Merge branch 'master' into ccchaos

ansible/files/bin/start-coturn.sh

@@ -5,8 +5,8 @@ if [ "$SNIKKET_TWEAK_TURNSERVER" = "0" ]; then
 	exit 0;
 fi
 
-CERTFILE="/snikket/letsencrypt/live/$SNIKKET_DOMAIN/fullchain.pem";
-KEYFILE="/snikket/letsencrypt/live/$SNIKKET_DOMAIN/privkey.pem";
+CERTFILE="${SNIKKET_CERTFILE:-/snikket/letsencrypt/live/$SNIKKET_DOMAIN/fullchain.pem}";
+KEYFILE="${SNIKKET_KEYFILE:-/snikket/letsencrypt/live/$SNIKKET_DOMAIN/privkey.pem}";
 
 echo "Waiting for certificates to become available..."
 while ! test -f "$CERTFILE" -a -f "$KEYFILE"; do

ansible/files/prosody.cfg.lua

@@ -3,12 +3,14 @@ local DOMAIN = assert(ENV_SNIKKET_DOMAIN, "Please set the SNIKKET_DOMAIN environ
 local RETENTION_DAYS = tonumber(ENV_SNIKKET_RETENTION_DAYS) or 7;
 local UPLOAD_STORAGE_GB = tonumber(ENV_SNIKKET_UPLOAD_STORAGE_GB);
 
+local CERT_PATH = ENV_SNIKKET_CERTFILE or "/etc/prosody/certs/"..DOMAIN..".crt";
+local KEY_PATH = ENV_SNIKKET_KEYFILE or "/etc/prosody/certs/"..DOMAIN..".key";
+
 if prosody.process_type == "prosody" and not prosody.config_loaded then
 	-- Wait at startup for certificates
 	local lfs, socket = require "lfs", require "socket";
-	local cert_path = "/etc/prosody/certs/"..DOMAIN..".crt";
 	local counter = 0;
-	while not lfs.attributes(cert_path, "mode") do
+	while not lfs.attributes(CERT_PATH, "mode") do
 		counter = counter + 1;
 		if counter == 1 or counter%6 == 0 then
 			print("Waiting for certificates...");
@@ -193,7 +195,7 @@ else
 	statistics_interval = 60
 end
 
-certificates = "certs"
+-- certificates = "certs"
 
 group_default_name = ENV_SNIKKET_SITE_NAME or DOMAIN
 
@@ -223,6 +225,13 @@ isolate_except_domains = { "push.snikket.net", "push-ios.snikket.net" }
 VirtualHost (DOMAIN)
 	authentication = "internal_hashed"
 
+	ssl = {
+		ciphers = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4";
+		certificate = CERT_PATH;
+		key = KEY_PATH;
+	};
+
+
 	http_files_dir = "/var/www"
 	http_paths = {
 		files = "/";