sudo ufw allow 5222/tcp comment 'XMPP: apps de chat'
sudo ufw allow 5269/tcp comment 'XMPP: otros servidores'
sudo ufw allow 5443/tcp comment 'XMPP: archivos'
sudo ufw allow 3478 comment 'STUN/TURN: llamadas'
sudo ufw allow 49152:65535/udp comment 'TURN: audio y video'
sudo ufw status | grep -E '5222|5269|5443|3478|49152'

sudo apt install ejabberd
sudo systemctl stop ejabberd
id ejabberd

sudo tee /etc/nginx/sites-available/chat-acme > /dev/null <<'EOF'
# Solo para Let's Encrypt: conference. y upload. no tienen web
server {
    listen 80;
    listen [::]:80;
    server_name conference.TU_DOMINIO upload.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 444;
    }
}
EOF
sudo ln -s /etc/nginx/sites-available/chat-acme /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

sudo tee /etc/letsencrypt/renewal-hooks/deploy/ejabberd-certificado.sh > /dev/null <<'EOF'
#!/bin/sh
# Copia el certificado del chat a ejabberd (que no puede leer los de root) y lo recarga
case "$RENEWED_LINEAGE" in
    */chat.TU_DOMINIO) ;;
    *) exit 0 ;;
esac
umask 027
install -d -o root -g ejabberd -m 750 /etc/ejabberd/certs
cat "$RENEWED_LINEAGE/fullchain.pem" "$RENEWED_LINEAGE/privkey.pem" > /etc/ejabberd/certs/chat.pem
chown root:ejabberd /etc/ejabberd/certs/chat.pem
chmod 640 /etc/ejabberd/certs/chat.pem
systemctl is-active --quiet ejabberd && systemctl reload ejabberd
exit 0
EOF
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/ejabberd-certificado.sh

sudo certbot certonly --webroot -w /var/www/letsencrypt \
  -d TU_DOMINIO -d conference.TU_DOMINIO -d upload.TU_DOMINIO \
  --cert-name chat.TU_DOMINIO
sudo ls -l /etc/ejabberd/certs/

sudo cp /etc/ejabberd/ejabberd.yml /etc/ejabberd/ejabberd.yml.orig
sudo nano /etc/ejabberd/ejabberd.yml

sudo mkdir -p /var/lib/ejabberd/upload
sudo chown ejabberd:ejabberd /var/lib/ejabberd/upload
sudo chmod 750 /var/lib/ejabberd/upload

sudo systemctl start ejabberd
sleep 10
sudo ejabberdctl status
sudo ss -tulnp | grep -E 'beam' | awk '{print $1, $5}' | sort -u

read -rs -p "Contraseña para TU_USUARIO: " P; echo
sudo ejabberdctl register TU_USUARIO TU_DOMINIO "$P"
unset P
sudo ejabberdctl registered_users TU_DOMINIO

sudo ls -la /var/lib/ejabberd/upload/
sudo du -sh /var/lib/ejabberd/upload/

sudo ejabberdctl muc_online_rooms global

sudo grep -iE "turn|stun" /var/log/ejabberd/ejabberd.log | tail -n 5

sudo grep -n "INET_DIST_INTERFACE" /etc/ejabberd/ejabberdctl.cfg
sudo sed -i 's/^#\?INET_DIST_INTERFACE=.*/INET_DIST_INTERFACE=127.0.0.1/' /etc/ejabberd/ejabberdctl.cfg
sudo grep -n "^INET_DIST_INTERFACE" /etc/ejabberd/ejabberdctl.cfg

F=/etc/systemd/system/epmd.socket.d/solo-local.conf
sudo mkdir -p /etc/systemd/system/epmd.socket.d
[ -e "$F" ] && echo "YA EXISTE, no lo toco" || sudo tee "$F" > /dev/null <<'EOF'
[Socket]
ListenStream=
ListenStream=127.0.0.1:4369
ListenStream=[::1]:4369
EOF
cat "$F"

sudo systemctl stop ejabberd
sudo systemctl stop epmd.service epmd.socket
sudo systemctl daemon-reload
sudo systemctl start epmd.socket
sudo systemctl start ejabberd
sleep 15
sudo ejabberdctl status
sudo ss -tlnp | grep -E 'beam|epmd' | awk '{print $4, $6}'

sudo tee /etc/fail2ban/jail.d/chat.local > /dev/null <<'EOF'
[ejabberd-auth]
enabled  = true
port     = 5222,5269,5443
logpath  = /var/log/ejabberd/ejabberd.log
maxretry = 5
findtime = 10m
bantime  = 1h
EOF
sudo fail2ban-client -t && sudo systemctl reload fail2ban
sudo fail2ban-client status ejabberd-auth

sudo tee /etc/cron.d/ejabberd-mantenimiento > /dev/null <<'EOF'
# Ebenezer IT · ejabberd
# Cada noche a las 02:30: copia de la base de datos de ejabberd
30 2 * * * ejabberd /usr/sbin/ejabberdctl backup /var/lib/ejabberd/copia-ejabberd.backup > /dev/null
# Los domingos a las 04:00: borrar del servidor los mensajes de más de un año
0 4 * * 0 ejabberd /usr/sbin/ejabberdctl delete_old_mam_messages all 365 > /dev/null
EOF
sudo -u ejabberd /usr/sbin/ejabberdctl backup /var/lib/ejabberd/copia-ejabberd.backup
sudo ls -lh /var/lib/ejabberd/copia-ejabberd.backup

sudo ejabberdctl status
sudo ss -tulnp | grep beam | awk '{print $1, $5}' | sort -u
sudo ufw status | grep -E '5222|5269|5443|3478|49152|5280|5223|1883'
echo | openssl s_client -connect 127.0.0.1:5222 -starttls xmpp -xmpphost TU_DOMINIO 2>/dev/null | openssl x509 -noout -enddate
sudo fail2ban-client status | grep "Jail list"