$ sudo apt-get update
$ sudo apt-get install certbot python3-certbot-nginx nginx-full

$ dig -t SRV _stun._tcp.xmpp.ua +short
0 0 3478 xmpp.ua.

$ sudo certbot certonly --nginx -d xmpp.ua -d conference.xmpp.ua -d proxy.xmpp.ua -d upload.xmpp.ua

$ echo deb http://packages.prosody.im/debian $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list
$ wget https://prosody.im/files/prosody-debian-packages.key -O- | sudo apt-key add -
$ sudo apt-get update
$ sudo apt-get install prosody prosody-modules lua-sec lua-dbi-sqlite3 lua-dbi-common lua-luaossl coturn

$ sudo apt-get install mercurial
$ sudo hg clone https://hg.prosody.im/prosody-modules/ /usr/src/prosody-modules

-- a custom prosody 0.13 config
-- Configuration docs: https://prosody.im/doc/configure

---------- Server-wide settings ----------

use_ipv6 = false

admins = { "admin@xmpp.ua" }

plugin_paths = { "/usr/src/prosody-modules" } -- non-standard plugin path so we can keep them up to date with mercurial

modules_enabled = {
  --  Generally required
  "disco"; -- Service discovery
  "roster"; -- Allow users to have a roster. Recommended ;)
  "saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
  "tls"; -- Add support for secure TLS on c2s/s2s connections

  -- Not essential, but recommended
  "blocklist"; -- XEP-0191 blocking of users
  "bookmarks"; -- Synchronize currently joined groupchat between different clients.
  "carbons"; -- XEP-0280: Message Carbons, synchronize messages accross devices
  "dialback"; -- s2s dialback support
  "limits"; -- Enable bandwidth limiting for XMPP connections
  "pep"; -- Enables users to publish their mood, activity, playing music and more
  "private"; -- Private XML storage (for room bookmarks, etc.)
  "smacks"; -- XEP-0198: Stream Management, keep chatting even when the network drops for a few seconds
  "vcard4"; -- User Profiles (stored in PEP)
  "vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard
  -- "carbons_copies"; -- carbons for legacy clients
  -- "carbons_adhoc"; -- carbons for legacy clients

  -- Nice to have
  "account_activity"; -- Record time when an account was last used
  "cloud_notify"; -- Push notifications for mobile devices
  "cloud_notify_extensions"; -- Required to support Siskin or Snikket iOS
  "csi_simple"; -- Simple but effective traffic optimizations for mobile devices
  -- "invites"; -- Create and manage invites
  -- "invites_adhoc"; -- Allow admins/users to create invitations via their client
  -- "invites_register"; -- Allows invited users to create accounts
  "ping"; -- Replies to XMPP pings with pongs
  "register"; --Allows clients to register an account on your server
  "time"; -- Let others know the time here on this server
  "uptime"; -- Report how long server has been running
  "version"; -- Replies to server version requests
  -- "ping_muc"; -- XEP-0410: MUC Self-Ping
  "mam"; -- Store recent messages to allow multi-device synchronization
  "turn_external"; -- Provide external STUN/TURN service for e.g. audio/video calls
  -- "csi_battery_saver";

  -- Admin interfaces
  "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands
  "admin_shell"; -- Allow secure administration via 'prosodyctl shell'
  -- "admin_telnet"; -- Opens telnet console interface on localhost port 5582

  -- HTTP modules
  "bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
  "http_openmetrics"; -- for exposing metrics to stats collectors
  "websocket"; -- XMPP over WebSockets
  "http_files"; -- Serve static files from a directory over HTTP
  -- "unified_push"; -- Unified Push Provider

  -- Other specific functionality
  -- "announce"; -- Send announcement to all online users
  -- "groups"; -- Shared roster support
  "mimicking"; -- Prevent address spoofing
  -- "motd"; -- Send a message to users when they log in
  -- "proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use
  "s2s_bidi"; -- Bi-directional server-to-server (XEP-0288)
  "server_contact_info"; -- Publish contact information for this service
  "tombstones"; -- Prevent registration of deleted accounts
  "watchregistrations"; -- Alert admins of registrations
  -- "welcome"; -- Welcome users who register accounts
  -- "legacyauth"; -- Enable mod_legacyauth

  -- Custom
  "conversejs"; -- Simplify setup of Converse.js
  "http_altconnect"; -- Enable discovery of BOSH and WebSocket endpoints
  "register_web"; -- A web interface to register user accounts
  "register_oob_url"; -- XEP-077 IBR registration URL redirect
  "listusers";
  "block_registrations"; -- Allow restricting registrations of certain user accounts, and/or ensure that registered accounts conform to a given pattern
  -- "block_strangers"; -- Module to block message and iqs from people not on your roster
  -- "firewall"; -- A rule-based stanza filtering module
  -- "register_dnsbl_firewall_mark"; -- Another copy of DNSBL module, this time creating "user marks" for mod_firewall
  "spam_reporting"; -- XEP-0377: Spam Reporting
  "watch_spam_reports"; -- Notify admins about incoming XEP-0377 spam reports
  "s2s_blacklist"; -- A new _simple_ s2s blacklist module
  "default_bookmarks"; -- Default bookmarked chatrooms
};

modules_disabled = {
  -- "offline"; -- Store offline messages
  -- "c2s"; -- Handle client connections
  -- "s2s"; -- Handle server-to-server connections
};

statistics = "internal"
statistics_interval = "manual"

limits = {
  c2s = {
    rate = "2000kb/s";
    burst = "2s";
  };
  s2sin = {
    rate = "5000kb/s";
    burst = "5s";
  };
  s2sout = {
    rate = "5000kb/s";
    burst = "5s";
  };
}

allow_registration = false; -- Enable to allow people to register accounts on your server from their clients, for more information see http://prosody.im/doc/creating_accounts
register_oob_url = "https://xmpp.ua/register"

certificates = "/etc/prosody/certs" -- Path where prosody looks for the certificates see: https://prosody.im/doc/letsencrypt

https_certificate = "certs/xmpp.ua.crt"

-- Force clients to use encrypted connections? This option will
-- prevent clients from authenticating unless they are using encryption.

c2s_require_encryption = true -- Force clients to use encrypted connections

-- Force servers to use encrypted connections? This option will
-- prevent servers from authenticating unless they are using encryption.
-- Note that this is different from authentication

s2s_require_encryption = true

-- Force certificate authentication for server-to-server connections?
-- This provides ideal security, but requires servers you communicate
-- with to support encryption AND present valid, trusted certificates.
-- NOTE: Your version of LuaSec must support certificate verification!
-- For more information see http://prosody.im/doc/s2s#security

s2s_secure_auth = true

consider_websocket_secure = true

c2s_direct_tls_ports = { 5223 }
c2s_direct_tls_ssl = {
  certificate = "/etc/prosody/certs/xmpp.ua.crt";
  key = "/etc/prosody/certs/xmpp.ua.key";
}
s2s_direct_tls_ports = { 5270 };
s2s_direct_tls_ssl = {
  certificate = "/etc/prosody/certs/xmpp.ua.crt";
  key = "/etc/prosody/certs/xmpp.ua.key";
}

-- You only need these if you need to specify custom ports or interfaces
-- proxy65_interfaces = { "*", "::" }
-- proxy65_ports = { 5000 }

pidfile = "/var/run/prosody/prosody.pid"

storage = "sql"
sql = {
    driver = "SQLite3";
    database = "prosody.sqlite";
}

authentication = "internal_hashed"

-- Archiving
-- If mod_mam is enabled, Prosody will store a copy of every message. This
-- is used to synchronize conversations between multiple clients, even if
-- they are offline. This setting controls how long Prosody will keep
-- messages in the archive before removing them.

default_archive_policy = true
-- archive_expires_after = "1w" -- Remove archived messages after 1 week
archive_expires_after = "never"

-- Chatroom MAM settings
muc_log_by_default = true
muc_room_default_language = "uk"
max_archive_query_results = 20
max_history_messages = 1000

log = { --disable for extra privacy
  info = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for verbose logging
  error = "/var/log/prosody/prosody.err";
  -- debug = "/var/log/prosody/prosody.dbg";
  -- "*syslog";
}

-- Use epoll as network backend.
network_backend = "epoll"

http_default_host = "xmpp.ua"
http_files_dir = "/var/www/xmpp.ua/"
http_paths = {
  file_share = "/upload";
  register_web = "/register";
  files = "/";
}

http_external_url = "https://xmpp.ua/"
trusted_proxies = { "127.0.0.1", "23.192.XX.XXX" }
-- Templates customization: https://modules.prosody.im/mod_register_web
-- register_web_template = "/var/lib/prosody/register-templates";
captcha_options = {
  provider = "hcaptcha";
  captcha_private_key = "CAPTCHA_PRIVATE_KEY";
  captcha_public_key = "CAPTCHA_PUBLIC_KEY";
}

-- add contact information for other server admins to contact you about issues regarding your server
-- this is particularly important if you enable public registrations
contact_info = {
  abuse = { "xmpp:admin@xmpp.ua" };
  admin = { "xmpp:admin@xmpp.ua" };
  feedback = { "xmpp:admin@xmpp.ua" };
  security = { "xmpp:admin@xmpp.ua" };
  support = { "xmpp:admin@xmpp.ua" };
}

block_registrations_users = { "administrator", "admin", "root", "postmaster", "xmpp", "contact", "mail", "abuse" }
-- Allow only simple ASCII characters in usernames
block_registrations_require = "^[a-zA-Z0-9_.-]+$"

-- Block connections to remote servers at the s2s level
s2s_blacklist = {
  -- "example.org",
}

-- cloud_notify
push_notification_with_body = false -- Whether or not to send the message body to remote pubsub node
push_notification_with_sender = false -- Whether or not to send the message sender to remote pubsub node
push_max_errors = 5 -- persistent push errors are tolerated before notifications for the identifier in question are disabled
push_max_devices = 5 -- number of allowed devices per user

-- by default every user on this server will join these muc rooms
--default_bookmarks = {
--  { jid = "general@conference.xmpp.ua"; name = "Балачки", autojoin = true };
--}

turn_external_host = "xmpp.ua"
turn_external_secret = "COTURN-PRIVATE-KEY"

VirtualHost "xmpp.ua"
  name = "Prosody"
  -- disco_items = { -- allows clients to find the capabilities of your server
    -- { "upload.xmpp.ua", "HTTP File Upload" };
    -- { "conference.xmpp.ua", "Prosody Chatrooms" };
    -- { "proxy.xmpp.ua", "SOCKS5 Bytestreams Service" };
    -- { "notify.xmpp.ua", "Prosody Unified Push Provider" };
  -- }

-- Enable http_upload to allow image sharing across multiple devices and clients
Component "upload.xmpp.ua" "http_file_share"
  name = "HTTP File Upload"
  http_file_share_size_limit = 50*1024*1024 -- 50 MiB
  http_file_share_daily_quota = 512*1024*1024 -- 512 MiB per day per user
  http_file_share_global_quota = 10*1024*1024*1024 -- 10 GiB total
  http_file_share_expires_after = 30*60*60*24 -- 30 days

-- Allow setting up groupchats on this subdomain:
Component "conference.xmpp.ua" "muc"
  name = "Prosody Chatrooms"
  modules_enabled = {
    "muc_mam",
    -- "muc_block_pm",
    "muc_mam_hints",
    "muc_auto_member",
    "muc_moderation",
    "muc_anonymize_moderation_actions"
  }
  anonymize_moderation_actions_form_position = 96
  component_admins_as_room_owners = true
  restrict_room_creation = "local"
  -- Defaults
  muc_room_default_language = "uk"

-- Set up a file transfer proxy to facilitate clients sending larger files to each other
Component "proxy.xmpp.ua" "proxy65"
  name = "SOCKS5 Bytestreams Service"

## Minimal version of /etc/tunserver.conf

# Which porst to listen on, make sure the corresponding ports are accepting
# UDP connections on your firewall
listening-port=3478
tls-listening-port=5349

# Your external IP, needed for some connections
listening-ip=23.192.XX.XXX
relay-ip=23.192.XX.XXX
external-ip=23.192.XX.XXX

# Your domain name
realm=xmpp.ua

# Ports that client can connect to.
# Again make sure they are open for UDP connections on your firewall
min-port=49152
max-port=65535

# For the connection with Prosody. Generate a long passphrase for the secret.
use-auth-secret
static-auth-secret=COTURN-PRIVATE-KEY

#Paths to Let's Encrypt certificates
cert=/etc/turnserver.cert
pkey=/etc/turnserver.pkey

# Log to syslog
syslog
## you may also want to log in a file instead:
# no-stdout-log
# simple-log
# log-file=/var/log/turnserver/turnserver.log

# For security:


# disallow server fingerprinting
prod
#dissalow connections on lo interface
# no-loopback-peers
# disable command-line access
no-cli

# Disable RFC5780 (NAT behavior discovery).
#
# Originally, if there are more than one listener address from the same
# address family, then by default the NAT behavior discovery feature enabled.
# This option disables the original behavior, because the NAT behavior
# discovery adds extra attributes to response, and this increase the
# possibility of an amplification attack.
#
# Strongly encouraged to use this option to decrease gain factor in STUN
# binding responses.
#
no-rfc5780

# Disable handling old STUN Binding requests and disable MAPPED-ADDRESS
# attribute in binding response (use only the XOR-MAPPED-ADDRESS).
#
# Strongly encouraged to use this option to decrease gain factor in STUN
# binding responses.
#
no-stun-backward-compatibility

# Only send RESPONSE-ORIGIN attribute in binding response if RFC5780 is enabled.
#
# Strongly encouraged to use this option to decrease gain factor in STUN
# binding responses.
#
response-origin-only-with-rfc5780

$ sudo prosodyctl --root cert import /etc/letsencrypt/live/xmpp.ua
$ sudo install -m 740 -o turnserver -g turnserver -T /etc/letsencrypt/live/xmpp.ua/cert.pem /etc/turnserver.cert
$ sudo install -m 740 -o turnserver -g turnserver -T /etc/letsencrypt/live/xmpp.ua/privkey.pem /etc/turnserver.pkey

# /etc/cron.d/xmpp: crontab entries for the prosody and coturn packages
#
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

0 0 * * 7 root sh -c 'prosodyctl --root cert import /etc/letsencrypt/live/xmpp.ua'
0 0 * * 7 root sh -c 'install -m 740 -o turnserver -g turnserver -T /etc/letsencrypt/live/xmpp.ua/cert.pem /etc/turnserver.cert; install -m 740 -o turnserver -g turnserver -T /etc/letsencrypt/live/xmpp.ua/privkey.pem /etc/turnserver.pkey; systemctl --signal=SIGUSR2 kill coturn'
#

$ sudo systemctl enable --now coturn prosody

$ sudo prosodyctl check
Checking config...
Done.

Checking DNS for component conference.xmpp.ua...

Checking DNS for component proxy.xmpp.ua...

Checking DNS for host xmpp.ua...

Checking DNS for component upload.xmpp.ua...
    Ensure the reverse proxy sets the HTTP Host header to 'upload.xmpp.ua'

Checking certificates...
Checking certificate for conference.xmpp.ua
  Certificate: /etc/prosody/certs/xmpp.ua.crt
Checking certificate for proxy.xmpp.ua
  Certificate: /etc/prosody/certs/xmpp.ua.crt
Checking certificate for xmpp.ua
  Certificate: /etc/prosody/certs/xmpp.ua.crt
Checking certificate for upload.xmpp.ua
  Certificate: /etc/prosody/certs/xmpp.ua.crt

Testing TURN service xmpp.ua:3478...
Success!

All checks passed, congratulations!

$ sudo prosodyctl adduser admin@xmpp.ua
Enter new password:
Retype new password:

$ sudo touch /etc/nginx/sites-available/xmpp.ua
$ sudo ln -s /etc/nginx/sites-available/xmpp.ua /etc/nginx/sites-enabled/xmpp.ua

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    server_tokens off;
    access_log /var/log/nginx/xmpp.ua-access.log;
    error_log /var/log/nginx/xmpp.ua-error.log;

    server_name    xmpp.ua www.xmpp.ua conference.xmpp.ua upload.xmpp.ua proxy.xmpp.ua;
    listen         80;
    listen         [::]:80;

    return         301 https://$server_name$request_uri;
}

server {
    server_tokens off;
    access_log /var/log/nginx/xmpp.ua-access.log;
    error_log /var/log/nginx/xmpp.ua-error.log;

    server_name    xmpp.ua www.xmpp.ua conference.xmpp.ua upload.xmpp.ua proxy.xmpp.ua;
    listen         443 ssl;
    listen         [::]:443 ssl;

    ssl_trusted_certificate   /etc/letsencrypt/live/xmpp.ua/fullchain.pem;
    ssl_certificate /etc/letsencrypt/live/xmpp.ua/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/xmpp.ua/privkey.pem; # managed by Certbot

    # Add TLSv1.0 to support older devices
    ssl_protocols TLSv1.2;
    # Uncomment line below if you want to support older devices (Before Android 4.4.2, IE 8, etc.)
    #ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
    ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
    ssl_prefer_server_ciphers on;
    # In case of an old server with an OpenSSL version of 1.0.2 or below,
    # leave only prime256v1 or comment out the following line.
    ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
    ssl_stapling on;
    ssl_stapling_verify on;

    root /var/www/html/;
    index index.html;

    location / {
        proxy_pass  http://127.0.0.1:5280;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        tcp_nodelay on;
    }

    location /upload {
        proxy_pass  http://127.0.0.1:5280;
        client_max_body_size 50m;
        proxy_set_header Host "upload.xmpp.ua";
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        tcp_nodelay on;
    }

    location /xmpp-websocket {
        proxy_pass http://127.0.0.1:5280/xmpp-websocket;
        proxy_http_version 1.1;
        proxy_buffering off;
        proxy_set_header Host $host;
        proxy_set_header Connection "upgrade";
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Forwarded-For $remote_addr;
        tcp_nodelay on;
    }
}

$ sudo nginx -t
 nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
 nginx: configuration file /etc/nginx/nginx.conf test is successful
$ sudo systemctl reload nginx