Skip to content
Learn Security

Deploying a Secure Prosody XMPP Server on Docker with SSL & Firewall

This guide walks you through deploying a secure Prosody XMPP server on Docker with SSL encryption, firewall protection, and automatic maintenance. It covers installation, configuration, user management, security hardening, and scaling for a self-hosted, privacy-focused messaging solution.

3 min read
Secure Chat Server for OnPrem

What is XMPP?

XMPP (Extensible Messaging and Presence Protocol) is a widely used open standard for instant messaging, offering real-time, decentralized communication.

Why Choose Prosody as an XMPP Server?

Prosody is a lightweight and efficient XMPP server known for its easy configuration, extensibility, and low resource consumption. It is an excellent choice for self-hosted messaging solutions.

Key Features and Advantages of Prosody:

  • Lightweight and efficient.
  • Plugin-based modular architecture.
  • Secure with TLS/SSL encryption.
  • Active development and strong community support.
  • Easy integration with third-party services.

Why Use Docker for XMPP?

Benefits of Docker:

  • Ease of Deployment & Portability: Easily deploy Prosody across multiple environments.
  • Isolation from Host System: Ensures security and reduces conflicts.
  • Simplified Updates & Maintenance: Updates and backups are more manageable.

Minimum Server Requirements (Based on User Capacity)

User CapacityCPURAMStorage
Small (Up to 100 users)1 vCPU1GB10GB SSD
Medium (Up to 500 users)2 vCPU2GB20GB SSD
Large (Up to 1000+ users)4 vCPU4GB50GB SSD

Step-by-Step Deployment

1. Choosing the Right OS

Use Debian 11 Minimal for stability and security.

2. Initial Server Setup & Firewall Configuration

apt update && apt upgrade -y
apt install ufw
ufw allow ssh
ufw allow 5222/tcp  # XMPP client connection
ufw allow 5269/tcp  # Server-to-server federation
ufw enable

3. Installing Docker & Docker-Compose

apt install -y docker.io docker-compose
systemctl enable --now docker

4. Writing the Docker-Compose File for Prosody

Create a docker-compose.yml file:

version: '3'
services:
  prosody:
    image: prosody/prosody:latest
    container_name: prosody
    restart: unless-stopped
    ports:
      - "5222:5222"
      - "5269:5269"
    volumes:
      - ./data:/var/lib/prosody
      - ./config:/etc/prosody
    environment:
      - XMPP_DOMAIN=example.com

5. Setting Up SSL (Let’s Encrypt) for Secure Connections

apt install certbot python3-certbot-nginx
certbot certonly --standalone -d example.com

Modify prosody.cfg.lua to enable SSL:

ssl = {
    key = "/etc/letsencrypt/live/example.com/privkey.pem";
    certificate = "/etc/letsencrypt/live/example.com/fullchain.pem";
}

6. Running the Prosody Container and Verifying Logs

docker-compose up -d

Check logs:

docker logs -f prosody

User Management in Prosody

Creating Users

docker exec -it prosody prosodyctl adduser user@example.com

Managing Accounts

  • Delete a user: prosodyctl deluser user@example.com
  • Change password: prosodyctl passwd user@example.com

Connecting to XMPP Server

  • Windows/macOS/Linux: Gajim, Dino, Pidgin.
  • Android: Conversations, Blabber.
  • iOS: Siskin IM, Monal.

Setting Up a User Account on a Client App

  1. Install an XMPP client.
  2. Add a new account: user@example.com
  3. Enter the password set earlier.
  4. Connect and start messaging!

Securing and Maintaining the XMPP Server

Auto-Renew SSL Certificates

crontab -e

Add:

0 0 * * * certbot renew --quiet

Keeping Prosody and Docker Up to Date

docker-compose pull && docker-compose up -d

Checking Logs and Debugging Issues

docker logs prosody

Scaling Up & Advanced Configurations

How to Scale the Server for More Users

  • Upgrade CPU and RAM.
  • Use a separate database for authentication.

Enabling Additional Prosody Modules

Modify prosody.cfg.lua:

modules_enabled = {
    "muc";  -- Multi-user chat (group chat)
    "mam";  -- Message archiving
    "smacks";  -- Stream management
}

Setting Up an Admin Web Interface

Use Prosody Web Admin.

Final Thoughts

Deploying Prosody on Docker is a powerful and scalable solution for secure, private messaging. With SSL, firewall protection, and user-friendly clients, XMPP is an excellent alternative to proprietary services like WhatsApp or Signal.

Are you ready to take control of your own messaging platform? Deploy your Prosody server today!


Share article

Subscribe to my newsletter

Receive my case study and the latest articles on my WhatsApp Channel.