comparison mod_restrict_federation/README.md @ 6325:ba2c344e1bdd

mod_restrict_federation: Yet another module for restricting s2s for (some) users
author Matthew Wild <mwild1@gmail.com>
date Thu, 25 Sep 2025 13:09:57 +0100
parents
children
comparison
equal deleted inserted replaced
6324:a41d5d511948 6325:ba2c344e1bdd
1 ---
2 labels:
3 - 'Stage-Beta'
4 summary: Restrict federation for some user roles
5 ...
6
7 Introduction
8 ============
9
10 This module allows you to control which user roles have permission to
11 communicate with remote servers.
12
13 Details
14 =======
15
16 There are quite a few modules that have similar functionality. The properties
17 of this one are:
18
19 - Uses the new [permissions and roles](https://prosody.im/doc/roles) feature introduced in Prosody 13.0
20 - Blocks both incoming and outgoing traffic
21 - Permits server-originated traffic (such as push notifications)
22 - Permits traffic between hosts on the same server
23
24 Configuration
25 =============
26
27 Simply load the module as usual:
28
29 ``` {.lua}
30 modules_enabled = {
31 ...
32 "restrict_federation";
33 ...
34 }
35 ```
36
37 Any user without the `xmpp:federate` permission will be unable to communicate
38 with remote domains. By default this module does not grant this permission to
39 any role, meaning all users will be restricted.
40
41 To grant permission to certain roles, you can use the `add_permission`
42 configuration option (assuming you are using Prosody's [default authorization
43 module](https://prosody.im/doc/modules/mod_authz_internal)):
44
45 ``` {.lua}
46 -- Allow registered users to federate (i.e. this excludes prosody:guest)
47 -- As prosody:admin inherits all permissions from this role too, admins will
48 -- also be able to communicate with other servers.
49 add_permissions = {
50 ["prosody:registered"] = {
51 "xmpp:federate";
52 };
53 }
54 ```
55
56 Compatibility
57 =============
58
59 ----- -------
60 13.0 Works
61 ----- -------