--- a/CHANGES	Thu Feb 10 15:49:01 2022 +0000
+++ b/CHANGES	Sat Dec 25 16:23:40 2021 +0100
@@ -33,6 +33,7 @@
 -   Pluggable authorization providers (mod_authz_)
 -   Easy use of Mozilla TLS recommendations presets
 -   Unencrypted HTTP port (5280) restricted to loopback by default
+-   require_encryption options default to 'true' if unspecified
 
 ### HTTP
 

--- a/plugins/mod_register_ibr.lua	Thu Feb 10 15:49:01 2022 +0000
+++ b/plugins/mod_register_ibr.lua	Sat Dec 25 16:23:40 2021 +0100
@@ -18,7 +18,7 @@
 
 local additional_fields = module:get_option("additional_registration_fields", {});
 local require_encryption = module:get_option_boolean("c2s_require_encryption",
-	module:get_option_boolean("require_encryption", false));
+	module:get_option_boolean("require_encryption", true));
 
 pcall(function ()
 	module:depends("register_limits");

--- a/plugins/mod_s2s.lua	Thu Feb 10 15:49:01 2022 +0000
+++ b/plugins/mod_s2s.lua	Sat Dec 25 16:23:40 2021 +0100
@@ -40,7 +40,7 @@
 local secure_auth = module:get_option_boolean("s2s_secure_auth", false); -- One day...
 local secure_domains, insecure_domains =
 	module:get_option_set("s2s_secure_domains", {})._items, module:get_option_set("s2s_insecure_domains", {})._items;
-local require_encryption = module:get_option_boolean("s2s_require_encryption", false);
+local require_encryption = module:get_option_boolean("s2s_require_encryption", true);
 local stanza_size_limit = module:get_option_number("s2s_stanza_size_limit", 1024*512);
 
 local measure_connections_inbound = module:metric(

--- a/plugins/mod_s2s_bidi.lua	Thu Feb 10 15:49:01 2022 +0000
+++ b/plugins/mod_s2s_bidi.lua	Sat Dec 25 16:23:40 2021 +0100
@@ -10,7 +10,7 @@
 local xmlns_bidi_feature = "urn:xmpp:features:bidi"
 local xmlns_bidi = "urn:xmpp:bidi";
 
-local require_encryption = module:get_option_boolean("s2s_require_encryption", false);
+local require_encryption = module:get_option_boolean("s2s_require_encryption", true);
 
 module:hook("s2s-stream-features", function(event)
 	local origin, features = event.origin, event.features;

--- a/plugins/mod_saslauth.lua	Thu Feb 10 15:49:01 2022 +0000
+++ b/plugins/mod_saslauth.lua	Sat Dec 25 16:23:40 2021 +0100
@@ -17,7 +17,7 @@
 
 local usermanager_get_sasl_handler = require "core.usermanager".get_sasl_handler;
 
-local secure_auth_only = module:get_option_boolean("c2s_require_encryption", module:get_option_boolean("require_encryption", false));
+local secure_auth_only = module:get_option_boolean("c2s_require_encryption", module:get_option_boolean("require_encryption", true));
 local allow_unencrypted_plain_auth = module:get_option_boolean("allow_unencrypted_plain_auth", false)
 local insecure_mechanisms = module:get_option_set("insecure_sasl_mechanisms", allow_unencrypted_plain_auth and {} or {"PLAIN", "LOGIN"});
 local disabled_mechanisms = module:get_option_set("disable_sasl_mechanisms", { "DIGEST-MD5" });

--- a/plugins/mod_tls.lua	Thu Feb 10 15:49:01 2022 +0000
+++ b/plugins/mod_tls.lua	Sat Dec 25 16:23:40 2021 +0100
@@ -10,8 +10,8 @@
 local rawgetopt = require"core.configmanager".rawget;
 local st = require "util.stanza";
 
-local c2s_require_encryption = module:get_option("c2s_require_encryption", module:get_option("require_encryption"));
-local s2s_require_encryption = module:get_option("s2s_require_encryption");
+local c2s_require_encryption = module:get_option("c2s_require_encryption", module:get_option("require_encryption", true));
+local s2s_require_encryption = module:get_option("s2s_require_encryption", true);
 local allow_s2s_tls = module:get_option("s2s_allow_encryption") ~= false;
 local s2s_secure_auth = module:get_option("s2s_secure_auth");