1 files changed, 31 insertions, 10 deletions
diff --git a/vps-configuration.env.nix b/vps-configuration.env.nix
index 1ef5eb2..4a4e743 100644
--- a/vps-configuration.env.nix
+++ b/vps-configuration.env.nix
@@ -24,6 +24,7 @@ let
     gitPort = "$GIT_PORT";
     gitRoot = "$GIT_ROOT";
     systemStateVersion = "$SYSTEM_STATE_VERSION";
+    prosodyConverseTLD = "$PROSODY_CONVERSE_TLD";
     prosodyAdminUser = "$PROSODY_ADMIN_USER";
     prosodyMUCTLD = "$PROSODY_MUC_TLD";
     prosodyPort = "$PROSODY_PORT";
@@ -143,15 +144,24 @@ in {
             root ${envsubstConfiguration.staticRoot}/songbooks/;
           '';
         };
+        # Generate and maintain TLS certificate with NGINX
+        # to be used by Prosody
         "${envsubstConfiguration.prosodyTLD}" = {
           forceSSL = true;
           enableACME = true;
+        };
+        "${envsubstConfiguration.prosodyConverseTLD}" = {
+          forceSSL = true;
+          enableACME = true;
           extraConfig = ''
             location = /favicon.ico {
                     alias ${envsubstConfiguration.dataRoot}/favicons/conversejs.ico;
             }
+            location = / {
+                    return 301 conversejs;
+            }
             location / {
-                    proxy_pass http://localhost:${envsubstConfiguration.prosodyHTTPPort}/conversejs;
+                    proxy_pass http://localhost:${envsubstConfiguration.prosodyHTTPPort}/;
             }
           '';
         };
@@ -189,9 +199,16 @@ in {
     };
 
     prosody = let
-      fullchainPEM =
-        "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/fullchain.pem";
-      keyPEM = "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/key.pem";
+      XMPP = {
+        fullchainPEM =
+          "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/fullchain.pem";
+        keyPEM = "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/key.pem";
+      };
+      ConverseJS = {
+        fullchainPEM =
+          "/var/lib/acme/${envsubstConfiguration.prosodyConverseTLD}/fullchain.pem";
+        keyPEM = "/var/lib/acme/${envsubstConfiguration.prosodyConverseTLD}/key.pem";
+      };
     in {
       enable = true;
       admins = [ envsubstConfiguration.prosodyAdminUser ];
@@ -201,17 +218,21 @@ in {
         withCommunityModules = [ "http_upload" "conversejs" "bookmarks" ];
       };
       extraModules = [ "http_upload" "conversejs" "bookmarks" ];
-      ssl = {
-        cert = fullchainPEM;
-        key = keyPEM;
-      };
       virtualHosts = {
         "${envsubstConfiguration.prosodyTLD}" = {
           enabled = true;
           domain = "${envsubstConfiguration.prosodyTLD}";
           ssl = {
-            cert = fullchainPEM;
-            key = keyPEM;
+            cert = XMPP.fullchainPEM;
+            key = XMPP.keyPEM;
+          };
+        };
+        "${envsubstConfiguration.prosodyConverseTLD}" = {
+          enabled = true;
+          domain = "${envsubstConfiguration.prosodyConverseTLD}";
+          ssl = {
+            cert = ConverseJS.fullchainPEM;
+            key = ConverseJS.keyPEM;
           };
         };
       };