latest ejabberd

cat ejabberd.yml
loglevel: 4
log_rotate_size: 10485760
log_rotate_count: 1
hosts:
  - yourdomain.com
certfiles:
  - /opt/ejabberd/conf/certs/*.pem
define_macro:

  'TLS_CIPHERS': "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
  'TLS_OPTIONS':
    - "no_sslv3"
    - "no_tlsv1"
    - "cipher_server_preference"
    - "no_compression"
  'DH_FILE': "/opt/ejabberd/conf/dh2048.pem" # generated with: openssl dhparam -out dhparams.pem 2048

c2s_dhfile: "/opt/ejabberd/conf/dh2048.pem"
c2s_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
c2s_protocol_options:
 - "no_sslv3"
 - "no_sslv2"
 - "no_tlsv1"
 - "no_tlsv1_1"
 - "cipher_server_preference"

listen:
  -
    port: 5222
    ip: "::"
    module: ejabberd_c2s
    starttls: true
    starttls_required: true
    protocol_options:
      - "no_sslv2"
      - "no_sslv3"
      - "no_tlsv1"
      - "no_tlsv1_1"
      - "cipher_server_preference"
    ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
    tls_compression: false
    dhfile: "/opt/ejabberd/conf/dh2048.pem"
    max_stanza_size: 262144
    shaper: c2s_shaper
    access: c2s
  -
    port: 5223
    ip: "::"
    module: ejabberd_c2s
    max_stanza_size: 262144
    tls: true
    shaper: c2s_shaper
    access: c2s
  -
    port: 5269
    ip: "::"
    module: ejabberd_s2s_in
    max_stanza_size: 524288
    shaper: s2s_shaper
  -
    port: 5280
    ip: "::"
    module: ejabberd_http
    request_handlers:
      "/ws": ejabberd_http_ws
      "/bosh": mod_bosh
      "/api": mod_http_api
      "/admin": ejabberd_web_admin
    captcha: false
    tls: true
    protocol_options:
       - "no_sslv3"
       - "no_sslv2"
       - "no_tlsv1"
       - "no_tlsv1_1"
       - "cipher_server_preference"
    dhfile: "/opt/ejabberd/conf/dh2048.pem"
    ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
  -
    port: 5281
    ip: "::"
    tls: true
    module: ejabberd_http
    request_handlers:
      /ws: ejabberd_http_ws
      /bosh: mod_bosh
      /admin: ejabberd_web_admin
      /.well-known/acme-challenge: ejabberd_acme
      /register: mod_register_web
      /api: mod_http_api
    captcha: false
  -
     port: 5444
     transport: tcp
     ip: "::"
     module: ejabberd_http
     request_handlers:
      "": mod_http_upload
     tls: true
     protocol_options:
       - "no_sslv2"
       - "no_sslv3"
       - "no_tlsv1"
       - "no_tlsv1_1"
       - "cipher_server_preference"
     dhfile: "/opt/ejabberd/conf/dh2048.pem"
     ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
  -
     port: 5444
     transport: udp
     ip: "::"
     module: ejabberd_http
     request_handlers:
      "": mod_http_upload
     tls: true
     protocol_options:
       - "no_sslv2"
       - "no_sslv3"
       - "no_tlsv1"
       - "no_tlsv1_1"
       - "cipher_server_preference"
     dhfile: "/opt/ejabberd/conf/dh2048.pem"
     ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
  -
    port: 5225
    use_proxy_protocol: true
    ip: "::"
    module: ejabberd_c2s
    max_stanza_size: 262144
    shaper: c2s_shaper
    access: c2s
    tls: true
    protocol_options: 'TLS_OPTIONS'

s2s_use_starttls: required
s2s_dhfile: "/opt/ejabberd/conf/dh2048.pem"
s2s_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
s2s_cafile: "/etc/ssl/certs/ca-certificates.crt"
s2s_protocol_options:
  - "no_sslv2"
  - "no_sslv3"
  - "no_tlsv1"
  - "cipher_server_preference"

auth_method:
       - sql
auth_use_cache: false

auth_password_format: plain

sql_type: mysql
sql_server: "localhost"
sql_database: "ejabberd"
sql_username: "ejabberd"
sql_password: "PRIVACY"
sql_pool_size: 5

new_sql_schema: true

default_db: sql

max_fsm_queue: 10000

acl:
  admin:
     user:
      - "beep@yourdomain.com"
  local:
    user_regexp: ""
  loopback:
    ip:
      - 127.0.0.0/8
      - ::1/128

shaper:
  normal: 3000
  burst_size: 20000
  fast: 200000


shaper_rules:
  max_user_sessions: 1
  max_user_offline_messages:
    5000: admin
    100: all
  c2s_shaper:
    none: admin
    normal: all
  s2s_shaper: fast

access_rules:
  local:
    allow: local
  muc_log:
    allow: admin
  muc_admin:
    allow: admin
  roster:
    allow: admin

  c2s:
    deny: blocked
    allow: all
  announce:
    allow: admin
  configure:
    allow: admin
  muc_create:
    allow: local
  pubsub_createnode:
    allow: all
  trusted_network:
    allow: loopback

api_permissions:
  "console commands":
    from:
      - ejabberd_ctl
    who: all
    what: "*"
  "webadmin commands":
    from: ejabberd_web_admin
    who: admin
    what: "*"
  "admin access":
    who:
      access:
        allow:
          acl: loopback
          acl: admin
      oauth:
        scope: "ejabberd:admin"
        access:
          allow:
            acl: loopback
            acl: admin
    what:
      - "*"
      - "!stop"
      - "!start"
  "public commands":
    who:
      ip: "127.0.0.1/8"
    what:
      - status
      - connected_users_number

language: "en"

acme:
  contact: "mailto:example-admin@example.com"
  ca_url: "https://acme-v02.api.letsencrypt.org/directory"

modules:
  mod_adhoc: {}
  mod_admin_extra: {}
  mod_announce:   # recommends mod_adhoc
    access: announce
  mod_avatar: {}
  mod_block_strangers: {}
  mod_blocking: {}   # requires mod_privacy
  mod_bosh: {}
  mod_caps: {}
  mod_carboncopy: {}
  mod_client_state: {}
  mod_configure: {}   # requires mod_adhoc
  mod_disco: {}
  mod_http_api: {}
  mod_http_upload:
    put_url: https://@HOST@/upload/
    docroot: "/var/www/upload/"
    custom_headers:
      "Access-Control-Allow-Origin": "https://@HOST@"
      "Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS"
      "Access-Control-Allow-Headers": "Content-Type"
  mod_last: {}
  mod_mam: # for xep0313, mnesia is limited to 2GB, better use an SQL backend
    db_type: sql
    assume_mam_usage: true
    default: always
  mod_muc:
    host: "conference.@HOST@"
    default_room_options:
     allow_user_invites: true
     allow_visitor_status: true
     persistent: true
     mam: true
     members_by_default: false
     allow_subscription: true
     anonymous: false
    access:
      - allow
    access_admin:
      - allow: admin
    access_create: muc_create
    access_persistent: muc_create
    access_mam:
      - allow
    ram_db_type: sql
  mod_muc_log:
    access_log: muc_log
    dirtype: subdirs
    file_permissions:
      mode: 644
      group: 33
    outdir: "/var/log/ejabberd/multichatlogs"
    timezone: local
    top_link:
      "http://www.yourdomain.com/": "yourdomain chastni comunicaci"
  mod_muc_admin: {}
  mod_offline:
    access_max_user_messages: max_user_offline_messages
  mod_ping:
   send_pings: true
   ping_interval: 3
  mod_privacy:
   db_type: sql
   use_cache: true
  mod_private:
   db_type: sql
   use_cache: true
  mod_proxy65:
   access: local
   host: "proxy.@HOST@"
   name: "yourdomain bytestream"
   ip: "192.168.33.4"
   port: 7778
   max_connections: 5
  mod_pubsub:
    access_createnode: pubsub_createnode
    plugins:
      - flat
      - pep   # pep requires mod_caps
    force_node_config:
      storage:bookmarks:
        access_model: whitelist
  mod_push: {}
  mod_push_keepalive: {}
  mod_pres_counter:
     count: 5
     interval: 60

  mod_register:
    captcha_protected: true
    welcome_message:
      subject: "Welcome!"
      body: |-
        Hi.
        Welcome to this XMPP server.
    redirect_url: "https://yourdomain.com/register"
    registration_watchers:
     - "beep@yourdomain.com"
    ip_access: trusted_network
  mod_register_web: {}
  mod_roster:
    versioning: true
    store_current_id: true
  mod_sic: {}
  mod_s2s_bidi: {}
  mod_s2s_dialback: {}
  mod_shared_roster: {}
  mod_stats: {}
  mod_stream_mgmt:
    resend_on_timeout: if_offline
    resume_timeout: 0
  mod_stun_disco:
    access: local
    offer_local_services: true
    secret: PRIVACY
    services:
      -
        host: yourdomain.com
        port: 8443
        type: stun
        transport: udp
        restricted: false
      -
        host: yourdomain.com
        port: 8443
        type: turn
        transport: udp
        restricted: true
      -
        host: yourdomain.com
        port: 8443
        type: stun
        transport: tcp
        restricted: false
      -
        host: yourdomain.com
        port: 8443
        type: turn
        transport: tcp
        restricted: true
      -
        host: yourdomain.com
        port: 8443
        type: stuns
        transport: tcp
        restricted: false
      -
        host: yourdomain.com
        port: 8443
        type: turns
        transport: tcp
        restricted: true
  mod_time: {}
  mod_vcard:
    search: true
  mod_vcard_xupdate: {}
  mod_version:
    show_os: false

allow_contrib_modules: true