODY_PACKAGE=prosody-0.12 -t prosody/prosody:0.12 .
 ```

-Where argument 1 is a pointer to the build `deb` file that you'd like to make an image from and 'version_tag' is the tag you'd like to push to the Docker registry with.
+## Alternative Dockerfiles

-You can specify multiple tags by adding additional tag names to the end of the command. This is useful where a for example release 0.10.4 is made which also consitutes 'latest', '0.10-nightly', '0.10.4', '0.10' images.
+There are many alternative Dockerfiles for Prosody available if this one
+does not suit your needs:

-After running the script will clean up any images generated (but not the base images - for efficiency purposes).
+  - [OpusVL/prosody-docker](https://github.com/OpusVL/prosody-docker/)
+  - [unclev/prosody-docker-extended](https://github.com/unclev/prosody-docker-extended)
@@ -1,28 +0,0 @@
-#!/bin/bash
-
-if [[ -z "$1" ]]; then
-    echo "Usage: ./build-docker.sh def_file_name version_number"
-    exit 1
-fi
-
-if [[ -z "$2" ]]; then
-    echo "Usage: ./build-docker.sh def_file_name version_number"
-    exit 1
-fi
-
-echo "Starting build..."
-cp "$1" ./prosody.deb
-docker build -t prosody/prosody:"$2" .
-for i in "${@:3}"; do
-  echo "Also building tag $i"
-  docker build -t prosody/prosody:"$i" .
-done
-docker push prosody/prosody
-
-echo "Cleaning up..."
-docker rmi prosody/prosody:"$2"
-for i in "${@:3}"; do
-  echo "Also cleaning tag $i"  
-  docker rmi prosody/prosody:"$i"
-done
-rm ./prosody.deb
@@ -0,0 +1,323 @@
+-- Prosody Configuration File
+--
+-- Information on configuring Prosody can be found on our
+-- website at https://prosody.im/doc/configure
+--
+-- Tip: You can check that the syntax of this file is correct
+-- when you have finished by running this command:
+--     prosodyctl check config
+-- If there are any errors, it will let you know what and where
+-- they are, otherwise it will keep quiet.
+--
+-- The only thing left to do is rename this file to remove the .dist ending, and fill in the
+-- blanks. Good luck, and happy Jabbering!
+
+local _unpack = table.unpack or _G.unpack;
+local function _split(s, sep)
+	if not s then return nil; end
+	sep = sep or ",";
+	local parts = {};
+	for part in s:gmatch("[^"..sep.."]+") do
+		parts[#parts+1] = part;
+	end
+	return parts;
+end
+
+
+---------- Server-wide settings ----------
+-- Settings in this section apply to the whole server and are the default settings
+-- for any virtual hosts
+
+plugin_paths = _split(ENV_PROSODY_PLUGIN_PATHS or "/etc/prosody/modules")
+
+-- This is a (by default, empty) list of accounts that are admins
+-- for the server. Note that you must create the accounts separately
+-- (see https://prosody.im/doc/creating_accounts for info)
+-- Example: admins = { "user1@example.com", "user2@example.net" }
+admins = _split(ENV_PROSODY_ADMINS)
+
+-- This option allows you to specify additional locations where Prosody
+-- will search first for modules. For additional modules you can install, see
+-- the community module repository at https://modules.prosody.im/
+--plugin_paths = {}
+
+-- This is the list of modules Prosody will load on startup.
+-- Documentation for bundled modules can be found at: https://prosody.im/doc/modules
+local default_modules = {
+
+	-- Generally required
+		"disco"; -- Service discovery
+		"roster"; -- Allow users to have a roster. Recommended ;)
+		"saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
+		"tls"; -- Add support for secure TLS on c2s/s2s connections
+
+	-- Not essential, but recommended
+		"blocklist"; -- Allow users to block communications with other users
+		"bookmarks"; -- Synchronise the list of open rooms between clients
+		"carbons"; -- Keep multiple online clients in sync
+		"dialback"; -- Support for verifying remote servers using DNS
+		"limits"; -- Enable bandwidth limiting for XMPP connections
+		"pep"; -- Allow users to store public and private data in their account
+		"private"; -- Legacy account storage mechanism (XEP-0049)
+		"smacks"; -- Stream management and resumption (XEP-0198)
+		"vcard4"; -- User profiles (stored in PEP)
+		"vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard
+
+	-- Nice to have
+		"csi_simple"; -- Simple but effective traffic optimizations for mobile devices
+		"invites"; -- Create and manage invites
+		"invites_adhoc"; -- Allow admins/users to create invitations via their client
+		"invites_register"; -- Allows invited users to create accounts
+		"ping"; -- Replies to XMPP pings with pongs
+		"register"; -- Allow users to register on this server using a client and change passwords
+		"time"; -- Let others know the time here on this server
+		"uptime"; -- Report how long server has been running
+		"version"; -- Replies to server version requests
+		--"mam"; -- Store recent messages to allow multi-device synchronization
+		--"turn_external"; -- Provide external STUN/TURN service for e.g. audio/video calls
+
+	-- Admin interfaces
+		"admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands
+		"admin_shell"; -- Allow secure administration via 'prosodyctl shell'
+
+	-- HTTP modules
+		--"bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
+		--"http_openmetrics"; -- for exposing metrics to stats collectors
+		--"websocket"; -- XMPP over WebSockets
+
+	-- Other specific functionality
+		--"announce"; -- Send announcement to all online users
+		--"groups"; -- Shared roster support
+		--"legacyauth"; -- Legacy authentication. Only used by some old clients and bots.
+		--"mimicking"; -- Prevent address spoofing
+		--"motd"; -- Send a message to users when they log in
+		--"proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use
+		--"s2s_bidi"; -- Bi-directional server-to-server (XEP-0288)
+		--"server_contact_info"; -- Publish contact information for this service
+		--"tombstones"; -- Prevent registration of deleted accounts
+		--"watchregistrations"; -- Alert admins of registrations
+		--"welcome"; -- Welcome users who register accounts
+}
+
+for _, module_name in ipairs(_split(ENV_PROSODY_ENABLE_MODULES) or {}) do
+	default_modules[#default_modules+1] = module_name;
+end
+
+if ENV_PROSODY_TURN_SECRET then
+	default_modules[#default_modules+1] = "turn_external";
+	turn_external_secret = ENV_PROSODY_TURN_SECRET
+	turn_external_host = ENV_PROSODY_TURN_HOST
+	turn_external_port = ENV_PROSODY_TURN_PORT
+	turn_external_tls_port = ENV_PROSODY_TURN_TLS_PORT
+end
+
+if ENV_PROSODY_RETENTION_DAYS or ENV_PROSODY_ARCHIVE_EXPIRY_DAYS then
+	default_modules[#default_modules+1] = "mam";
+end
+
+modules_enabled = default_modules
+
+local env_disabled_modules = {};
+for _, module_name in ipairs(_split(ENV_PROSODY_DISABLE_MODULES) or {}) do
+	env_disabled_modules[#env_disabled_modules+1] = module_name;
+end
+
+modules_disabled = env_disabled_modules
+
+
+-- Server-to-server authentication
+-- Require valid certificates for server-to-server connections?
+-- If false, other methods such as dialback (DNS) may be used instead.
+
+s2s_secure_auth = ENV_PROSODY_S2S_SECURE_AUTH ~= "0"
+
+-- Some servers have invalid or self-signed certificates. You can list
+-- remote domains here that will not be required to authenticate using
+-- certificates. They will be authenticated using other methods instead,
+-- even when s2s_secure_auth is enabled.
+
+--s2s_insecure_domains = { "insecure.example" }
+
+-- Even if you disable s2s_secure_auth, you can still require valid
+-- certificates for some domains by specifying a list here.
+
+--s2s_secure_domains = { "jabber.org" }
+
+
+-- Rate limits
+-- Enable rate limits for incoming client and server connections. These help
+-- protect from excessive resource consumption and denial-of-service attacks.
+
+limits = {
+	c2s = {
+		rate = ENV_PROSODY_C2S_RATE_LIMIT or "10kb/s";
+	};
+	s2sin = {
+		rate = ENV_PROSODY_S2S_RATE_LIMIT or "30kb/s";
+	};
+}
+
+-- Authentication
+-- Select the authentication backend to use. The 'internal' providers
+-- use Prosody's configured data storage to store the authentication data.
+-- For more information see https://prosody.im/doc/authentication
+
+authentication = "internal_hashed"
+
+-- Many authentication providers, including the default one, allow you to
+-- create user accounts via Prosody's admin interfaces. For details, see the
+-- documentation at https://prosody.im/doc/creating_accounts
+
+
+-- Storage
+-- Select the storage backend to use. By default Prosody uses flat files
+-- in its configured data directory, but it also supports more backends
+-- through modules. An "sql" backend is included by default, but requires
+-- additional dependencies. See https://prosody.im/doc/storage for more info.
+
+storage = ENV_PROSODY_SQL_DRIVER and "sql" or ENV_PROSODY_STORAGE or "internal"
+
+-- For the "sql" backend, you can uncomment *one* of the below to configure:
+
+if ENV_PROSODY_SQL_DRIVER then
+	sql = {
+		driver = ENV_PROSODY_SQL_DRIVER;
+		database = ENV_PROSODY_SQL_DB;
+		username = ENV_PROSODY_SQL_USERNAME;
+		password = ENV_PROSODY_SQL_PASSWORD;
+		host = ENV_PROSODY_SQL_HOST;
+	}
+end
+--sql = { driver = "SQLite3", database = "prosody.sqlite" } -- Default. 'database' is the filename.
+--sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
+--sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
+
+
+-- Archiving configuration
+-- If mod_mam is enabled, Prosody will store a copy of every message. This
+-- is used to synchronize conversations between multiple clients, even if
+-- they are offline. This setting controls how long Prosody will keep
+-- messages in the archive before removing them.
+
+archive_expires_after = (ENV_PROSODY_ARCHIVE_EXPIRY_DAYS or ENV_PROSODY_RETENTION_DAYS or "7").."d" -- Remove archived messages after 1 week
+
+-- You can also configure messages to be stored in-memory only. For more
+-- archiving options, see https://prosody.im/doc/modules/mod_mam
+
+
+-- Audio/video call relay (STUN/TURN)
+-- To ensure clients connected to the server can establish connections for
+-- low-latency media streaming (such as audio and video calls), it is
+-- recommended to run a STUN/TURN server for clients to use. If you do this,
+-- specify the details here so clients can discover it.
+-- Find more information at https://prosody.im/doc/turn
+
+-- Specify the address of the TURN service (you may use the same domain as XMPP)
+--turn_external_host = "turn.example.com"
+
+-- This secret must be set to the same value in both Prosody and the TURN server
+--turn_external_secret = "your-secret-turn-access-token"
+
+
+-- Logging configuration
+-- For advanced logging see https://prosody.im/doc/logging
+log = {
+	[ENV_PROSODY_LOGLEVEL or "info"] = "*console";
+}
+
+
+-- For more info see https://prosody.im/doc/statistics
+statistics = ENV_PROSODY_STATISTICS
+statistics_interval = tonumber(ENV_PROSODY_STATISTICS_INTERVAL) or ENV_PROSODY_STATISTICS_INTERVAL
+
+
+-- Certificates
+-- Every virtual host and component needs a certificate so that clients and
+-- servers can securely verify its identity. Prosody will automatically load
+-- certificates/keys from the directory specified here.
+-- For more information, including how to use 'prosodyctl' to auto-import certificates
+-- (from e.g. Let's Encrypt) see https://prosody.im/doc/certificates
+
+-- Location of directory to find certificates in (relative to main config file):
+certificates = ENV_PROSODY_CERTIFICATES or "certs"
+
+----------- Virtual hosts -----------
+-- You need to add a VirtualHost entry for each domain you wish Prosody to serve.
+-- Settings under each VirtualHost entry apply *only* to that host.
+
+local pp = require "util.pposix";
+local vhosts = _split(ENV_PROSODY_VIRTUAL_HOSTS) or {pp.uname().nodename};
+
+local network_hostname = ENV_PROSODY_NETWORK_HOSTNAME or #vhosts == 1 and vhosts[1];
+if network_hostname then
+	http_host = network_hostname
+	proxy65_address = network_hostname
+	if ENV_PROSODY_TURN_SECRET and not ENV_PROSODY_TURN_HOST then
+		turn_external_host = network_hostname
+	end
+end
+
+for _, vhost in ipairs(vhosts) do
+	VirtualHost (vhost)
+end
+
+------ Components ------
+-- You can specify components to add hosts that provide special services,
+-- like multi-user conferences, and transports.
+-- For more information on components, see https://prosody.im/doc/components
+
+for _, component_def in ipairs(_split(ENV_PROSODY_COMPONENTS) or {}) do
+	local c_name, c_type = _unpack(_split(component_def, ":"));
+	Component (c_name) (c_type)
+
+	if c_type == "muc" then
+		modules_enabled = _split(ENV_PROSODY_MUC_MODULES)
+	elseif c_type == "http_file_share" then
+		http_file_share_expire_after = 60 * 60 * 24 * tonumber(ENV_PROSODY_UPLOAD_EXPIRY_DAYS or ENV_PROSODY_RETENTION_DAYS or "7")
+		if ENV_PROSODY_UPLOAD_LIMIT_MB then
+			http_file_share_size_limit = (1024 * 1024 * tonumber(ENV_PROSODY_UPLOAD_LIMIT_MB)) + 16
+		end
+		if ENV_PROSODY_UPLOAD_STORAGE_GB then
+			http_file_share_global_quota = 1024 * 1024 * 1024 * tonumber(ENV_PROSODY_UPLOAD_STORAGE_GB)
+		end
+		http_paths = {
+			file_share = "/share";
+		}
+	end
+end
+
+for _, component_def in ipairs(_split(ENV_PROSODY_EXTERNAL_COMPONENTS) or {}) do
+	local c_name, c_secret = _unpack(_split(component_def, ":"));
+	Component (c_name)
+		component_secret = c_secret or ENV_PROSODY_COMPONENT_SECRET
+end
+
+---Set up a MUC (multi-user chat) room server on conference.example.com:
+--Component "conference.example.com" "muc"
+--- Store MUC messages in an archive and allow users to access it
+--modules_enabled = { "muc_mam" }
+
+---Set up a file sharing component
+--Component "share.example.com" "http_file_share"
+
+---Set up an external component (default component port is 5347)
+--
+-- External components allow adding various services, such as gateways/
+-- bridges to non-XMPP networks and services. For more info
+-- see: https://prosody.im/doc/components#adding_an_external_component
+--
+--Component "gateway.example.com"
+--	component_secret = "password"
+
+
+---------- End of the Prosody Configuration file ----------
+-- You usually **DO NOT** want to add settings here at the end, as they would
+-- only apply to the last defined VirtualHost or Component.
+--
+-- Settings for the global section should go higher up, before the first
+-- VirtualHost or Component line, while settings intended for specific hosts
+-- should go under the corresponding VirtualHost or Component line.
+--
+-- For more information see https://prosody.im/doc/configure
+
+Include (ENV_PROSODY_EXTRA_CONFIG or "/etc/prosody/conf.d/*.cfg.lua")
@@ -0,0 +1,323 @@
+-- Prosody Configuration File
+--
+-- Information on configuring Prosody can be found on our
+-- website at https://prosody.im/doc/configure
+--
+-- Tip: You can check that the syntax of this file is correct
+-- when you have finished by running this command:
+--     prosodyctl check config
+-- If there are any errors, it will let you know what and where
+-- they are, otherwise it will keep quiet.
+--
+-- The only thing left to do is rename this file to remove the .dist ending, and fill in the
+-- blanks. Good luck, and happy Jabbering!
+
+local _unpack = Lua.table.unpack;
+local function _split(s, sep)
+	if not s then return nil; end
+	sep = sep or ",";
+	local parts = {};
+	for part in s:gmatch("[^"..sep.."]+") do
+		parts[#parts+1] = part;
+	end
+	return parts;
+end
+
+
+---------- Server-wide settings ----------
+-- Settings in this section apply to the whole server and are the default settings
+-- for any virtual hosts
+
+plugin_paths = _split(ENV_PROSODY_PLUGIN_PATHS or "/etc/prosody/modules")
+
+-- This is a (by default, empty) list of accounts that are admins
+-- for the server. Note that you must create the accounts separately
+-- (see https://prosody.im/doc/creating_accounts for info)
+-- Example: admins = { "user1@example.com", "user2@example.net" }
+admins = _split(ENV_PROSODY_ADMINS)
+
+-- This option allows you to specify additional locations where Prosody
+-- will search first for modules. For additional modules you can install, see
+-- the community module repository at https://modules.prosody.im/
+--plugin_paths = {}
+
+-- This is the list of modules Prosody will load on startup.
+-- Documentation for bundled modules can be found at: https://prosody.im/doc/modules
+modules_enabled = {
+
+	-- Generally required
+		"disco"; -- Service discovery
+		"roster"; -- Allow users to have a roster. Recommended ;)
+		"saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
+		"tls"; -- Add support for secure TLS on c2s/s2s connections
+
+	-- Not essential, but recommended
+		"blocklist"; -- Allow users to block communications with other users
+		"bookmarks"; -- Synchronise the list of open rooms between clients
+		"carbons"; -- Keep multiple online clients in sync
+		"dialback"; -- Support for verifying remote servers using DNS
+		"limits"; -- Enable bandwidth limiting for XMPP connections
+		"pep"; -- Allow users to store public and private data in their account
+		"private"; -- Legacy account storage mechanism (XEP-0049)
+		"smacks"; -- Stream management and resumption (XEP-0198)
+		"vcard4"; -- User profiles (stored in PEP)
+		"vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard
+
+	-- Nice to have
+		"csi_simple"; -- Simple but effective traffic optimizations for mobile devices
+		"invites"; -- Create and manage invites
+		"invites_adhoc"; -- Allow admins/users to create invitations via their client
+		"invites_register"; -- Allows invited users to create accounts
+		"ping"; -- Replies to XMPP pings with pongs
+		"register"; -- Allow users to register on this server using a client and change passwords
+		"time"; -- Let others know the time here on this server
+		"uptime"; -- Report how long server has been running
+		"version"; -- Replies to server version requests
+		--"mam"; -- Store recent messages to allow multi-device synchronization
+		--"turn_external"; -- Provide external STUN/TURN service for e.g. audio/video calls
+
+	-- Admin interfaces
+		"admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands
+		"admin_shell"; -- Allow secure administration via 'prosodyctl shell'
+
+	-- HTTP modules
+		--"bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
+		--"http_openmetrics"; -- for exposing metrics to stats collectors
+		--"websocket"; -- XMPP over WebSockets
+
+	-- Other specific functionality
+		--"announce"; -- Send announcement to all online users
+		--"groups"; -- Shared roster support
+		--"legacyauth"; -- Legacy authentication. Only used by some old clients and bots.
+		--"mimicking"; -- Prevent address spoofing
+		--"motd"; -- Send a message to users when they log in
+		--"proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use
+		--"s2s_bidi"; -- Bi-directional server-to-server (XEP-0288)
+		--"server_contact_info"; -- Publish contact information for this service
+		--"tombstones"; -- Prevent registration of deleted accounts
+		--"watchregistrations"; -- Alert admins of registrations
+		--"welcome"; -- Welcome users who register accounts
+}
+
+if ENV_PROSODY_ENABLE_MODULES then
+	modules_enabled:append(_split(ENV_PROSODY_ENABLE_MODULES))
+end
+
+if ENV_PROSODY_TURN_SECRET then
+	modules_enabled:append{ "turn_external" };
+	turn_external_secret = ENV_PROSODY_TURN_SECRET
+	turn_external_host = ENV_PROSODY_TURN_HOST
+	turn_external_port = ENV_PROSODY_TURN_PORT
+	turn_external_tls_port = ENV_PROSODY_TURN_TLS_PORT
+end
+
+if ENV_PROSODY_RETENTION_DAYS or ENV_PROSODY_ARCHIVE_EXPIRY_DAYS then
+	modules_enabled:append{ "mam" }
+end
+
+modules_disabled = _split(ENV_PROSODY_DISABLE_MODULES)
+
+
+-- Server-to-server authentication
+-- Require valid certificates for server-to-server connections?
+-- If false, other methods such as dialback (DNS) may be used instead.
+
+s2s_secure_auth = ENV_PROSODY_S2S_SECURE_AUTH ~= "0"
+
+use_dane = ENV_PROSODY_USE_DANE and true or false
+unbound = {
+	-- on Debian this file is included in the package 'dns-root-data'
+	trustfile = ENV_PROSODY_USE_DANE and "/usr/share/dns/root.ds";
+	forward = _split(ENV_PROSODY_DNS_RESOLVERS);
+}
+
+-- Some servers have invalid or self-signed certificates. You can list
+-- remote domains here that will not be required to authenticate using
+-- certificates. They will be authenticated using other methods instead,
+-- even when s2s_secure_auth is enabled.
+
+--s2s_insecure_domains = { "insecure.example" }
+
+-- Even if you disable s2s_secure_auth, you can still require valid
+-- certificates for some domains by specifying a list here.
+
+--s2s_secure_domains = { "jabber.org" }
+
+
+-- Rate limits
+-- Enable rate limits for incoming client and server connections. These help
+-- protect from excessive resource consumption and denial-of-service attacks.
+
+limits = {
+	c2s = {
+		rate = ENV_PROSODY_C2S_RATE_LIMIT or "10kb/s";
+	};
+	s2sin = {
+		rate = ENV_PROSODY_S2S_RATE_LIMIT or "30kb/s";
+	};
+}
+
+-- Authentication
+-- Select the authentication backend to use. The 'internal' providers
+-- use Prosody's configured data storage to store the authentication data.
+-- For more information see https://prosody.im/doc/authentication
+
+authentication = "internal_hashed"
+
+-- Many authentication providers, including the default one, allow you to
+-- create user accounts via Prosody's admin interfaces. For details, see the
+-- documentation at https://prosody.im/doc/creating_accounts
+
+
+-- Storage
+-- Select the storage backend to use. By default Prosody uses flat files
+-- in its configured data directory, but it also supports more backends
+-- through modules. An "sql" backend is included by default, but requires
+-- additional dependencies. See https://prosody.im/doc/storage for more info.
+
+storage = ENV_PROSODY_SQL_DRIVER and "sql" or ENV_PROSODY_STORAGE or "internal"
+
+-- For the "sql" backend, you can uncomment *one* of the below to configure:
+
+if ENV_PROSODY_SQL_DRIVER then
+	sql = {
+		driver = ENV_PROSODY_SQL_DRIVER;
+		database = ENV_PROSODY_SQL_DB;
+		username = ENV_PROSODY_SQL_USERNAME;
+		password = ENV_PROSODY_SQL_PASSWORD;
+		host = ENV_PROSODY_SQL_HOST;
+	}
+end
+--sql = { driver = "SQLite3", database = "prosody.sqlite" } -- Default. 'database' is the filename.
+--sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
+--sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
+
+
+-- Archiving configuration
+-- If mod_mam is enabled, Prosody will store a copy of every message. This
+-- is used to synchronize conversations between multiple clients, even if
+-- they are offline. This setting controls how long Prosody will keep
+-- messages in the archive before removing them.
+
+archive_expires_after = (ENV_PROSODY_ARCHIVE_EXPIRY_DAYS or ENV_PROSODY_RETENTION_DAYS or "7").."d" -- Remove archived messages after 1 week
+
+-- You can also configure messages to be stored in-memory only. For more
+-- archiving options, see https://prosody.im/doc/modules/mod_mam
+
+
+-- Audio/video call relay (STUN/TURN)
+-- To ensure clients connected to the server can establish connections for
+-- low-latency media streaming (such as audio and video calls), it is
+-- recommended to run a STUN/TURN server for clients to use. If you do this,
+-- specify the details here so clients can discover it.
+-- Find more information at https://prosody.im/doc/turn
+
+-- Specify the address of the TURN service (you may use the same domain as XMPP)
+--turn_external_host = "turn.example.com"
+
+-- This secret must be set to the same value in both Prosody and the TURN server
+--turn_external_secret = "your-secret-turn-access-token"
+
+
+-- Logging configuration
+-- For advanced logging see https://prosody.im/doc/logging
+log = {
+	[ENV_PROSODY_LOGLEVEL or "info"] = "*console";
+}
+
+
+-- For more info see https://prosody.im/doc/statistics
+statistics = ENV_PROSODY_STATISTICS
+statistics_interval = Lua.tonumber(ENV_PROSODY_STATISTICS_INTERVAL) or ENV_PROSODY_STATISTICS_INTERVAL
+
+
+-- Certificates
+-- Every virtual host and component needs a certificate so that clients and
+-- servers can securely verify its identity. Prosody will automatically load
+-- certificates/keys from the directory specified here.
+-- For more information, including how to use 'prosodyctl' to auto-import certificates
+-- (from e.g. Let's Encrypt) see https://prosody.im/doc/certificates
+
+-- Location of directory to find certificates in (relative to main config file):
+certificates = ENV_PROSODY_CERTIFICATES or "certs"
+
+----------- Virtual hosts -----------
+-- You need to add a VirtualHost entry for each domain you wish Prosody to serve.
+-- Settings under each VirtualHost entry apply *only* to that host.
+
+local pp = Lua.require "prosody.util.pposix";
+local vhosts = _split(ENV_PROSODY_VIRTUAL_HOSTS) or {pp.uname().nodename};
+
+local network_hostname = ENV_PROSODY_NETWORK_HOSTNAME or #vhosts == 1 and vhosts[1];
+if network_hostname then
+	http_host = network_hostname
+	proxy65_address = network_hostname
+	if ENV_PROSODY_TURN_SECRET and not ENV_PROSODY_TURN_HOST then
+		turn_external_host = network_hostname
+	end
+end
+
+for _, vhost in Lua.ipairs(vhosts) do
+	VirtualHost (vhost)
+end
+
+------ Components ------
+-- You can specify components to add hosts that provide special services,
+-- like multi-user conferences, and transports.
+-- For more information on components, see https://prosody.im/doc/components
+
+for _, component_def in Lua.ipairs(_split(ENV_PROSODY_COMPONENTS) or {}) do
+	local c_name, c_type = _unpack(_split(component_def, ":"));
+	Component (c_name) (c_type)
+
+	if c_type == "muc" then
+		modules_enabled = _split(ENV_PROSODY_MUC_MODULES)
+	elseif c_type == "http_file_share" then
+		http_file_share_expire_after = 60 * 60 * 24 * tonumber(ENV_PROSODY_UPLOAD_EXPIRY_DAYS or ENV_PROSODY_RETENTION_DAYS or "7")
+		if ENV_PROSODY_UPLOAD_LIMIT_MB then
+			http_file_share_size_limit = (1024 * 1024 * tonumber(ENV_PROSODY_UPLOAD_LIMIT_MB)) + 16
+		end
+		if ENV_PROSODY_UPLOAD_STORAGE_GB then
+			http_file_share_global_quota = 1024 * 1024 * 1024 * tonumber(ENV_PROSODY_UPLOAD_STORAGE_GB)
+		end
+		http_paths = {
+			file_share = "/share";
+		}
+	end
+end
+
+for _, component_def in Lua.ipairs(_split(ENV_PROSODY_EXTERNAL_COMPONENTS) or {}) do
+	local c_name, c_secret = _unpack(_split(component_def, ":"));
+	Component (c_name)
+		component_secret = c_secret or ENV_PROSODY_COMPONENT_SECRET
+end
+
+---Set up a MUC (multi-user chat) room server on conference.example.com:
+--Component "conference.example.com" "muc"
+--- Store MUC messages in an archive and allow users to access it
+--modules_enabled = { "muc_mam" }
+
+---Set up a file sharing component
+--Component "share.example.com" "http_file_share"
+
+---Set up an external component (default component port is 5347)
+--
+-- External components allow adding various services, such as gateways/
+-- bridges to non-XMPP networks and services. For more info
+-- see: https://prosody.im/doc/components#adding_an_external_component
+--
+--Component "gateway.example.com"
+--	component_secret = "password"
+
+
+---------- End of the Prosody Configuration file ----------
+-- You usually **DO NOT** want to add settings here at the end, as they would
+-- only apply to the last defined VirtualHost or Component.
+--
+-- Settings for the global section should go higher up, before the first
+-- VirtualHost or Component line, while settings intended for specific hosts
+-- should go under the corresponding VirtualHost or Component line.
+--
+-- For more information see https://prosody.im/doc/configure
+
+Include (ENV_PROSODY_EXTRA_CONFIG or "/etc/prosody/conf.d/*.cfg.lua")
@@ -0,0 +1,323 @@
+-- Prosody Configuration File
+--
+-- Information on configuring Prosody can be found on our
+-- website at https://prosody.im/doc/configure
+--
+-- Tip: You can check that the syntax of this file is correct
+-- when you have finished by running this command:
+--     prosodyctl check config
+-- If there are any errors, it will let you know what and where
+-- they are, otherwise it will keep quiet.
+--
+-- The only thing left to do is rename this file to remove the .dist ending, and fill in the
+-- blanks. Good luck, and happy Jabbering!
+
+local _unpack = Lua.table.unpack;
+local function _split(s, sep)
+	if not s then return nil; end
+	sep = sep or ",";
+	local parts = {};
+	for part in s:gmatch("[^"..sep.."]+") do
+		parts[#parts+1] = part;
+	end
+	return parts;
+end
+
+
+---------- Server-wide settings ----------
+-- Settings in this section apply to the whole server and are the default settings
+-- for any virtual hosts
+
+plugin_paths = _split(ENV_PROSODY_PLUGIN_PATHS or "/etc/prosody/modules")
+
+-- This is a (by default, empty) list of accounts that are admins
+-- for the server. Note that you must create the accounts separately
+-- (see https://prosody.im/doc/creating_accounts for info)
+-- Example: admins = { "user1@example.com", "user2@example.net" }
+admins = _split(ENV_PROSODY_ADMINS)
+
+-- This option allows you to specify additional locations where Prosody
+-- will search first for modules. For additional modules you can install, see
+-- the community module repository at https://modules.prosody.im/
+--plugin_paths = {}
+
+-- This is the list of modules Prosody will load on startup.
+-- Documentation for bundled modules can be found at: https://prosody.im/doc/modules
+modules_enabled = {
+
+	-- Generally required
+		"disco"; -- Service discovery
+		"roster"; -- Allow users to have a roster. Recommended ;)
+		"saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
+		"tls"; -- Add support for secure TLS on c2s/s2s connections
+
+	-- Not essential, but recommended
+		"blocklist"; -- Allow users to block communications with other users
+		"bookmarks"; -- Synchronise the list of open rooms between clients
+		"carbons"; -- Keep multiple online clients in sync
+		"dialback"; -- Support for verifying remote servers using DNS
+		"limits"; -- Enable bandwidth limiting for XMPP connections
+		"pep"; -- Allow users to store public and private data in their account
+		"private"; -- Legacy account storage mechanism (XEP-0049)
+		"smacks"; -- Stream management and resumption (XEP-0198)
+		"vcard4"; -- User profiles (stored in PEP)
+		"vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard
+
+	-- Nice to have
+		"csi_simple"; -- Simple but effective traffic optimizations for mobile devices
+		"invites"; -- Create and manage invites
+		"invites_adhoc"; -- Allow admins/users to create invitations via their client
+		"invites_register"; -- Allows invited users to create accounts
+		"ping"; -- Replies to XMPP pings with pongs
+		"register"; -- Allow users to register on this server using a client and change passwords
+		"time"; -- Let others know the time here on this server
+		"uptime"; -- Report how long server has been running
+		"version"; -- Replies to server version requests
+		--"mam"; -- Store recent messages to allow multi-device synchronization
+		--"turn_external"; -- Provide external STUN/TURN service for e.g. audio/video calls
+
+	-- Admin interfaces
+		"admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands
+		"admin_shell"; -- Allow secure administration via 'prosodyctl shell'
+
+	-- HTTP modules
+		--"bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
+		--"http_openmetrics"; -- for exposing metrics to stats collectors
+		--"websocket"; -- XMPP over WebSockets
+
+	-- Other specific functionality
+		--"announce"; -- Send announcement to all online users
+		--"groups"; -- Shared roster support
+		--"legacyauth"; -- Legacy authentication. Only used by some old clients and bots.
+		--"mimicking"; -- Prevent address spoofing
+		--"motd"; -- Send a message to users when they log in
+		--"proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use
+		--"s2s_bidi"; -- Bi-directional server-to-server (XEP-0288)
+		--"server_contact_info"; -- Publish contact information for this service
+		--"tombstones"; -- Prevent registration of deleted accounts
+		--"watchregistrations"; -- Alert admins of registrations
+		--"welcome"; -- Welcome users who register accounts
+}
+
+if ENV_PROSODY_ENABLE_MODULES then
+	modules_enabled:append(_split(ENV_PROSODY_ENABLE_MODULES))
+end
+
+if ENV_PROSODY_TURN_SECRET then
+	modules_enabled:append{ "turn_external" };
+	turn_external_secret = ENV_PROSODY_TURN_SECRET
+	turn_external_host = ENV_PROSODY_TURN_HOST
+	turn_external_port = ENV_PROSODY_TURN_PORT
+	turn_external_tls_port = ENV_PROSODY_TURN_TLS_PORT
+end
+
+if ENV_PROSODY_RETENTION_DAYS or ENV_PROSODY_ARCHIVE_EXPIRY_DAYS then
+	modules_enabled:append{ "mam" }
+end
+
+modules_disabled = _split(ENV_PROSODY_DISABLE_MODULES)
+
+
+-- Server-to-server authentication
+-- Require valid certificates for server-to-server connections?
+-- If false, other methods such as dialback (DNS) may be used instead.
+
+s2s_secure_auth = ENV_PROSODY_S2S_SECURE_AUTH ~= "0"
+
+use_dane = ENV_PROSODY_USE_DANE and true or false
+unbound = {
+	-- on Debian this file is included in the package 'dns-root-data'
+	trustfile = ENV_PROSODY_USE_DANE and "/usr/share/dns/root.ds";
+	forward = _split(ENV_PROSODY_DNS_RESOLVERS);
+}
+
+-- Some servers have invalid or self-signed certificates. You can list
+-- remote domains here that will not be required to authenticate using
+-- certificates. They will be authenticated using other methods instead,
+-- even when s2s_secure_auth is enabled.
+
+--s2s_insecure_domains = { "insecure.example" }
+
+-- Even if you disable s2s_secure_auth, you can still require valid
+-- certificates for some domains by specifying a list here.
+
+--s2s_secure_domains = { "jabber.org" }
+
+
+-- Rate limits
+-- Enable rate limits for incoming client and server connections. These help
+-- protect from excessive resource consumption and denial-of-service attacks.
+
+limits = {
+	c2s = {
+		rate = ENV_PROSODY_C2S_RATE_LIMIT or "10kb/s";
+	};
+	s2sin = {
+		rate = ENV_PROSODY_S2S_RATE_LIMIT or "30kb/s";
+	};
+}
+
+-- Authentication
+-- Select the authentication backend to use. The 'internal' providers
+-- use Prosody's configured data storage to store the authentication data.
+-- For more information see https://prosody.im/doc/authentication
+
+authentication = "internal_hashed"
+
+-- Many authentication providers, including the default one, allow you to
+-- create user accounts via Prosody's admin interfaces. For details, see the
+-- documentation at https://prosody.im/doc/creating_accounts
+
+
+-- Storage
+-- Select the storage backend to use. By default Prosody uses flat files
+-- in its configured data directory, but it also supports more backends
+-- through modules. An "sql" backend is included by default, but requires
+-- additional dependencies. See https://prosody.im/doc/storage for more info.
+
+storage = ENV_PROSODY_SQL_DRIVER and "sql" or ENV_PROSODY_STORAGE or "internal"
+
+-- For the "sql" backend, you can uncomment *one* of the below to configure:
+
+if ENV_PROSODY_SQL_DRIVER then
+	sql = {
+		driver = ENV_PROSODY_SQL_DRIVER;
+		database = ENV_PROSODY_SQL_DB;
+		username = ENV_PROSODY_SQL_USERNAME;
+		password = ENV_PROSODY_SQL_PASSWORD;
+		host = ENV_PROSODY_SQL_HOST;
+	}
+end
+--sql = { driver = "SQLite3", database = "prosody.sqlite" } -- Default. 'database' is the filename.
+--sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
+--sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
+
+
+-- Archiving configuration
+-- If mod_mam is enabled, Prosody will store a copy of every message. This
+-- is used to synchronize conversations between multiple clients, even if
+-- they are offline. This setting controls how long Prosody will keep
+-- messages in the archive before removing them.
+
+archive_expires_after = (ENV_PROSODY_ARCHIVE_EXPIRY_DAYS or ENV_PROSODY_RETENTION_DAYS or "7").."d" -- Remove archived messages after 1 week
+
+-- You can also configure messages to be stored in-memory only. For more
+-- archiving options, see https://prosody.im/doc/modules/mod_mam
+
+
+-- Audio/video call relay (STUN/TURN)
+-- To ensure clients connected to the server can establish connections for
+-- low-latency media streaming (such as audio and video calls), it is
+-- recommended to run a STUN/TURN server for clients to use. If you do this,
+-- specify the details here so clients can discover it.
+-- Find more information at https://prosody.im/doc/turn
+
+-- Specify the address of the TURN service (you may use the same domain as XMPP)
+--turn_external_host = "turn.example.com"
+
+-- This secret must be set to the same value in both Prosody and the TURN server
+--turn_external_secret = "your-secret-turn-access-token"
+
+
+-- Logging configuration
+-- For advanced logging see https://prosody.im/doc/logging
+log = {
+	[ENV_PROSODY_LOGLEVEL or "info"] = "*console";
+}
+
+
+-- For more info see https://prosody.im/doc/statistics
+statistics = ENV_PROSODY_STATISTICS
+statistics_interval = Lua.tonumber(ENV_PROSODY_STATISTICS_INTERVAL) or ENV_PROSODY_STATISTICS_INTERVAL
+
+
+-- Certificates
+-- Every virtual host and component needs a certificate so that clients and
+-- servers can securely verify its identity. Prosody will automatically load
+-- certificates/keys from the directory specified here.
+-- For more information, including how to use 'prosodyctl' to auto-import certificates
+-- (from e.g. Let's Encrypt) see https://prosody.im/doc/certificates
+
+-- Location of directory to find certificates in (relative to main config file):
+certificates = ENV_PROSODY_CERTIFICATES or "certs"
+
+----------- Virtual hosts -----------
+-- You need to add a VirtualHost entry for each domain you wish Prosody to serve.
+-- Settings under each VirtualHost entry apply *only* to that host.
+
+local pp = Lua.require "prosody.util.pposix";
+local vhosts = _split(ENV_PROSODY_VIRTUAL_HOSTS) or {pp.uname().nodename};
+
+local network_hostname = ENV_PROSODY_NETWORK_HOSTNAME or #vhosts == 1 and vhosts[1];
+if network_hostname then
+	http_host = network_hostname
+	proxy65_address = network_hostname
+	if ENV_PROSODY_TURN_SECRET and not ENV_PROSODY_TURN_HOST then
+		turn_external_host = network_hostname
+	end
+end
+
+for _, vhost in Lua.ipairs(vhosts) do
+	VirtualHost (vhost)
+end
+
+------ Components ------
+-- You can specify components to add hosts that provide special services,
+-- like multi-user conferences, and transports.
+-- For more information on components, see https://prosody.im/doc/components
+
+for _, component_def in Lua.ipairs(_split(ENV_PROSODY_COMPONENTS) or {}) do
+	local c_name, c_type = _unpack(_split(component_def, ":"));
+	Component (c_name) (c_type)
+
+	if c_type == "muc" then
+		modules_enabled = _split(ENV_PROSODY_MUC_MODULES)
+	elseif c_type == "http_file_share" then
+		http_file_share_expire_after = 60 * 60 * 24 * tonumber(ENV_PROSODY_UPLOAD_EXPIRY_DAYS or ENV_PROSODY_RETENTION_DAYS or "7")
+		if ENV_PROSODY_UPLOAD_LIMIT_MB then
+			http_file_share_size_limit = (1024 * 1024 * tonumber(ENV_PROSODY_UPLOAD_LIMIT_MB)) + 16
+		end
+		if ENV_PROSODY_UPLOAD_STORAGE_GB then
+			http_file_share_global_quota = 1024 * 1024 * 1024 * tonumber(ENV_PROSODY_UPLOAD_STORAGE_GB)
+		end
+		http_paths = {
+			file_share = "/share";
+		}
+	end
+end
+
+for _, component_def in Lua.ipairs(_split(ENV_PROSODY_EXTERNAL_COMPONENTS) or {}) do
+	local c_name, c_secret = _unpack(_split(component_def, ":"));
+	Component (c_name)
+		component_secret = c_secret or ENV_PROSODY_COMPONENT_SECRET
+end
+
+---Set up a MUC (multi-user chat) room server on conference.example.com:
+--Component "conference.example.com" "muc"
+--- Store MUC messages in an archive and allow users to access it
+--modules_enabled = { "muc_mam" }
+
+---Set up a file sharing component
+--Component "share.example.com" "http_file_share"
+
+---Set up an external component (default component port is 5347)
+--
+-- External components allow adding various services, such as gateways/
+-- bridges to non-XMPP networks and services. For more info
+-- see: https://prosody.im/doc/components#adding_an_external_component
+--
+--Component "gateway.example.com"
+--	component_secret = "password"
+
+
+---------- End of the Prosody Configuration file ----------
+-- You usually **DO NOT** want to add settings here at the end, as they would
+-- only apply to the last defined VirtualHost or Component.
+--
+-- Settings for the global section should go higher up, before the first
+-- VirtualHost or Component line, while settings intended for specific hosts
+-- should go under the corresponding VirtualHost or Component line.
+--
+-- For more information see https://prosody.im/doc/configure
+
+Include (ENV_PROSODY_EXTRA_CONFIG or "/etc/prosody/conf.d/*.cfg.lua")
@@ -1,13 +1,22 @@
-#!/bin/bash
+#!/bin/bash -e
 set -e

+data_dir_owner="$(stat -c %u "/var/lib/prosody/")"
+if [[ "$(id -u prosody)" != "$data_dir_owner" ]]; then
+    # FIXME this fails if owned by root
+    usermod -u "$data_dir_owner" prosody
+fi
+if [[ "$(stat -c %u /var/run/prosody/)" != "$data_dir_owner" ]]; then
+    chown "$data_dir_owner" /var/run/prosody/
+fi
+
 if [[ "$1" != "prosody" ]]; then
-    exec prosodyctl $*
+    exec prosodyctl "$@"
    exit 0;
 fi

-if [ "$LOCAL" -a  "$PASSWORD" -a "$DOMAIN" ] ; then
-    prosodyctl register $LOCAL $DOMAIN $PASSWORD
+if [[ "$LOCAL" && "$PASSWORD" && "$DOMAIN" ]]; then
+    prosodyctl register "$LOCAL" "$DOMAIN" "$PASSWORD"
 fi

-exec "$@"
+exec runuser -u prosody -- "$@"
Author	SHA1	Message	Date
Kim Alvefur	4425fae939	configs: Coerce use_dane to boolean to avoid error	2026-03-06 13:13:06 +01:00
Kim Alvefur	6270bc329f	Allow overriding DNS resolver Nice to have on its own, but also useful to point at a DNSSEC-capable resolver.	2026-03-03 20:23:03 +01:00
Kim Alvefur	370bca28c0	Add option to turn on DANE Nice to have, especially with the recent Let's Encrypt debacle	2026-03-03 20:21:59 +01:00
Kim Alvefur	fddb859136	Dockerfile: Explicitly add ca-certificates to fix TLS verification Must have been implicitly depended on by something before	2026-03-03 17:54:37 +01:00
Kim Alvefur	348231e50b	Dockerfile: Include Bootstrap4 and jQuery to ease enabling web invites Suggested in the chat	2026-02-27 16:22:02 +01:00
Kim Alvefur	fc3d7b920c	Dockerfile: Change default package name to current stable branch	2026-02-27 16:21:33 +01:00
Kim Alvefur	1248e97f0c	Switch base images to Debian 13 "trixie"	2026-02-27 16:08:29 +01:00
Kim Alvefur	3e85e9d2b6	Dockerfile: Switch to modern way of adding Prosody repo 60MB image size reduction	2026-02-27 16:03:53 +01:00
Matthew Wild	36fb07b2d4	Merge pull request #79 from joelpurra/patch-1 Link to official, up-to-date Docker Hub image: prosodyim/prosody	2026-02-10 14:39:21 +00:00
Joel Purra	dc8600770a	Link to official, up-to-date Docker Hub image: prosodyim/prosody - Official, automated image builds are published as `prosodyim/prosody` on Docker Hub. - This commit updates links to the published image in `README.md`. - Still mentioning the outdated `prosody/prosody` image, because they are both official accounts but have confusing naming. - Adding or updating other documentation would also be helpful. - The information page(s) for both Docker Hub images. - Links to the outdated Docker Hub image, for example in the Github repository sidebar information. - Links to alternative `Dockerfile` implementations are moved below the documentation for this repository. Closes #72. Usage example: ```shell docker image pull prosodyim/prosody:13.0 podman image pull docker.io/prosodyim/prosody:13.0 ``` See - https://github.com/prosody/prosody-docker/issues/72 - https://hub.docker.com/r/prosodyim/prosody - https://hub.docker.com/r/prosody/prosody	2026-02-10 14:22:37 +01:00
Kim Alvefur	ba105e7dee	Fix splitting of PROSODY_COMPONENTS Problem is that the code appears to expect multiple returns from the `_split()` function but it returns an array, so we unpack that presumably 2-item array into the parts expected. Fixes #77	2025-04-21 19:50:21 +02:00
Kim Alvefur	d5987023e2	Update configs for deprecation of direct Lua API usage	2025-02-17 17:04:57 +01:00
Matthew Wild	601945cb85	Dockerfile: Add BUILD_ID build argument This can be used to break the cache when we know the upstream package has changed. In CI we will probably just put the build number here. Even though it is not currently exposed anywhere, it is available as an environment variable in all RUN commands following the ARG. This should be enough to avoid reusing cached layers between builds.	2025-02-18 12:27:36 +00:00
Kim Alvefur	8ede81d357	Update README for new version of Dockerfile	2025-02-15 16:36:55 +01:00
Kim Alvefur	11f3255946	Fix mistake with config for file share global quota	2025-02-15 16:24:47 +01:00
Kim Alvefur	3683ab91cc	configs: Fix mistake in `46201ee`	2025-02-15 16:23:56 +01:00
Kim Alvefur	9e7be12bec	Update reference to Debian version In order to match current Dockerfile	2025-02-15 15:43:32 +01:00
Kim Alvefur	438bb3e002	Remove 0.11 config, it has reached EOL	2025-02-15 15:42:45 +01:00
Kim Alvefur	cbc0f60ab2	configs: Create config for 13.0 as copy of trunk config Needed to start producing 13.0 docker images	2025-02-15 15:34:17 +01:00
Kim Alvefur	46201eefc1	configs/trunk: Use new array append feature to simplify	2025-02-15 15:32:06 +01:00
Kim Alvefur	8ed20cbe8f	Dockerfile: Switch to Lua 5.4 for improved performance Prosody on Lua 5.4 on Debian 12 should be well tested by now	2025-02-15 15:29:51 +01:00
Matthew Wild	d15c46949a	Move ng/* to top-level, replacing old build files	2025-02-13 18:15:55 +00:00
Kim Alvefur	74286f0b2b	ng: Update base image to Debian 12 Way overdue since we stopped supporting Debian 11 when it reached (non-LTS) EOL on 2024-08-14	2025-01-24 14:00:58 +01:00
Kim Alvefur	0581c684a5	ng: Fix bug that would create a VirtualHost"" Seems * in patterns behave differently before Lua 5.3 Thanks to tarneo for reporting this issue	2023-12-02 17:54:53 +01:00
Kim Alvefur	aa886a0b49	ng: Add FIXME wrt failure to start if data directory owned by root	2023-03-21 18:34:20 +01:00
Kim Alvefur	1c79b49c74	ng: Install Lua C headers as workaround for luarocks/luarocks#1275	2023-03-21 18:33:20 +01:00
Kim Alvefur	bfa98dcb30	ng: Apply previous two changes to 0.12 config as well	2023-02-24 14:21:49 +01:00
Kim Alvefur	2a8ec06934	ng: Allow specifying statistics interval Recommended for Prometheus / OpenMetrics which will probably be the primary use. In fact, why not just enable and hardcode mod_http_openmetrics?	2023-01-14 00:28:27 +01:00
Kim Alvefur	84a6c25e5d	ng: Set selected interpreter as default in shell Otherwise it's just going to somehow install Lua 5.1 and then use that because why not?	2023-01-14 00:25:28 +01:00
Kim Alvefur	87c60bc5d9	ng: Use console logs This enables color if output is a terminal	2023-01-14 00:22:19 +01:00
Matthew Wild	d9e98d73cf	ng: Ensure all environment variables have 'PROSODY_' prefix for consistency	2022-12-14 15:52:54 +00:00
Matthew Wild	76fa083967	ng: add config for prosody-trunk	2022-12-14 14:46:53 +00:00
Kim Alvefur	2f14fcaf8b	ng: Add lua-readline so prosodyctl shell is nicer to use	2022-12-13 18:46:26 +01:00
Matthew Wild	25f7395352	ng: New experimental Dockerfile based on apt-installing prosody	2022-12-10 16:17:35 +00:00
Alexander Dahl	a5e773d9b6	Fix signal handling and allow graceful shutdown Although `cc88073a79` ("Fix signal handling") fixed the signal handling and signals don't end up in `entrypoint.sh` anymore, there's still no clean graceful shutdown. The reason is runuser. It runs as PID 1 and prosody only runs as child process. A SIGTERM sent to runuser lets runuser forward SIGTERM to the child process. However it does not wait, but send SIGKILL right after it. (Confirmed by looking at runuser source code in util-linux.) The output on `docker stop [prosodycontainer]` is therefore: Session terminated, killing shell...mod_posix warn Received SIGTERM portmanager info Deactivated service 'c2s' ...killed. The additional messages in between prosody log output come from runuser. This is obviously no graceful shutdown. Because prosody fordibs running as uid 0 (root) we have to run it as unpriviledged user. The docker best practices recommend to use gosu and gosu lists some alternatives. Instead of installing gosu to the image, we use setpriv from the already installed util-linux now. The version in Debian buster, on which the prosody image is based currently, is recent enough to already contain setpriv. After that, prosody itself runs with PID 1, but as unpriviledged user now, and the output of `docker stop` looks like this: mod_posix warn Received SIGTERM portmanager info Deactivated service 'c2s' general info Shutting down... general info Shutdown status: Cleaning up general info Shutdown complete Link: https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#entrypoint Signed-off-by: Alexander Dahl <post@lespocky.de>	2021-03-27 16:58:09 +01:00
Alexander Dahl	83556a4c5a	Revert "Use tini as PID 1 inside the container" This reverts commit `31d6d84433`. While tini successfully forwards signals, this leads to `runuser` killing prosody now. The container does terminate in 10 seconds, so Docker is happy and you could argue that actually fixes #68, but it's no graceful shutdown. The revert is done because it's easier to apply a real fix without tini.	2021-03-27 16:58:09 +01:00
Kim Alvefur	52cd642d38	Remove inaccurate comment It says "from debian" right beneath it!	2021-03-20 12:32:20 +01:00
Jonas Schäfer	31d6d84433	Use tini as PID 1 inside the container tini [1] is a minimalistic PID 1 process. It correctly handles the special jobs which PID 1 (or a reaper process in general) needs to take care of in addition to correctly processing the relevant signals. Fixes #68. [1]: https://github.com/krallin/tini	2021-03-20 12:30:27 +01:00
selurvedu	d627c29eab	Fix minor shellcheck warnings	2021-01-29 17:20:34 +01:00
selurvedu	0555dc16c9	Fix mod_posix error if prosody user ID was altered This fixes the following mod_posix error: Couldn't write pidfile at /var/run/prosody/prosody.pid; /var/run/prosody/prosody.pid: Permission denied	2021-01-29 17:20:34 +01:00
Matthew Wild	3a21cd2c21	Merge pull request #65 from goffi-contrib/signal_fix Fix signal handling	2020-10-12 06:55:37 +01:00
Jérôme Poisson	cc88073a79	Fix signal handling This patch add `exec` to replace the shell running the `entrypoint.sh` script by Prosody executable. This allows Prosody to catch and handle correctly signals, notably SIGTERM and SIGINT. Without it, Docker can't stop correctly the container, resulting in a 10 s delay before it kills it.	2020-10-10 21:20:17 +02:00
Kim Alvefur	4878e32010	Remove our repo Debian versions of dependencies should be fine now	2020-02-14 00:50:18 +01:00
Kim Alvefur	7a6b4df1a2	README: Update for base image update	2020-02-14 00:47:17 +01:00
Matthew Wild	90963038ee	Merge pull request #62 from prosody/dynamic-uid Run with same UID as datadir owner	2020-02-13 11:18:06 +00:00
Kim Alvefur	95a9d24b76	Run with same UID as datadir owner This should fix problems with owner/uid mismatch when an existing prosody data directory is mounted into the container Closes #39	2020-02-13 01:10:36 +01:00
Kim Alvefur	47d22ada68	Start prosody with the new flag to force foreground operation	2020-02-13 01:08:16 +01:00
Kim Alvefur	80c6ffc362	Install procps, dependency of recent packages	2020-02-12 19:55:34 +01:00
Kim Alvefur	f2c1afeabe	Add libicu needed by trunk nightly builds (fixes #59 )	2020-02-12 19:52:19 +01:00
Kim Alvefur	3a47a006bc	Switch base image to Debian 10 (closes #61 ) OpenSSL version with TLS 1.3 support	2020-02-12 19:32:28 +01:00
Kim Alvefur	e0c2334d2a	Merge pull request #56 from Zash/shellcheck Quote variables in entrypoint.sh	2019-03-31 18:47:34 +02:00
Kim Alvefur	8c4170e7d9	entrypoint.sh: Quote variables [shellcheck]	2019-03-16 19:19:37 +01:00
Matthew Wild	1fa2fb60ce	Ensure prosody package key is world-readable (so apt user can read it)	2019-01-14 12:19:03 +00:00