Tips for self-hosting Snikket with a reverse proxy

Recently I found a need to self-host an XMPP server, this was due to the public server I was using suddenly going offline.

I don't use XMPP chat a whole lot but I use it as a gateway into some of my other tools and so I decided that rather than rely on another third-party, I'd bring it in-house. And by "in-house" I mean onto a free cloud hosting instance I have little control over.

After reviewing the various options I decided Snikket was the one for me. It's built on top of Prosody (or by the same team, technically) and is essentially the same thing with a bunch of pre-configuration/choices made.

While getting Snikket installed went smoothly, getting it up and running proved fun as I had a bunch of other services on the same VPS.

I use Caddy to provide a reverse proxy for some of these and this caused a lot of hassle trying open the various routes to allow both access to the web interface and the XMPP ports as well as getting the Let's Encrypt SSL certificates to be recognised in Snikket.

In the end, I had to do four things:

1. Open the ports on the VPS

First off, naturally, I had to open the relevant ports on my VPS. TCP ports weren't a problem as they were all already open and forwarded. I added UDP as well in the same vein.

2. Set alternative HTTP/S ports in Snikket

In snicket.config I had to add:

SNIKKET_TWEAK_HTTP_PORT=5080
SNIKKET_TWEAK_HTTPS_PORT=5443

3. Add firewall rules in Linux

Additionally I had to modify my iptables like so:

sudo iptables -I INPUT 6 -p tcp --dport 5222 -j ACCEPT
sudo iptables -I INPUT 6 -p tcp --dport 5269 -j ACCEPT

And then persist them with:

sudo netfilter-persistent save

4. Confiure Caddy

The options in the Snikket FAQ didn't work for me and it took a lot of trial and error, online searching and LLM use to hit the right combination that did, which was:

http://chat.mydomain.net, http://groups.chat.mydomain.net, http://share.chat.mydomain.net {
        # Pass Let's Encrypt requests straight through to Snikket
        reverse_proxy /.well-known/acme-challenge/* localhost:5080

        # Optional: Redirect all other standard web traffic to HTTPS
        redir https://{host}{uri} permanent
}

chat.mydomain.net, groups.chat.mydomain.net, share.chat.mydomain.net {
        reverse_proxy localhost:5443 {
                header_up Host {host}
                header_up X-Forwarded-Proto https
                transport http {
                        tls_insecure_skip_verify
                }
        }
}

And that seems to have been the magic combination.

Posting both to remind me and in case anyone else finds it useful.