@factoidal/core 0.33.0 → 0.34.0

package/CHANGELOG.md

@@ -1,6 +1,13 @@
 # Changelog
 
-## Unreleased
+## 0.34.0 (2026-11-08)
+
+- `foafnaut` command: `--url` and `--html` open a page or a file (`file:` URLs too), and other options are passed to the app.
+- XMPP: `xmpp-serve --proxy-protocol` (`proxyProtocol` in `createXmppServer`): every connection, on every listener, must start with a PROXY protocol v2 header, read before TLS, and the failed-login limit counts the client address it names. So the limit per client address can stay on behind Fly's proxy, where `--no-address-limit` was needed. The header is decided in Lean (`L4Factoidal/Net/ProxyProtocol.lean`, new wasm op `proxyHeaderParse`, theorems `parse_signature`, `parse_more_bounded`, `parse_proxy_le`); a connection without a valid header in 10 seconds (`proxyHeaderTimeoutMs`) is closed. Without the flag no header is read.
+- XMPP: the server keeps no client address. The limit counts an HMAC-SHA-256 tag of the address (IPv6 by its /64) under a random key that is in memory only and new at each start (`LoginLimit.addressTag`; `xmppOpen` takes `addressKey`; `xmppSessionOpen` and `xmppWsOpen` answer `addressTag`, its first 12 digits). The "connection from" log line shows the tag, not the address and port.
+- XMPP: the server pings a bound session that has been silent, and closes it if it stays silent, so a dead connection frees its resource. A ping is XEP-0199 on TCP and a ping frame on a WebSocket; any byte from the client counts as an answer. `xmpp-serve --ping-interval SECONDS` (default 30, 0 disables) and `--ping-timeout SECONDS` (default 20); `pingIntervalMs` and `pingTimeoutMs` in `createXmppServer`. New ops `xmppSessionPing` and `xmppWsPing`.
+- XMPP: a client that binds a resource a live session holds gets a server-generated one (RFC 6120 section 7.7.2.2), in the bind result. The live session stays. A client must use the JID in the bind result. A resource with no live session is free, and a room seat goes when its stream ends.
+- XMPP: room moderation (XEP-0045 sections 8 to 10): kick (status 307), ban (status 301), grant and revoke voice, moderator, member, admin and owner, the admin and owner lists, and status 321. `xmpp-serve --muc-owners FILE` names the owners, as `room: a@x` or `*: a@x` for every room. With that flag, also with an empty file, the first occupant of a room gets no rights, XMPP cannot change a configured owner, and with `--state-key` bans, grants and revoked voices survive a restart. Without the flag the first occupant is the owner as before, and a room's bans go with the room.
 
 ## 0.33.0 (2026-11-06)
 

package/bin/factoidal.mjs

@@ -772,9 +772,10 @@ Specification: https://solidproject.org/TR/protocol`,
 usage: factoidal xmpp-serve DIR [--domain NAME] [--port N] [--host ADDRESS]
                             [--accounts FILE] [--cert FILE --key FILE [--starttls [--tls-port N]]]
                             [--ws-port N [--ws-path PATH] [--ws-origin ORIGIN]...]
-                            [--muc DOMAIN [--muc-members FILE]] [--mix DOMAIN] [--gc3 DOMAIN]
+                            [--muc DOMAIN [--muc-members FILE] [--muc-owners FILE]] [--mix DOMAIN] [--gc3 DOMAIN]
                             [--state-key FILE] [--max-connections N]
-                            [--login-timeout SECONDS] [--no-address-limit]
+                            [--login-timeout SECONDS] [--ping-interval SECONDS]
+                            [--ping-timeout SECONDS] [--proxy-protocol] [--no-address-limit]
                             [--dangerously-disable-ratelimits]
 
 Starts a Node TCP server that runs one engine session per connection and
@@ -817,11 +818,19 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
   --muc DOMAIN     also serve XEP-0045 multi-user chat rooms at DOMAIN, e.g.
                    conference.example.com: temporary rooms, made by the first
                    join and gone with the last occupant; no history, no
-                   configuration, no persistence (L4Factoidal/XMPP/Muc.lean)
+                   configuration form (L4Factoidal/XMPP/Muc.lean). Kick, ban, voice
+                   and the admin and owner lists follow XEP-0045 sections 8 to 10
   --muc-members FILE  members-only rooms: one room per line, as
                    "room: alice@example.com bob@example.com". Only those accounts
                    may join or see that room; a room not in the file is open to
                    every account (L4Factoidal/XMPP/Muc.lean)
+  --muc-owners FILE  room owners: one room per line, as "room: alice@example.com",
+                   and "*: alice@example.com" for every room. XMPP cannot change
+                   these names. With this flag, also with an empty file, nobody
+                   becomes an owner by being first in a room, and with --state-key
+                   bans and affiliations survive a restart. Without this flag, the
+                   first occupant of a room with no owner is its owner, and a room's
+                   bans and affiliations go with the room
   --mix DOMAIN     also serve XEP-0369 MIX channels at DOMAIN, e.g. mix.example.com,
                    joined through this server (XEP-0405 MIX-PAM); channels are
                    made by an IQ <create/>, kept in memory only, JID-hidden; no
@@ -831,6 +840,11 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    behind a proxy, every client has the same one
   --login-timeout SECONDS  how long a connection may stay without a bound
                    resource before it is closed (default 30; 0 disables)
+  --ping-interval SECONDS  how long a bound session may be silent before the
+                   server pings it: XEP-0199 on TCP, a ping frame on a WebSocket
+                   (default 30; 0 disables pings)
+  --ping-timeout SECONDS  how long after a ping a session that sends no byte is
+                   closed, which frees its resource (default 20)
   --state-key FILE keep the server's state across restarts: rosters, messages held
                    for offline accounts, MIX channels and GC3 groups, in an LWS
                    storage in DIR/state, sealed (ChaCha20-Poly1305) under the key
@@ -841,10 +855,21 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    membership, stable participant ids, optional events. There is
                    no published GC3 spec; every wire format is invented and listed
                    in L4Factoidal/XMPP/Gc3.lean and danbri/factoidal issue 1236
+  --proxy-protocol every connection, on every listener (--port, --tls-port,
+                   --ws-port), must start with a PROXY protocol version 2 header
+                   (HAProxy's spec), read before TLS. The client address in it is
+                   the one the failed-login limit counts. A connection with no
+                   valid header in 10 seconds is closed; a version 1 (text)
+                   header is refused. A LOCAL header (a health check of the
+                   proxy) is accepted with the socket's address. Use it only
+                   behind a proxy that always sends the header, such as Fly with
+                   handlers = ["proxy_proto"] and proxy_proto_options =
+                   { version = "v2" }; without it no header is ever read, so a
+                   client cannot claim an address
   --no-address-limit
                    count failed logins per account name only. For a listener
-                   behind a proxy, where every client has the proxy's address
-                   and a limit on it would stop them all
+                   behind a proxy that sends no PROXY header, where every client
+                   has the proxy's address and a limit on it would stop them all
   --dangerously-disable-ratelimits
                    no failed SASL login limit and no sender rate on held
                    messages (a warning is printed at start); any client can
@@ -858,6 +883,9 @@ the SASL failure temporary-auth-failure, and no password is checked, also
 the right one, until that window ends. A client address also has a slower
 limit of 20 failed logins in an hour. A malformed SASL payload checks no
 password and does not count. A stream closes after 3 failed attempts.
+The server keeps no client address: the counters hold an HMAC-SHA-256
+tag of it (of its /64 for IPv6) under a random key that is in memory
+only and new at each start, and logs show the first 12 digits of the tag.
 
 The server makes no protocol decision. Stream negotiation, SASL PLAIN and
 SCRAM-SHA-256, resource binding, the roster, presence subscription and
@@ -1283,7 +1311,7 @@ const VALUE_OPTIONS = {
   'authz-serve': new Set(['port', 'host', 'issuer', 'resource', 'alg', 'token-lifetime', 'rotate-after',
     'cors-origin', 'saml-idp', 'saml-decrypt-key']),
   'authz-keys': new Set([]),
-  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'tls-port', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'muc-members', 'mix', 'gc3', 'state-key', 'max-connections', 'login-timeout', 'verifier', 'iterations']),
+  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'tls-port', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'muc-members', 'muc-owners', 'mix', 'gc3', 'state-key', 'max-connections', 'login-timeout', 'ping-interval', 'ping-timeout', 'verifier', 'iterations']),
   'webdav-serve': new Set(['port', 'host', 'users', 'guest', 'cert', 'key', 'login-limit', 'login-window', 'xmpp', 'xmpp-password-file',
     'xmpp-host', 'xmpp-port', 'xmpp-allow', 'xmpp-resource', 'xmpp-ca', 'allow-host', 'allow-origin']),
   'webdav-user': new Set(['iterations']),
@@ -2983,6 +3011,7 @@ async function commandXmppServe (positional, options) {
     settings.disableRateLimits = options['dangerously-disable-ratelimits'] === true
   }
   if (options['no-address-limit'] === true) settings.addressLimit = false
+  if (options['proxy-protocol'] === true) settings.proxyProtocol = true
   if (useTls) {
     settings.cert = await fs.readFile(options.cert)
     settings.key = await fs.readFile(options.key)
@@ -3019,6 +3048,20 @@ async function commandXmppServe (positional, options) {
       settings.mucMembers.push({ room, members })
     }
   }
+  if (options['muc-owners'] !== undefined) {
+    if (typeof options['muc-owners'] !== 'string') throw new UsageError('--muc-owners needs a FILE')
+    if (settings.mucDomain === undefined) throw new UsageError('--muc-owners needs --muc')
+    settings.mucOwners = []
+    for (const line of (await fs.readFile(options['muc-owners'], 'utf8')).split('\n')) {
+      if (line.trim() === '') continue
+      const [, room, list] = /^([^:\s@/]+):(.*)$/.exec(line.trim()) ?? []
+      const owners = (list ?? '').split(/\s+/).filter(Boolean)
+      if (room === undefined || owners.length === 0 || owners.some((m) => !/^[^\s@/]+@[^\s@/]+$/.test(m))) {
+        throw new UsageError(`--muc-owners: not "room: bare@jid ...": ${line}`)
+      }
+      settings.mucOwners.push({ room, owners })
+    }
+  }
   if (options.mix !== undefined) {
     if (typeof options.mix !== 'string' || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(options.mix)) {
       throw new UsageError('--mix needs a domain name, e.g. mix.example.com')
@@ -3043,6 +3086,16 @@ async function commandXmppServe (positional, options) {
     if (!Number.isSafeInteger(n) || n < 0) throw new UsageError('--login-timeout needs a number of seconds')
     settings.loginTimeoutMs = n * 1000
   }
+  if (options['ping-interval'] !== undefined) {
+    const n = Number(options['ping-interval'])
+    if (!Number.isSafeInteger(n) || n < 0) throw new UsageError('--ping-interval needs a number of seconds')
+    settings.pingIntervalMs = n * 1000
+  }
+  if (options['ping-timeout'] !== undefined) {
+    const n = Number(options['ping-timeout'])
+    if (!Number.isSafeInteger(n) || n < 1) throw new UsageError('--ping-timeout needs a positive number of seconds')
+    settings.pingTimeoutMs = n * 1000
+  }
   if (options['ws-port'] !== undefined) {
     const wsPort = Number(options['ws-port'])
     if (!Number.isInteger(wsPort) || wsPort < 0 || wsPort > 65535) throw new UsageError('--ws-port needs a port number')
@@ -3078,6 +3131,8 @@ async function commandXmppServe (positional, options) {
     err(`xmpp-serve: listening on ${running.origin} for domain ${running.xmpp.domain}` +
         ` (${running.xmpp.accounts} accounts, state ${positional[0]}` +
         (startTls ? ', STARTTLS required)' : useTls ? ', direct TLS)' : ', PLAINTEXT: no TLS on this listener)'))
+    if (settings.proxyProtocol) err('xmpp-serve: every connection must start with a PROXY protocol v2 header')
+    else if (settings.addressLimit === false) err('xmpp-serve: failed logins count per account name only (--no-address-limit)')
     if (settings.mucDomain) err(`xmpp-serve: multi-user chat (XEP-0045) at ${settings.mucDomain}`)
     if (settings.mixDomain) err(`xmpp-serve: MIX channels (XEP-0369, joined by XEP-0405) at ${settings.mixDomain}`)
     if (settings.gc3Domain) err(`xmpp-serve: GC3 PROTOTYPE groups at ${settings.gc3Domain} (no published spec; invented wire format)`)

package/bin/foafnaut.mjs

@@ -10,9 +10,11 @@ import { homedir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
-const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE] [-- APP_ARGS]
+const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE | --url URL | --html FILE] [APP_OPTIONS] [-- APP_ARGS]
 
-  PAGE              an http(s) URL or an HTML file; none opens the default page
+  PAGE              an http(s) or file: URL, or an HTML file; none opens the default page
+  --url URL         the page as a URL (http, https or file)
+  --html FILE       the page as a local HTML file
   --latest          install the newest published macOS build, then use it
   --bleeding-edge   use the local build (config.json "bleedingEdge", or
                     ~/Applications/foafnaut.app)
@@ -23,6 +25,15 @@ const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE] [-- APP_ARGS]
   --which           print the app that would run
   --help            this text
 
+App options, passed to the app as they are:
+  --perf-summary    print frame and input latency figures when the window closes
+  --check-pixels    read back and check every frame (slow)
+  --wasm-engine     use the Wasm engine, not the native library
+  --native-engine PATH  use this native engine library
+  --font FILE       load this font file
+  --bitmap-font     use the baked-in ASCII font only
+  --follow-links    open links that a page asks for at load
+
 Also: foafnaut-latest, foafnaut-bleedingedge. Environment: FOAFNAUT_HOME, and
 FOAFNAUT_APP, which chooses the app outright. Page data goes to the app. Its trace
 is in ~/Library/Logs/foafnaut/trace.jsonl. The command stays open until the window
@@ -96,9 +107,14 @@ async function installLatest() {
   return versionApp(dir);
 }
 
+// App options that take no value, and those that take one.
+const APP_FLAGS = ['--perf-summary', '--check-pixels', '--wasm-engine', '--bitmap-font', '--follow-links', '--idle-checks-only', '--trace-input'];
+const APP_VALUES = ['--native-engine', '--font'];
+
 function pageArgs(page) {
   if (page === undefined) return [];
   if (/^https?:\/\//i.test(page)) return ['--url', page];
+  if (/^file:/i.test(page)) page = new URL(page).pathname;
   const path = resolve(page);
   if (!existsSync(path)) fail(`no such file: ${page}`);
   return ['--html', path];
@@ -109,10 +125,13 @@ export async function main(argv, channel = 'current') {
   const options = split < 0 ? argv : argv.slice(0, split);
   const extra = split < 0 ? [] : argv.slice(split + 1);
   let page, which = false, verbose = false, detach = false;
+  const app_ = [];
+  const setPage = (value) => { if (page !== undefined) fail('give one page'); if (value === undefined) fail('a page option needs a value'); page = value; };
   // Each of these picks the app or the action. Two of them have no one meaning.
   const exclusive = options.filter((arg) => ['--latest', '--bleeding-edge', '--install-latest', '--list'].includes(arg));
   if (new Set(exclusive).size > 1) fail(`${exclusive.join(' and ')} can not be used together; see --help`);
-  for (const arg of options) {
+  for (let i = 0; i < options.length; i++) {
+    const arg = options[i];
     if (arg === '--help' || arg === '-h') { process.stdout.write(HELP); return; }
     else if (arg === '--latest') channel = 'latest';
     else if (arg === '--bleeding-edge') channel = 'bleeding-edge';
@@ -127,9 +146,12 @@ export async function main(argv, channel = 'current') {
         console.log(`${name === current ? '*' : ' '} ${name}`);
       console.log(`  bleeding edge: ${bleedingEdgeApp()}${existsSync(bleedingEdgeApp()) ? '' : ' (not found)'}`);
       return;
-    } else if (arg.startsWith('-')) fail(`unknown option ${arg}; see --help`);
-    else if (page !== undefined) fail('give one page');
-    else page = arg;
+    } else if (arg === '--url' || arg === '--html') setPage(options[++i]);
+    else if (arg.startsWith('--url=') || arg.startsWith('--html=')) setPage(arg.slice(arg.indexOf('=') + 1));
+    else if (APP_FLAGS.includes(arg)) app_.push(arg);
+    else if (APP_VALUES.includes(arg)) { if (options[i + 1] === undefined) fail(`${arg} needs a value`); app_.push(arg, options[++i]); }
+    else if (arg.startsWith('-')) fail(`unknown option ${arg}; see --help`);
+    else setPage(arg);
   }
   if (process.platform !== 'darwin') fail('the native window is macOS only; use the Hub page in a WebGPU browser');
   let app = process.env.FOAFNAUT_APP;
@@ -138,7 +160,7 @@ export async function main(argv, channel = 'current') {
   if (!app) app = currentApp() ?? bleedingEdgeApp();
   if (!existsSync(app)) fail(`no app at ${app}. Run foafnaut --install-latest.`);
   if (which) { console.log(app); return; }
-  const args = ['-n', ...(detach ? [] : ['-W']), app, '--args', ...pageArgs(page), ...(verbose ? ['--trace-input'] : []), ...extra];
+  const args = ['-n', ...(detach ? [] : ['-W']), app, '--args', ...pageArgs(page), ...(verbose ? ['--trace-input'] : []), ...app_, ...extra];
   const log = join(homedir(), 'Library', 'Logs', 'foafnaut', 'trace.jsonl');
   if (verbose) console.error(`foafnaut: app ${app}\nfoafnaut: open ${args.join(' ')}\nfoafnaut: trace ${log}`);
   // Follow only what this run appends.

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "7f617da4ecbe";
+const WASM_VERSION = "a92a94475fa0";
 
 import createModule from './l4factoidal.mjs';
 

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-31be9833264a-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/42304532396",
-  "gitSha": "31be9833264a2289526a8c9fcc1d6b67610cf746",
-  "builtAt": "2026-11-06T23:08:01Z",
+  "release": "danbri/factoidal-builds build-20ff52ea9005-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/42520417546",
+  "gitSha": "20ff52ea90050c8db7bb7135aa0c20ee118183e5",
+  "builtAt": "2026-11-08T21:35:07Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "7f617da4ecbe7352b94f361802e12bb785f401aafbf78f92b6031c8e920011f2",
-  "wasmBytes": 32611669,
+  "wasmSha256": "a92a94475fa0cfc6fe9aeb28b197e81c3c3162806ecbba562f200fbaea51416b",
+  "wasmBytes": 32702060,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"

package/lib/version.mjs

@@ -2,4 +2,4 @@
 // needs import attributes, which not every runtime this package targets
 // reads). test/dts-drift.test.js checks that it equals package.json's
 // `version`.
-export const version = '0.33.0';
+export const version = '0.34.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factoidal/core",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "EXPERIMENTAL UNDER-REVIEWED CODE: do not run public services on it without careful independent expert review. RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
   "keywords": [
     "sparql",

package/xmpp/README.md

@@ -95,6 +95,7 @@ process per connection behind socat) serves; the wasm session ops are
 | `xmppSessionFeed` | `[session, text]` | `{ ok, send: [...], route: [{to, text}], presence: [...], rostersSaved: [...], close, stage, bare, full, bufferedBytes }` |
 | `xmppSessionDeliver` | `[session, text]` | `{ ok, delivered, send }` — `delivered:false` for an unbound session; nothing is lost |
 | `xmppSessionClose` | `[session]` | `{ ok, send }` |
+| `xmppSessionPing` | `[session, id]` | `{ ok, sent, send }` — an XEP-0199 ping for a bound session; `sent:false` otherwise. On a WebSocket, `xmppWsPing` writes a ping frame instead |
 | `xmppSessionTlsUp` | `[session]` | `{ ok, stage }` — after a feed answered `startTls: true` and the host finished the TLS handshake; refused otherwise |
 | `xmppRosterGet` / `xmppRosterSet` | `[server, bare]` / `[server, bare, encoded]` | the roster in the engine's own on-disk encoding |
 | `xmppClose` | `[server]` | `{ ok, sessions }` |
@@ -135,6 +136,12 @@ Each name has its own SCRAM salt, from a seed the host gives the engine
 (`saltSeed`; derived from the state key when there is one). The native
 harness and a fixed `saltB64` keep one salt for all.
 
+A live session keeps its full JID. A client that binds a resource a live session holds gets a
+server-generated one (RFC 6120 section 7.7.2.2), so a client must use the JID in the bind result.
+A resource is free as soon as the stream that held it ends. A connection lost with no notice to the
+host stays live until the host sees that. The native harness has no shared session table and does
+not make this check.
+
 The shared engine currently reduces routed destinations to bare JIDs and
 the Node host delivers to every bound resource. It does not implement full
 resource-selection/priority semantics. Binding alone permits delivery; this
@@ -205,6 +212,7 @@ The host closes a socket when a limit is reached. These are limits on bytes and
 | `loginTimeoutMs` | `--login-timeout SECONDS` | 30 s | Time to bind a resource |
 | `maxQueuedBytes` | | 8 MiB | Bytes waiting for a client that is not reading |
 | `maxBuffered` | | 1 MiB | Bytes of an unfinished unit |
+| `proxyHeaderTimeoutMs` | | 10 s | With `proxyProtocol`: time to send the PROXY header and, on a TLS listener, to finish the TLS handshake |
 
 There is no connection limit per address: behind a proxy, every client has the same one.
 
@@ -215,6 +223,39 @@ There is no connection limit per address: behind a proxy, every client has the s
 | `heldLimits.perAccount`, `.perAccountBytes` | | 256 stanzas, 4 MiB | Held for one offline account |
 | `heldLimits.total`, `.totalBytes` | | 10,000 stanzas, 64 MiB | Held on the server |
 | `heldLimits.senderPerWindow`, `.senderWindow` | | 60 in 60 s | Stanzas one account may have held; roster writes of one account |
-| `addressLimit: false` | `--no-address-limit` | on | Failed logins per client address (5 in 60 s, 20 in an hour). Turn it off behind a proxy, where every client has one address |
+| `addressLimit: false` | `--no-address-limit` | on | Failed logins per client address (5 in 60 s, 20 in an hour). Turn it off only behind a proxy that sends no PROXY header, where every client has one address |
 
 Fixed in the engine: 5 failed logins in 60 s per account name, 3 failed attempts on a stream, 1,000 items in a roster, 64 levels and 8,192 elements in a stanza, and room nicks of at most 64 bytes.
+
+## Client addresses and the PROXY protocol
+
+The server keeps no client address. At start the host makes a random 32-byte key (`addressKey` of `xmppOpen`) that is in
+memory only and new at each start. The engine keeps, for each session, the tag HMAC-SHA-256(key, prefix), where the
+prefix is the IPv4 address or the /64 of an IPv6 address (`LoginLimit.clientPrefix`, the one place that groups addresses;
+`LoginLimit.addressTag`, theorem `addressTag_prefix`). The failed-login counters hold `address:` and the tag. A log line
+shows the first 12 hexadecimal digits of the tag (`addressTag` of `xmppSessionOpen` and `xmppWsOpen`). After a restart
+the tags change, and so do the counters, which are in memory too.
+
+`proxyProtocol: true` (`xmpp-serve --proxy-protocol`) is for a listener behind a TCP proxy that ends no TLS, such as Fly
+with `handlers = ["proxy_proto"]` and `proxy_proto_options = { version = "v2" }`. Every connection on every listener
+(the main port, `--tls-port`, `--ws-port`) must start with a PROXY protocol version 2 header (HAProxy,
+https://www.haproxy.org/download/2.9/doc/proxy-protocol.txt section 2.2), and the client address in it is the one the
+limit counts. The host buffers the first bytes and calls `proxyHeaderParse` (IN region: the bytes so far) until the
+engine decides (`L4Factoidal/Net/ProxyProtocol.lean`, `parse`):
+
+| Decision | Host |
+|---|---|
+| `more` | Waits. Theorem `parse_more_bounded`: only while fewer than 1,040 bytes are held. `proxyHeaderTimeoutMs` closes a connection that never completes a header |
+| `refuse`, with `reason` `signature`, `version`, `command`, `family` or `length` | Closes the connection. No XMPP and no TLS byte is read. A connection that starts with anything else (an XMPP stream header, a TLS ClientHello) is refused at its first byte |
+| `local` | A connection the proxy made itself (a health check). Spec: the receiver uses the real endpoints, so the address is the socket's |
+| `proxy`, with `address` and `port` | The address goes to the session as `remoteAddress` |
+
+The bytes after the header, in the same read, go to TLS or to the XMPP session (theorems `parse_proxy_le`,
+`parse_local_le`). PROXY is accepted for TCP over IPv4 (`0x11`) and IPv6 (`0x21`) only; UNSPEC, UNIX and UDP name no
+client address for the limit and are refused. TLVs are skipped. A length field above 1,024 is refused. An IPv4-mapped IPv6
+source is counted as its IPv4 address. Version 1 (the text form) is not read: Fly sends version 2 when asked, and a second
+parser would only be one more input path.
+
+Without `proxyProtocol` no header is read, so no client can claim an address; the socket's address is tagged the same way.
+`proxyProtocol` on a listener that is reachable without the proxy lets a client choose its address for the limit: use it
+only where every connection comes through the proxy.

package/xmpp/server.mjs

@@ -37,12 +37,25 @@
 // server-to-server federation, and any limit on how many bytes
 // a client may send without completing a unit beyond `maxBuffered`,
 // which is a transport limit this host applies by closing the socket.
-// The other transport limits are `maxConnections`, `loginTimeoutMs` and
-// `maxQueuedBytes`. There is no connection limit per address: behind a
+// The other transport limits are `maxConnections`, `loginTimeoutMs`,
+// `maxQueuedBytes`, and `pingIntervalMs` with `pingTimeoutMs`: a bound session
+// silent for the interval gets a ping from the engine (`xmppSessionPing`, or
+// `xmppWsPing` on a WebSocket), and one that sends no byte in the timeout after
+// that is closed. There is no connection limit per address: behind a
 // proxy, every client has the same one.
+//
+// Client addresses (the failed-login limit): the engine keeps a tag of each,
+// HMAC-SHA-256 under `addressKey`, a random key made here at start and kept in
+// memory only (`L4Factoidal/Net/LoginLimit.lean`, `addressTag`). Logs show the
+// first 12 digits of the tag, never the address. With `proxyProtocol` each
+// connection must start with a PROXY protocol v2 header, which names the client
+// behind a proxy; the engine decides on it (`proxyHeaderParse`,
+// `L4Factoidal/Net/ProxyProtocol.lean`) and this file only buffers the bytes,
+// then hands what follows the header to TLS or to the XMPP session.
 
 import { createHash, randomBytes } from 'node:crypto'
 import { StringDecoder } from 'node:string_decoder'
+import { Duplex } from 'node:stream'
 import { mkdir, readFile, writeFile, readdir, unlink, rename, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { loadEngine } from '../bin/engine.mjs'
@@ -51,7 +64,7 @@ import { createXmppRouter } from './router.mjs'
 /** The ops this host needs from the engine. */
 export const XMPP_SERVER_OPS = [
   'xmppOpen', 'xmppClose',
-  'xmppSessionOpen', 'xmppSessionFeed', 'xmppSessionDeliver', 'xmppSessionClose',
+  'xmppSessionOpen', 'xmppSessionFeed', 'xmppSessionDeliver', 'xmppSessionPing', 'xmppSessionClose',
   'xmppSessionTlsUp', 'xmppRosterGet', 'xmppRosterSet', 'xmppWsOpen', 'xmppStateLoad', 'xmppClock'
 ]
 
@@ -154,6 +167,9 @@ export async function openXmppServer (options = {}) {
   if (typeof options.mucDomain === 'string') config.mucDomain = options.mucDomain
   // Members-only rooms: [{room, members: [bare JID]}]; no list, an open room.
   if (Array.isArray(options.mucMembers)) config.mucMembers = options.mucMembers
+  // Owners: [{room, owners: [bare JID]}], room '*' for every room. Present, also empty: nobody
+  // becomes an owner by being first in a room. Absent: the first occupant is the owner.
+  if (Array.isArray(options.mucOwners)) config.mucOwners = options.mucOwners
   // Nicks reserved for a JID: [{nick, jid}]. Each account's name is reserved for it anyway.
   if (Array.isArray(options.mucReservedNicks)) config.mucReservedNicks = options.mucReservedNicks
   // XEP-0369 channels (L4Factoidal/XMPP/Mix.lean), joined through MIX-PAM; off unless named.
@@ -167,6 +183,9 @@ export async function openXmppServer (options = {}) {
   // (https://github.com/danbri/factoidal/issues/1128); the engine decides.
   if (options.disableRateLimits === true) config.disableRateLimits = true
   if (options.heldLimits && typeof options.heldLimits === 'object') config.heldLimits = options.heldLimits
+  // The key of the client address tags: random, in memory only, new at each start.
+  // A tag is no use to anyone who does not hold it, so it never goes to a log or a file.
+  config.addressKey = typeof options.addressKey === 'string' ? options.addressKey : randomToken(32)
   let opened
   try {
     opened = engine.call('xmppOpen', [JSON.stringify(config)])
@@ -200,6 +219,11 @@ export async function openXmppServer (options = {}) {
     engine.call('xmppClose', [handle])
     throw new XmppHostError('this engine does not carry members-only rooms; rebuild the engine')
   }
+  // The same for owners: an older engine would make the first occupant the owner.
+  if (Array.isArray(options.mucOwners) && opened.mucOwners !== options.mucOwners.length) {
+    engine.call('xmppClose', [handle])
+    throw new XmppHostError('this engine does not carry configured room owners; rebuild the engine')
+  }
   return {
     engine,
     handle,
@@ -230,6 +254,8 @@ export async function openXmppServer (options = {}) {
       let open = true
       return {
         handle: session,
+        /** The first digits of the client's address tag, for a log line ('' for no address). */
+        addressTag: typeof answer.addressTag === 'string' ? answer.addressTag : '',
         /** Feed received text; returns the engine's answer document. */
         feed (text) {
           tick()
@@ -243,6 +269,10 @@ export async function openXmppServer (options = {}) {
         deliver (text) {
           return engine.call('xmppSessionDeliver', [session, text])
         },
+        /** This session has been silent: `{sent, send}`, an XEP-0199 ping when it is bound. */
+        ping (id) {
+          return engine.call('xmppSessionPing', [session, id])
+        },
         /** End of input: returns `{send: string[]}` and releases the handle. */
         close () {
           if (!open) return { send: [], routeFull: [] }
@@ -315,8 +345,18 @@ async function accountsFileWarnings (path) {
  *   without a bound resource before it is closed (default 30000; 0 disables)
  * @param {number} [options.maxQueuedBytes] bytes waiting to be written to a
  *   client that is not reading, before the socket is closed (default 8 MiB)
- * @param {boolean} [options.addressLimit] false: count failed logins per account name only, for a
- *   listener behind a proxy, where every client has one address (default true)
+ * @param {number} [options.pingIntervalMs] how long a bound session may be silent before it
+ *   gets a ping (default 30000; 0 disables pings and the timeout)
+ * @param {number} [options.pingTimeoutMs] how long after a ping a session that sends
+ *   no byte is closed, so that its resource is free again (default 20000)
+ * @param {boolean} [options.addressLimit] false: count failed logins per account name only
+ *   (default true). Behind a proxy that sends no PROXY header every client has the proxy's address
+ * @param {boolean} [options.proxyProtocol] every connection, on every listener, starts with a
+ *   PROXY protocol v2 header, read before TLS; the client address it names is the one the
+ *   failed-login limit counts. A connection without a valid header is closed. Without this option no
+ *   header is ever read, so a client cannot claim an address (default false)
+ * @param {number} [options.proxyHeaderTimeoutMs] with `proxyProtocol`, how long a connection has to
+ *   send its header and, on a TLS listener, finish the TLS handshake (default 10000)
  * @param {Function} [options.onError]
  * @param {Function} [options.onLog]
  * @returns {Promise<{server: object, xmpp: object, close: Function, sessions: Function}>}
@@ -337,6 +377,11 @@ export async function createXmppServer (options = {}) {
   const maxConnections = limit('maxConnections', 1024)
   const loginTimeoutMs = limit('loginTimeoutMs', 30000)
   const maxQueuedBytes = limit('maxQueuedBytes', 8 * 1024 * 1024)
+  const pingIntervalMs = limit('pingIntervalMs', 30000)
+  const pingTimeoutMs = limit('pingTimeoutMs', 20000)
+  const proxyProtocol = options.proxyProtocol === true
+  const proxyHeaderTimeoutMs = limit('proxyHeaderTimeoutMs', 10000)
+  if (pingIntervalMs > 0 && pingTimeoutMs === 0) throw new XmppHostError('pingTimeoutMs must be positive when pings are on')
   if (!Number.isSafeInteger(maxBuffered) || maxBuffered < 0) {
     throw new XmppHostError('maxBuffered must be a nonnegative safe integer')
   }
@@ -369,6 +414,17 @@ export async function createXmppServer (options = {}) {
   if (dir !== null && options.stateKey !== undefined) serverOptions.persist = true
   const xmpp = await openXmppServer(serverOptions)
   if (accountsFile !== null) xmpp.warnings.push(...await accountsFileWarnings(accountsFile))
+  if (proxyProtocol) {
+    try {
+      xmpp.engine.callBlobIO('proxyHeaderParse', [], new Uint8Array(0))
+    } catch (error) {
+      xmpp.close()
+      if (isUnknownOp(error)) {
+        throw new XmppHostError('the loaded l4factoidal WebAssembly module does not carry proxyHeaderParse', { unknownOp: true })
+      }
+      throw error
+    }
+  }
 
   // Rosters the previous run persisted.
   try {
@@ -415,7 +471,7 @@ export async function createXmppServer (options = {}) {
           '  acl:mode acl:Read, acl:Write, acl:Control .\n'
       })
       const get = (target, accept) => state.step({ method: 'GET', target, headers: accept ? [['Accept', accept]] : [], body: new Uint8Array(0) })
-      for (const kind of ['roster', 'held', 'mix', 'gc3']) {
+      for (const kind of ['roster', 'held', 'mix', 'gc3', 'muc']) {
         const listing = await get(`/xmpp/${kind}/`, 'application/lws+json')
         if (listing.status === 404) continue
         if (listing.status !== 200) throw new XmppHostError(`state: listing /xmpp/${kind}/ answered ${listing.status}`)
@@ -478,10 +534,95 @@ export async function createXmppServer (options = {}) {
   // connection callback and therefore have no engine session yet.
   const transports = new Set()
 
-  // The client's address for the login limit. Behind a proxy every client has
-  // the proxy's address, and a limit on it would stop them all: `addressLimit: false`.
-  const addressOf = (socket) =>
-    options.addressLimit !== false && typeof socket.remoteAddress === 'string' ? socket.remoteAddress : ''
+  // The client's address for the login limit: the socket's, or the one a PROXY
+  // header named. The engine keeps only its tag. `addressLimit: false` gives none.
+  const addressOf = (address) =>
+    options.addressLimit !== false && typeof address === 'string' ? address : ''
+
+  /** With `proxyProtocol`: buffer a new connection's bytes until the engine
+   *  decides on its PROXY v2 header, then `then(address, rest)` with the client
+   *  address and the bytes after the header. A refused header, or none in
+   *  `proxyHeaderTimeoutMs`, closes the connection. */
+  function readProxyHeader (socket, then) {
+    let buffered = Buffer.alloc(0)
+    const timer = setTimeout(() => {
+      onLog('closing a connection that sent no PROXY header in time')
+      finish()
+      socket.destroy()
+    }, proxyHeaderTimeoutMs)
+    timer.unref()
+    const finish = () => {
+      clearTimeout(timer)
+      socket.removeListener('data', onData)
+      socket.removeListener('error', onSocketError)
+    }
+    const onSocketError = () => { finish(); socket.destroy() }
+    const onData = (chunk) => {
+      buffered = buffered.length === 0 ? chunk : Buffer.concat([buffered, chunk])
+      let decision
+      try {
+        decision = xmpp.engine.callBlobIO('proxyHeaderParse', [],
+          new Uint8Array(buffered.buffer, buffered.byteOffset, buffered.byteLength)).envelope
+      } catch (error) {
+        onError(error)
+        finish()
+        socket.destroy()
+        return
+      }
+      if (decision.decision === 'more') return
+      finish()
+      if ((decision.decision !== 'proxy' && decision.decision !== 'local') ||
+          !Number.isSafeInteger(decision.consumed) || decision.consumed > buffered.length) {
+        onLog(`closing a connection: PROXY header refused (${decision.reason || decision.error || 'no decision'})`)
+        socket.destroy()
+        return
+      }
+      // LOCAL: the proxy's own connection (a health check); its address is the socket's.
+      const address = decision.decision === 'proxy' ? decision.address : socket.remoteAddress
+      then(address, buffered.subarray(decision.consumed))
+    }
+    socket.on('data', onData)
+    socket.on('error', onSocketError)
+  }
+
+  /** A stream that yields `head` and then what `socket` reads, and writes to
+   *  `socket`: TLS over a connection whose first bytes were a PROXY header. */
+  function prefixed (socket, head) {
+    const stream = new Duplex({
+      read () { socket.resume() },
+      write (chunk, _encoding, callback) { socket.write(chunk, callback) },
+      final (callback) { socket.end(); callback() },
+      destroy (error, callback) { socket.destroy(); callback(error) }
+    })
+    if (head.length > 0) stream.push(head)
+    socket.on('data', (chunk) => { if (!stream.push(chunk)) socket.pause() })
+    socket.on('end', () => stream.push(null))
+    socket.on('error', (error) => stream.destroy(error))
+    socket.on('close', () => stream.destroy())
+    return stream
+  }
+
+  /** With `proxyProtocol`, a TLS listener is a TCP listener: read the header,
+   *  then be the TLS server over the rest, within `proxyHeaderTimeoutMs`. */
+  function acceptTls (tls, socket, tlsOptions, then) {
+    readProxyHeader(socket, (address, rest) => {
+      const secure = new tls.TLSSocket(prefixed(socket, rest), { isServer: true, ...tlsOptions })
+      const timer = setTimeout(() => { secure.destroy(); socket.destroy() }, proxyHeaderTimeoutMs)
+      timer.unref()
+      const onHandshakeError = (error) => {
+        clearTimeout(timer)
+        if (error && error.code !== 'ECONNRESET') onError(new XmppHostError(`TLS handshake: ${error.message}`))
+        secure.destroy()
+        socket.destroy()
+      }
+      secure.once('error', onHandshakeError)
+      secure.once('secure', () => {
+        clearTimeout(timer)
+        secure.removeListener('error', onHandshakeError)
+        then(secure, address)
+      })
+    })
+  }
 
   // Transport limits, like `maxBuffered`: bytes and time, not protocol.
   function closeIfBacklogged (c) {
@@ -507,6 +648,35 @@ export async function createXmppServer (options = {}) {
     c.loginTimer.unref()
   }
 
+  /** Any byte from a peer shows it is alive, whatever the byte says. */
+  function heard (c) {
+    c.lastHeard = Date.now()
+    c.pingedAt = 0
+  }
+
+  /** Ping the bound sessions that have been silent, and close the ones that stayed silent.
+   *  A dead TCP connection sends no FIN, so without this it holds its resource for as long as
+   *  the operating system keeps retrying. */
+  function checkSilence () {
+    const now = Date.now()
+    for (const c of connections) {
+      if (c.full === null || c.closing || c.upgrading) continue
+      if (c.pingedAt !== 0) {
+        if (now - c.pingedAt >= pingTimeoutMs) {
+          onLog(`closing ${c.full}: no answer to a ping`)
+          c.socket.destroy()
+        }
+      } else if (now - c.lastHeard >= pingIntervalMs) {
+        c.pingedAt = now
+        try { c.ping() } catch (error) { onError(error) }
+      }
+    }
+  }
+  const pinger = pingIntervalMs > 0
+    ? setInterval(checkSilence, Math.ceil(Math.min(pingIntervalMs, pingTimeoutMs, 10000) / 2))
+    : null
+  if (pinger !== null) pinger.unref()
+
   /** Count a new socket, or close it at once if the server is full. */
   function admit (socket) {
     if (transports.size >= maxConnections) {
@@ -612,10 +782,10 @@ export async function createXmppServer (options = {}) {
     }
   }
 
-  function onConnection (socket, direct = false) {
+  function onConnection (socket, direct = false, address = socket.remoteAddress, rest = null) {
     let session
     try {
-      session = xmpp.openSession({ tlsCarrier: useTls || direct, startTls: startTls && !direct, remoteAddress: addressOf(socket) })
+      session = xmpp.openSession({ tlsCarrier: useTls || direct, startTls: startTls && !direct, remoteAddress: addressOf(address) })
     } catch (error) {
       onError(error)
       socket.destroy()
@@ -628,16 +798,25 @@ export async function createXmppServer (options = {}) {
       full: null,
       closing: false,
       decoder: new StringDecoder('utf8'),
+      lastHeard: Date.now(),
+      pingedAt: 0,
+      pings: 0,
       deliver (text) {
         const answer = c.session.deliver(text)
         if (answer.delivered === true) { writeAll(c, answer.send); return true }
         return false
+      },
+      ping () {
+        const answer = c.session.ping(`ping-${++c.pings}`)
+        if (answer.sent === true) writeAll(c, answer.send)
       }
     }
     connections.add(c)
     startLoginTimer(c)
-    onLog(`connection from ${socket.remoteAddress}:${socket.remotePort}`)
+    // The tag's first digits, never the address (the tag's key is in memory only).
+    onLog(`connection from ${session.addressTag === '' ? 'no address' : 'address ' + session.addressTag}`)
     c.onData = (chunk) => {
+      heard(c)
       if (!connections.has(c) || c.closing || c.upgrading) return
       const text = c.decoder.write(chunk)
       if (text.length === 0) return
@@ -669,6 +848,8 @@ export async function createXmppServer (options = {}) {
       if (error && error.code !== 'ECONNRESET') onError(error)
       endSession(c)
     })
+    // The bytes that came in one read with a PROXY header.
+    if (rest !== null && rest.length > 0) c.onData(rest)
   }
 
   // XMPP over WebSocket (RFC 7395): every byte goes to xmppWsFeed, which
@@ -679,17 +860,19 @@ export async function createXmppServer (options = {}) {
     const got = xmpp.engine.callBlobIO(op, args, bytes)
     return { envelope: got.envelope, bytes: got.bytes instanceof Uint8Array ? got.bytes : new Uint8Array(0) }
   }
-  function onWsConnection (socket) {
+  function onWsConnection (socket, address = socket.remoteAddress, rest = null) {
     let handle
+    let tag = ''
     try {
       const opened = xmpp.engine.call('xmppWsOpen', [xmpp.handle, JSON.stringify({
-        streamId: randomToken(), nonce: randomToken(), remoteAddress: addressOf(socket),
+        streamId: randomToken(), nonce: randomToken(), remoteAddress: addressOf(address),
         path: typeof ws.path === 'string' ? ws.path : '/xmpp-websocket',
         allowedOrigins: Array.isArray(ws.allowedOrigins) ? ws.allowedOrigins : [],
         allowNoOrigin: ws.allowNoOrigin === true,
         tlsCarrier: ws.cert !== undefined && ws.key !== undefined
       })])
       handle = opened.handle
+      if (typeof opened.addressTag === 'string') tag = opened.addressTag
     } catch (error) {
       onError(error)
       socket.destroy()
@@ -700,6 +883,8 @@ export async function createXmppServer (options = {}) {
       bare: null,
       full: null,
       closing: false,
+      lastHeard: Date.now(),
+      pingedAt: 0,
       session: {
         close () {
           try {
@@ -712,11 +897,17 @@ export async function createXmppServer (options = {}) {
         const got = wsCall('xmppWsDeliver', [handle, text], new Uint8Array(0))
         if (got.envelope.delivered === true) { if (!socket.destroyed) socket.write(got.bytes); closeIfBacklogged(c); return true }
         return false
+      },
+      ping () {
+        const got = wsCall('xmppWsPing', [handle], new Uint8Array(0))
+        if (got.envelope.sent === true && !socket.destroyed) { socket.write(got.bytes); closeIfBacklogged(c) }
       }
     }
     connections.add(c)
     startLoginTimer(c)
-    socket.on('data', (chunk) => {
+    onLog(`WebSocket connection from ${tag === '' ? 'no address' : 'address ' + tag}`)
+    const onData = (chunk) => {
+      heard(c)
       if (!connections.has(c) || c.closing) return
       let got
       try {
@@ -735,13 +926,16 @@ export async function createXmppServer (options = {}) {
         socket.destroy()
         endSession(c)
       }
-    })
+    }
+    socket.on('data', onData)
     socket.on('end', () => endSession(c))
     socket.on('close', () => endSession(c))
     socket.on('error', (error) => {
       if (error && error.code !== 'ECONNRESET') onError(error)
       endSession(c)
     })
+    // The bytes that came in one read with a PROXY header.
+    if (rest !== null && rest.length > 0) onData(rest)
   }
   let wsServer = null
   if (ws !== null) {
@@ -749,19 +943,34 @@ export async function createXmppServer (options = {}) {
       xmpp.close()
       throw new XmppHostError('the WebSocket listener needs both cert and key for TLS')
     }
-    if (ws.cert !== undefined) {
+    if (proxyProtocol) {
+      const net = await import('node:net')
+      const tls = ws.cert !== undefined ? await import('node:tls') : null
+      wsServer = net.createServer((socket) => {
+        if (tls === null) readProxyHeader(socket, (address, rest) => onWsConnection(socket, address, rest))
+        else acceptTls(tls, socket, { cert: ws.cert, key: ws.key }, (secure, address) => onWsConnection(secure, address))
+      })
+    } else if (ws.cert !== undefined) {
       const tls = await import('node:tls')
-      wsServer = tls.createServer({ cert: ws.cert, key: ws.key }, onWsConnection)
+      wsServer = tls.createServer({ cert: ws.cert, key: ws.key }, (socket) => onWsConnection(socket))
     } else {
       const net = await import('node:net')
-      wsServer = net.createServer(onWsConnection)
+      wsServer = net.createServer((socket) => onWsConnection(socket))
     }
     wsServer.on('connection', admit)
   }
 
   let server
   try {
-    if (useTls) {
+    if (proxyProtocol) {
+      // Every listener is TCP: the header comes before TLS.
+      const net = await import('node:net')
+      const tls = useTls ? await import('node:tls') : null
+      server = net.createServer((socket) => {
+        if (tls === null) readProxyHeader(socket, (address, rest) => onConnection(socket, false, address, rest))
+        else acceptTls(tls, socket, { cert: options.cert, key: options.key }, (secure, address) => onConnection(secure, false, address))
+      })
+    } else if (useTls) {
       const tls = await import('node:tls')
       server = tls.createServer({ cert: options.cert, key: options.key }, (socket) => onConnection(socket))
     } else {
@@ -779,7 +988,13 @@ export async function createXmppServer (options = {}) {
   let directServer = null
   if (startTls && options.directTlsPort !== undefined) {
     const tls = await import('node:tls')
-    directServer = tls.createServer({ cert: options.cert, key: options.key }, (socket) => onConnection(socket, true))
+    if (proxyProtocol) {
+      const net = await import('node:net')
+      directServer = net.createServer((socket) =>
+        acceptTls(tls, socket, { cert: options.cert, key: options.key }, (secure, address) => onConnection(secure, true, address)))
+    } else {
+      directServer = tls.createServer({ cert: options.cert, key: options.key }, (socket) => onConnection(socket, true))
+    }
     directServer.on('connection', admit)
   }
 
@@ -843,6 +1058,7 @@ export async function createXmppServer (options = {}) {
       if (closePromise !== null) return closePromise
       closePromise = (async () => {
         if (poller !== null) clearInterval(poller)
+        if (pinger !== null) clearInterval(pinger)
         for (const c of Array.from(connections)) {
           endSession(c)
           c.socket.destroy()