Mercurial > prosody-modules

annotate mod_restrict_federation/README.md @ 6562:5da6fb562df9 default tip

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_unified_push: Fix push error handling (fixes #2000) Use the error object that send_iq() passes as an argument to it's reject callback instead of attempting and failing to do the parsing in the callback itself.
author kmq
date Mon, 06 Jul 2026 14:23:57 +0200
parents ba2c344e1bdd
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6325
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 ---
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2 labels:
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 - 'Stage-Beta'
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4 summary: Restrict federation for some user roles
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 ...
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 Introduction
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8 ============
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 This module allows you to control which user roles have permission to
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 communicate with remote servers.
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13 Details
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 =======
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 There are quite a few modules that have similar functionality. The properties
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 of this one are:
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 - Uses the new [permissions and roles](https://prosody.im/doc/roles) feature introduced in Prosody 13.0
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 - Blocks both incoming and outgoing traffic
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 - Permits server-originated traffic (such as push notifications)
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22 - Permits traffic between hosts on the same server
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 Configuration
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25 =============
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
27 Simply load the module as usual:
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
28
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
29 ``` {.lua}
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
30 modules_enabled = {
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
31 ...
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
32 "restrict_federation";
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
33 ...
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
34 }
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
35 ```
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
36
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
37 Any user without the `xmpp:federate` permission will be unable to communicate
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
38 with remote domains. By default this module does not grant this permission to
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
39 any role, meaning all users will be restricted.
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
40
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
41 To grant permission to certain roles, you can use the `add_permission`
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
42 configuration option (assuming you are using Prosody's [default authorization
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
43 module](https://prosody.im/doc/modules/mod_authz_internal)):
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
44
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
45 ``` {.lua}
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
46 -- Allow registered users to federate (i.e. this excludes prosody:guest)
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
47 -- As prosody:admin inherits all permissions from this role too, admins will
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
48 -- also be able to communicate with other servers.
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
49 add_permissions = {
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
50 ["prosody:registered"] = {
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
51 "xmpp:federate";
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
52 };
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
53 }
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
54 ```
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
55
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
56 Compatibility
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
57 =============
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
58
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
59 ----- -------
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
60 13.0 Works
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
61 ----- -------