A+ rating on Qualys :)
https://www.ssllabs.com/ssltest/analyze.html?d=owncloud.rudel.nl&hideResults=on

set up the xmpp server: prosody

apt-get install prosody
configure as per example / global settings and add an admin user there

create some keys:

openssl req -new -x509 -days 1000 -nodes -out “/etc/ssl/certs/xxxxxxxx.crt” -newkey rsa:4096 -keyout “/etc/ssl/private/xxxxxxxx.key”

UPDATE: Use Letsencrypt, this flag should do the trick
./letsencrypt-auto certonly --standalone -d xmpp.rudel.nl

Copy the certificate from /etc/letsencrypt/live//fullchain.pem to /etc/prosody/.crt
Copy the private key from /etc/letsencrypt/live//privkey.pem to /etc/prosody/.key

under your server in your domain’s .cfg.lua add the certs
ssl = {
key = “/etc/prosody/xmpp.key”;
certificate = “/etc/prosody/xmpp.crt”;
}

or create symlinks

secure the keys
sudo chmod 600 /path/to/certificate.key
sudo chown prosody:prosody /path/to/certificate.key

Prosody should also be able to read the parent directories of the file.

To test that only Prosody can read the file:

sudo -u prosody cat /path/to/certificate.key # Should succeed
sudo -u nobody cat /path/to/certificate.key # Should fail

Declaring host

The configuration of the host im.example.org will be done in the file « /etc/prosody/conf.avail/im.example.org.cfg.lua », the file example.com.cfg.lua may serve as a model:

cp -a /etc/prosody/conf.avail/example.com.cfg.lua /etc/prosody/conf.avail/xmpp.rudel.nl.cfg.lua

With your favorite editor change the settings for VirtualHost and enabled so you have:

VirtualHost “im.example.org”
–enabled = false — Remove this line to enable this host

The line “- enabled = […]” can also be removed, instead of of removing the comment like above.

Also represent the key and the SSL certificate:

ssl = {
key = “/etc/prosody/certs/im.example.org.key”;
certificate = “/etc/prosody/certs/im.example.org.cert”;
}

If you already have a key / certificate pair on the same domain name (Common Name), for example for apache, point to it instead of the files listed above.

Now create the symbolic link in« /etc/prosody/conf.d/ » with:

ln -sf /etc/prosody/conf.avail/im.example.org.cfg.lua /etc/prosody/conf.d/im.example.org.cfg.lua

Several host by one configuration

Here is an example to declare a single configuration for multiple hosts (thank you MattJ):

for _, host in ipairs { “example.net”, “example.org” } do
VirtualHost (host)
option1 = “foo”
option2 = “bar”
end

Create users (single)

Creating user accounts is done with the command « prosodyctl »

prosodyctl adduser romeo@im.example.org

open firewall for ports 5222 and 5269 IP and IPv6

create DNS SRV records for optimal federation / domain delegation
use this template:
_xmpp-client._tcp.example.com. 18000 IN SRV 0 5 5222 xmpp.example.com.
_xmpp-server._tcp.example.com. 18000 IN SRV 0 5 5269 xmpp.example.com.
_jabber._tcp.example.com 18000 IN SRV 0 5 5222 xmpp.example.com < -- that still relevant? also.. no dots after TLD? doubt this will work... in fact: the domain is automatically added so just add this: _xmpp-client._tcp type SRV with value 0 5 5222 xmpp.domain.com. and _xmpp-server._tcp type SRV with value 0 5 5222 xmpp.domain.com. it must point to an existing A-record - not an IP address (this also helps with IPv6 I guess...) ;; QUESTION SECTION: ;_xmpp-client._tcp.rudel.nl. IN SRV ;; ANSWER SECTION: _xmpp-client._tcp.rudel.nl. 3600 IN SRV 0 5 5222 telecity.rudel.nl. ;; ADDITIONAL SECTION: telecity.rudel.nl. 3600 IN A 80.252.86.117

restart and test

—————————————————-

https://doc.owncloud.org/server/8.2/admin_manual/installation/installation_wizard.html

as long as you can call it from the apache config file (and/or the owncloud virtual host config)

RewriteEngine on
ReWriteCond %{SERVER_PORT} !^443$
RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]


enforce redirect to SSL (disable plain HTTP) and enforce transport header security
see owncloud hardening document

TO DO: memcache and db locking > https://doc.owncloud.org/server/8.2/admin_manual/configuration_server/caching_configuration.html?highlight=memcache
apt-get install php5-apcu
FAIL: edit config.php and add the config (didn’t work for me.. )

Quasselcore: building it myself:
http://bugs.quassel-irc.org/projects/1/wiki/Build_Core_On_Ubuntu

on the old host stop the daemon:
#service quasselcore stop

then copy over old quassel:
(assuming a single user sqlite install without a particulary important certificate…) meaning one config file and one log file:
(do not copy the cert… let’s create a new one)

/var/lib/quassel/quasselcore.conf
and /var/lib/quassel/quassel-storage.sqlite

create a user called “quasselcore” with group “quassel” and its homedir in /var/lib/quassel

move these to /var/lib/quassel and change the permissions of the dir and the files to quasselcore:quassel (chown)

create /etc/defaults/quasselcore

# Defaults for quasselcore initscript
# sourced by /etc/init.d/quasselcore

# The port quasselcore will listen at. Default is: 4242
PORT="4242"

and the upstart script: /etc/init/quasselcore.conf
# quasselcore - distributed IRC client using a central core component
#
# This is the core component of Quassel. A modern,
# cross-platform, distributed IRC client, meaning that one
# (or multiple) client(s) can attach to and detach from this
# central core. It's much like the popular combination
# of screen and a text-based IRC client such as WeeChat.

create a cert (as user “quasselcore”)

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /var/lib/quassel/quasselCert.pem -out /var/lib/quassel/quasselCert.pem

check if the config checks out:
root@bespin:~# init-checkconf /etc/init/quasselcore.conf
File /etc/init/quasselcore.conf: syntax ok
root@bespin:~#

start the server
#service quasselcore start

open firewall:
#ufw allow 4242/tcp

and it should work :)