Merge pull request 'Allow to install murmur server' (#2) from 1-install-murmur-server into master

Reviewed-on: #2
master
HgO 2020-12-06 19:43:29 +01:00
commit 00c6bfd41a
35 changed files with 1520 additions and 42 deletions

3
.gitignore vendored 100644
View File

@ -0,0 +1,3 @@
.venv
.vscode
.gitignore

View File

@ -1,4 +1,107 @@
umurmur_user_password: ""
acme_enabled: yes
acme_domains:
- "{{ umurmur_domain }}"
- "{{ mumble_web_domain }}"
mumble_web_enabled: yes
mumble_web_domain: "{{ inventory_hostname }}.local"
mumble_web_owner: mumble-web
mumble_web_group: "{{ mumble_web_owner }}"
mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/{{ acme_enabled | ternary('fullchain','cert') }}.pem"
mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem"
mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.pem"
mumble_web_www_dir: /var/www/mumble-web
mumble_web_version: master
mumble_web_websockify_port: "64737"
mumble_web_nginx_enabled: yes
mumble_web_nginx_config_dir: /etc/nginx
mumble_web_nginx_generate_dhparam: yes
mumble_web_nginx_dhparam: "{{ mumble_web_nginx_config_dir }}/ssl/dhparam.pem"
mumble_web_nginx_dhparam_size: 2048
murmur_enabled: yes
murmur_domain: "{{ mumble_web_domain }}"
murmur_superuser_password: supersecret
murmur_database:
path: "/var/lib/mumble-server/mumble-server.sqlite"
# driver: "QMYSQL"
# username: "mumble"
# password: "password"
# host: "localhost"
# port: 3306
# prefix: "murmur_"
murmur_ice_host: "127.0.0.1"
murmur_ice_port: 6502
# Give read permission on ICE connection. Empty secret will deny read permission to anybody.
murmur_ice_secret_read: "{{ lookup('password', '/tmp/murmur-ice-read.secret length=50') }}"
# Give write permission on ICE connection. Empty secret will deny write permission to anybody.
murmur_ice_secret_write: "{{ lookup('password', '/tmp/murmur-ice-write.secret length=50') }}"
murmur_autoban_attempts: 10
murmur_autoban_timeframe: 120
murmur_autoban_time: 300
murmur_log_file: "/var/log/mumble-server/mumble-server.log"
murmur_pid_file: "/var/run/mumble-server/mumble-server.pid"
murmur_welcome_text: "Welcome on the {{ inventory_hostname }} Mumble server!"
# Leave blank to let Murmur bind to all available addresses
murmur_host: ""
murmur_port: 64738
# Password to join the server
murmur_server_password: ""
murmur_max_bandwidth: 72000
murmur_max_users: 100
murmur_opus_threshold: 100
murmur_channel_nesting_limit: 10
murmur_channel_count_limit: 1000
# Regex to validate channel or usernames
# murmur_channel_name_regex: ""
# murmur_username_regex: ""
murmur_text_message_max_length: 5000
murmur_image_message_max_length: 131072
murmur_allow_html: yes
# Set to 0 to keep logs forever, or -1 to disable logging to the DB.
murmur_log_days: -1
# Name for root channel and entry in mumble main server list
murmur_register_enabled: no
murmur_register:
name: "MyMumbleServerRegisterName"
password: "password"
url: "https://mymumbleserverurl.org"
hostname: "mymumblehostname.domain.org"
# Enable Bonjour for dev purpose
murmur_bonjour_enabled: no
murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/chain.pem"
murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domain }}.pem"
murmur_dhparam: "@ffdhe4096"
murmur_owner: "mumble-server"
murmur_group: "{{ murmur_owner }}"
murmur_client_certificate_required: no
murmur_send_server_version: yes
murmur_ice_warn_unknown_properties: yes
murmur_ice_message_size_max: 65536
umurmur_enabled: yes
umurmur_domain: "{{ mumble_web_domain }}"
umurmur_max_bandwidth: 48000
umurmur_max_users: 100
umurmur_server_password: ""
umurmur_channels:
- name: Root
description: Root channel. No entry.
noenter: yes
- name: Welcome
parent: Root
description: Welcome channel
position: 0
- name: Silent
parent: Root
description: Silent channel
silent: yes
position: 1
umurmur_default_channel: Welcome
umurmur_welcome_text: "Welcome on the {{ inventory_hostname }} Mumble server!"
umurmur_channel_links:
- source: "{{ umurmur_default_channel }}"
destinations: >-
@ -9,18 +112,7 @@ umurmur_channel_links:
| list
}}
umurmur_ssl_group: "{{ acme_ssl_group }}"
umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/fullchain.pem"
umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
umurmur_private_key: "{{ acme_keys_dir }}/{{ umurmur_domain }}.pem"
umurmur_version: master
umurmur_ispublic: yes
umurmur_port: "64738"
mumble_web_owner: mumble-web
mumble_web_group: "{{ mumble_web_owner }}"
mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/fullchain.pem"
mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem"
mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.pem"
mumble_web_dhparam: "/etc/nginx/ssl/dhparam.pem"
mumble_web_www_dir: /var/www/mumble-web
mumble_web_version: master
mumble_web_websockify_port: "64737"
umurmur_port: 64738

View File

@ -0,0 +1,42 @@
channels:
- name: Root
description: Root channel. No entry.
groups:
admin:
inherit: true
inheritable: true
permissions:
- group: all
deny:
- Enter
recursive: false
enabled: true
- group: all
allow:
- RegisterSelf
- MakeTempChannel
- group: admin
allow:
- MuteDeafen
- Move
- Kick
- Ban
- Register
- name: Welcome
parent: Root
description: Welcome channel
position: 0
isdefault: true
- name: Silent
parent: Root
description: Silent channel
position: 1
permissions:
- group: all
deny:
- Speak
- MakeTempChannel
enabled: true
- group: admin
allow:
- MakeTempChannel

View File

@ -0,0 +1,345 @@
#!/usr/bin/python3
import argparse
import logging
import os
import sys
from typing import List, Dict
import Ice
import yaml
import Murmur
CONFIG_SEARCH_PATH = [".", "/etc"]
CONFIG_DEFAULT_NAME = "mice.yml"
ICE_DEFAULT_HOST = "127.0.0.1"
ICE_DEFAULT_PORT = 6502
ICE_DEFAULT_TIMEOUT = 1000
class Mice:
def __init__(self, host: str = ICE_DEFAULT_HOST,
port: int = ICE_DEFAULT_PORT, secret: str = None,
timeout: int = ICE_DEFAULT_TIMEOUT):
logging.debug("Initializing ICE connection")
properties = Ice.createProperties()
properties.setProperty("Ice.ImplicitContext", "Shared")
init_data = Ice.InitializationData()
init_data.properties = properties
self._communicator = Ice.initialize(init_data)
if secret:
logging.debug("Providing ICE secret")
self._communicator.getImplicitContext().put("secret", secret)
logging.debug("Creating meta proxy")
proxy_str = f"Meta: tcp -h {host} -p {port} -t {timeout}"
proxy = self._communicator.stringToProxy(proxy_str)
self.meta = Murmur.MetaPrx.checkedCast(proxy)
if not self.meta:
self._communicator.destroy()
raise RuntimeError(f"Invalid Proxy: {proxy_str}")
try:
logging.debug("Retrieving the list of Mumble servers")
servers = self.meta.getAllServers()
except Murmur.InvalidSecretException:
self._communicator.destroy()
raise RuntimeError(f"Failed to connect to {host} "
f"on port {port}: Invalid secret.") from None
self.servers = [MurmurServer(server) for server in servers]
if len(self.servers) == 0:
self._communicator.destroy()
raise RuntimeError("No Mumble server found")
def __enter__(self):
return self
def __exit__(self, exc_type, exc_value, traceback):
self._communicator.destroy()
class ChannelGroup:
def __init__(self, name: str, inherit: bool = True,
inheritable: bool = True):
self.name = name
self.inherit = inherit
self.inheritable = inheritable
def get_state(self) -> Murmur.Group:
return Murmur.Group(
name=self.name,
inherit=self.inherit,
inheritable=self.inheritable
)
@staticmethod
def from_dict(group_dict: Dict[str, object]) -> "ChannelGroup":
return ChannelGroup(
name=group_dict["name"],
inherit=group_dict.get("inherit", True),
inheritable=group_dict.get("inheritable", True)
)
class ChannelPermission:
def __init__(self, group: str = "all", userid: int = -1,
allow: int = 0, deny: int = 0,
recursive: bool = True, enabled: bool = True):
self.group = group
self.userid = userid
self.allow = allow
self.deny = deny
self.recursive = recursive
self.enabled = enabled
def get_acl(self) -> Murmur.ACL:
return Murmur.ACL(
applyHere=self.enabled,
applySubs=self.recursive,
userid=self.userid,
group=self.group,
allow=self.allow,
deny=self.deny)
@staticmethod
def from_dict(permission_dict: Dict[str, object]) -> "ChannelPermission":
allow = ChannelPermission._parse_rules(
permission_dict.get("allow", []))
deny = ChannelPermission._parse_rules(
permission_dict.get("deny", []))
return ChannelPermission(
group=permission_dict["group"],
allow=allow,
deny=deny,
recursive=permission_dict.get("recursive", True),
enabled=permission_dict.get("enabled", True))
@staticmethod
def _parse_rule(rule: str) -> int:
return getattr(Murmur, "Permission" + rule)
@staticmethod
def _parse_rules(rules: List[str]) -> int:
result = 0
for rule in rules:
result |= ChannelPermission._parse_rule(rule)
return result
class Channel:
def __init__(self, name: str, description: str = "", position: int = 0,
groups: List[ChannelGroup] = [],
permissions: List[ChannelPermission] = [],
inherit: bool = True, isdefault: bool = False,
parent: "Channel" = None):
self.id = -1
self.name = name
self.description = description
self.position = position
self.groups = groups
self.permissions = permissions
self.inherit = inherit
self.isdefault = isdefault
self.parent = parent
self.children = []
def __str__(self) -> str:
return self.name
def get_state(self) -> Murmur.Channel:
if self.parent is None:
parent_id = 0
else:
parent_id = self.parent.id
return Murmur.Channel(
id=self.id,
name=self.name,
description=self.description,
position=self.position,
parent=parent_id)
def add(self, channel: "Channel") -> None:
self.children.append(channel)
channel.parent = self
@staticmethod
def from_dict(channel_dict: Dict[str, object]) -> "Channel":
if "parent" in channel_dict:
parent = Channel(channel_dict["parent"])
else:
parent = None
groups = []
for group_name, group_dict in channel_dict.get("groups", {}).items():
group_dict["name"] = group_name
group = ChannelGroup.from_dict(group_dict)
groups.append(group)
permissions = []
for permission_dict in channel_dict.get("permissions", []):
permission = ChannelPermission.from_dict(permission_dict)
permissions.append(permission)
return Channel(
name=channel_dict["name"],
description=channel_dict.get("description", ''),
position=channel_dict.get("position", 0),
groups=groups,
permissions=permissions,
inherit=channel_dict.get("inherit", True),
isdefault=channel_dict.get("isdefault", False),
parent=parent)
class MurmurServer:
def __init__(self, server: Murmur.Server):
self._server = server
def clear_acls(self, channel_id=0):
_, groups, inherit = self._server.getACL(0)
self._server.setACL(channel_id, [], groups, inherit)
def clear_channels(self) -> None:
for channel_state in self._server.getChannels().values():
if channel_state.id != 0 and channel_state.parent == 0:
self._server.removeChannel(channel_state.id)
self.clear_acls()
def set_channel_acls(self, channel: Channel) -> None:
acls = []
for permission in channel.permissions:
acl = permission.get_acl()
acls.append(acl)
_, current_groups, _ = self._server.getACL(channel.id)
current_group_names = {group.name: group for group in current_groups}
groups = []
for group in channel.groups:
group_state = group.get_state()
if group.name in current_group_names:
current_group_state = current_group_names[group.name]
group_state.add = current_group_state.add
group_state.remove = current_group_state.remove
del current_group_names[group.name]
groups.append(group_state)
groups.extend(current_group_names.values())
self._server.setACL(channel.id, acls, groups, channel.inherit)
def create_channels(self, channel: Channel) -> None:
if channel.parent is None:
channel.id = 0
else:
channel.id = self._server.addChannel(
channel.name,
channel.parent.id)
self._server.setChannelState(channel.get_state())
self.set_channel_acls(channel)
if channel.isdefault:
self._server.setConf("defaultchannel", str(channel.id))
for child in channel.children:
self.create_channels(child)
class Config:
def __init__(self, filename: str = None):
self.filename = filename
self._data = {}
self.load(filename)
def load(self, filename: str = None):
if not filename:
for config_path in CONFIG_SEARCH_PATH:
filename = os.path.join(config_path, CONFIG_DEFAULT_NAME)
if os.path.exists(filename) and os.path.isfile(filename):
break
with open(filename, 'r') as ifd:
self._data = yaml.safe_load(ifd)
def parse_channels(self) -> Channel:
channels = []
for channel_dict in self._data["channels"]:
channel = Channel.from_dict(channel_dict)
channels.append(channel)
channel_names = {channel.name: channel for channel in channels}
for channel in channels:
if channel.parent is None:
continue
if channel.parent.name not in channel_names:
continue
channel_names[channel.parent.name].add(channel)
root_channels = [channel for channel in channels
if channel.parent is None]
if len(root_channels) == 0:
raise RuntimeError("No root channel found.")
if len(root_channels) > 1:
root_names = root_channels.join(', ')
raise RuntimeError(f"Multiple root channels found: {root_names}")
default_channels = [channel for channel in channels
if channel.isdefault]
if len(default_channels) > 1:
default_names = default_channels.join(', ')
raise RuntimeError("Multiple default channels found: "
f"{default_names}")
return root_channels[0]
def main():
parser = argparse.ArgumentParser(
description="Manage Mumble server through ICE connection",
formatter_class=argparse.ArgumentDefaultsHelpFormatter
)
parser.add_argument("--host", "-H", default=ICE_DEFAULT_HOST,
help="ICE host or ip")
parser.add_argument("--port", "-p", default=ICE_DEFAULT_PORT,
help="ICE port number")
parser.add_argument("--timeout", "-t", default=ICE_DEFAULT_TIMEOUT,
help="Connection timeout in milliseconds")
parser.add_argument("--secret", "-s",
default=os.environ.get("MICE_SECRET"),
help="ICE write secret")
parser.add_argument("--server-id", "-i", type=int, default=0,
help="Server ID to manage")
parser.add_argument("--config", "-c",
help="Path to the config file.")
args = parser.parse_args()
config = Config(args.config)
root_channel = config.parse_channels()
server_id = args.server_id
try:
with Mice(args.host, args.port, args.secret, args.timeout) as mice:
if not 0 <= server_id < len(mice.servers):
raise RuntimeError(f"Cannot find server with ID {server_id}")
server = mice.servers[server_id]
server.clear_channels()
server.create_channels(root_channel)
except RuntimeError as e:
logging.error(e, exc_info=e)
return 1
if __name__ == "__main__":
sys.exit(main())

View File

@ -12,6 +12,13 @@
when:
- not (umurmur_started.changed | default(false))
- name: restart murmur
service:
name: mumble-server
state: restarted
when:
- not (murmur_started.changed | default(false))
- name: reload mumble-web
service:
name: mumble-web
@ -20,4 +27,17 @@
- not (mumble_web_started.changed | default(false))
- name: reload nginx
include_tasks: ../handlers/nginx.yml
include_tasks: ../handlers/nginx.yml
- name: change murmur superuser password
command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}"
# See https://github.com/mumble-voip/mumble/issues/3911
# Should be fixed in 1.3.1
failed_when: no
- name: create murmur channels
command:
cmd: ./mice.py -c {{ murmur_ice_config_path | quote }}
chdir: "{{ murmur_ice_script_dir }}"
environment:
MICE_SECRET: "{{ murmur_ice_secret_write }}"

View File

@ -1,11 +1,11 @@
dependencies:
- role: ppbe.acme
tags: [acme]
tags: [never]
- role: geerlingguy.nodejs
vars:
nodejs_install_npm_user: root
tags: [nodejs,mumble_web]
tags: [never]
galaxy_info:
role_name: mumble

View File

@ -0,0 +1,23 @@
*********************************
Vagrant driver installation guide
*********************************
Requirements
============
* Vagrant
* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
Install
=======
Please refer to the `Virtual environment`_ documentation for installation best
practices. If not using a virtual environment, please consider passing the
widely recommended `'--user' flag`_ when invoking ``pip``.
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
.. code-block:: bash
$ pip install 'molecule_vagrant'

View File

@ -0,0 +1,14 @@
---
- name: Converge
hosts: all
become: yes
vars:
mumble_web_enabled: yes
murmur_enabled: yes
umurmur_enabled: yes
umurmur_port: 64739
acme_enabled: no
roles:
- ansible-role-mumble

View File

@ -0,0 +1,79 @@
---
.hardware: &hardware
memory: 1024
cpu: 2
dependency:
name: galaxy
driver:
name: vagrant
provider:
name: virtualbox
platforms:
- name: buster-mumble-molecule
box: debian/buster64
<<: *hardware
interfaces:
# Mumble web client
- network_name: forwarded_port
guest: 80
host: 8080
- network_name: forwarded_port
guest: 443
host: 8443
# Murmur server
- network_name: forwarded_port
guest: 64738
host: 14738
protocol: udp
- network_name: forwarded_port
guest: 64738
host: 14738
protocol: tcp
# Umurmur server
- network_name: forwarded_port
guest: 64739
host: 14739
protocol: udp
- network_name: forwarded_port
guest: 64739
host: 14739
protocol: tcp
- name: focal-mumble-molecule
box: ubuntu/focal64
<<: *hardware
interfaces:
# Mumble web client
- network_name: forwarded_port
guest: 80
host: 9080
- network_name: forwarded_port
guest: 443
host: 9443
# Murmur server
- network_name: forwarded_port
guest: 64738
host: 24738
protocol: udp
- network_name: forwarded_port
guest: 64738
host: 24738
protocol: tcp
# Umurmur server
- network_name: forwarded_port
guest: 64739
host: 24739
protocol: udp
- network_name: forwarded_port
guest: 64739
host: 24739
protocol: tcp
provisioner:
name: ansible
config_options:
defaults:
interpreter_python: /usr/bin/python3
ssh_connection:
pipelining: true
verifier:
name: ansible

View File

@ -0,0 +1,14 @@
- name: Prepare
hosts: all
become: yes
tasks:
- name: Update apt cache
apt:
update_cache: yes
cache_valid_time: 3600
- name: Install nginx package
package:
name: nginx-light
state: present

View File

@ -0,0 +1,23 @@
*********************************
Vagrant driver installation guide
*********************************
Requirements
============
* Vagrant
* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
Install
=======
Please refer to the `Virtual environment`_ documentation for installation best
practices. If not using a virtual environment, please consider passing the
widely recommended `'--user' flag`_ when invoking ``pip``.
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
.. code-block:: bash
$ pip install 'molecule_vagrant'

View File

@ -0,0 +1,13 @@
---
- name: Converge
hosts: all
become: yes
vars:
mumble_web_enabled: yes
murmur_enabled: yes
umurmur_enabled: no
acme_enabled: no
roles:
- ansible-role-mumble

View File

@ -0,0 +1,43 @@
---
.hardware: &hardware
memory: 1024
cpu: 2
dependency:
name: galaxy
driver:
name: vagrant
provider:
name: virtualbox
platforms:
- name: buster-mumble-molecule
box: debian/buster64
<<: *hardware
interfaces:
# Mumble web client
- network_name: forwarded_port
guest: 80
host: 8080
- network_name: forwarded_port
guest: 443
host: 8443
- name: focal-mumble-molecule
box: ubuntu/focal64
<<: *hardware
interfaces:
# Mumble web client
- network_name: forwarded_port
guest: 80
host: 9080
- network_name: forwarded_port
guest: 443
host: 9443
provisioner:
name: ansible
config_options:
defaults:
interpreter_python: /usr/bin/python3
ssh_connection:
pipelining: true
verifier:
name: ansible

View File

@ -0,0 +1,14 @@
- name: Prepare
hosts: all
become: yes
tasks:
- name: Update apt cache
apt:
update_cache: yes
cache_valid_time: 3600
- name: Install nginx package
package:
name: nginx-light
state: present

View File

@ -0,0 +1,23 @@
*********************************
Vagrant driver installation guide
*********************************
Requirements
============
* Vagrant
* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
Install
=======
Please refer to the `Virtual environment`_ documentation for installation best
practices. If not using a virtual environment, please consider passing the
widely recommended `'--user' flag`_ when invoking ``pip``.
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
.. code-block:: bash
$ pip install 'molecule_vagrant'

View File

@ -0,0 +1,14 @@
---
- name: Converge
hosts: all
become: yes
vars:
mumble_web_enabled: no
murmur_enabled: yes
umurmur_enabled: no
umurmur_port: 64739
acme_enabled: no
roles:
- ansible-role-mumble

View File

@ -0,0 +1,47 @@
---
.hardware: &hardware
memory: 1024
cpu: 2
dependency:
name: galaxy
driver:
name: vagrant
provider:
name: virtualbox
platforms:
- name: buster-mumble-molecule
box: debian/buster64
<<: *hardware
interfaces:
# Murmur server
- network_name: forwarded_port
guest: 64738
host: 14738
protocol: udp
- network_name: forwarded_port
guest: 64738
host: 14738
protocol: tcp
- name: focal-mumble-molecule
box: ubuntu/focal64
<<: *hardware
interfaces:
# Murmur server
- network_name: forwarded_port
guest: 64738
host: 24738
protocol: udp
- network_name: forwarded_port
guest: 64738
host: 24738
protocol: tcp
provisioner:
name: ansible
config_options:
defaults:
interpreter_python: /usr/bin/python3
ssh_connection:
pipelining: true
verifier:
name: ansible

View File

@ -0,0 +1,9 @@
- name: Prepare
hosts: all
become: yes
tasks:
- name: Update apt cache
apt:
update_cache: yes
cache_valid_time: 3600

View File

@ -0,0 +1,23 @@
*********************************
Vagrant driver installation guide
*********************************
Requirements
============
* Vagrant
* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
Install
=======
Please refer to the `Virtual environment`_ documentation for installation best
practices. If not using a virtual environment, please consider passing the
widely recommended `'--user' flag`_ when invoking ``pip``.
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
.. code-block:: bash
$ pip install 'molecule_vagrant'

View File

@ -0,0 +1,13 @@
---
- name: Converge
hosts: all
become: yes
vars:
mumble_web_enabled: no
murmur_enabled: no
umurmur_enabled: yes
acme_enabled: no
roles:
- ansible-role-mumble

View File

@ -0,0 +1,47 @@
---
.hardware: &hardware
memory: 1024
cpu: 2
dependency:
name: galaxy
driver:
name: vagrant
provider:
name: virtualbox
platforms:
- name: buster-mumble-molecule
box: debian/buster64
<<: *hardware
interfaces:
# Umurmur server
- network_name: forwarded_port
guest: 64738
host: 14738
protocol: udp
- network_name: forwarded_port
guest: 64738
host: 14738
protocol: tcp
- name: focal-mumble-molecule
box: ubuntu/focal64
<<: *hardware
interfaces:
# Umurmur server
- network_name: forwarded_port
guest: 64738
host: 24738
protocol: udp
- network_name: forwarded_port
guest: 64738
host: 24738
protocol: tcp
provisioner:
name: ansible
config_options:
defaults:
interpreter_python: /usr/bin/python3
ssh_connection:
pipelining: true
verifier:
name: ansible

View File

@ -0,0 +1,9 @@
- name: Prepare
hosts: all
become: yes
tasks:
- name: Update apt cache
apt:
update_cache: yes
cache_valid_time: 3600

View File

@ -0,0 +1,21 @@
- name: Ensure Diffie-Hellman directory exists
file:
path: "{{ mumble_web_nginx_dhparam | dirname }}"
state: directory
owner: root
group: www-data
mode: "755"
- name: Generate Diffie-Hellman parameters
# This can take a long time... So we are doing it in async mode
openssl_dhparam:
path: "{{ mumble_web_nginx_dhparam }}"
state: present
owner: root
group: www-data
mode: "640"
size: "{{ mumble_web_nginx_dhparam_size }}"
async: 3600
poll: 0
changed_when: no
register: _mumble_web_nginx_dhparam

View File

@ -0,0 +1,7 @@
- name: Waiting for Diffie-Hellman task to complete…
async_status:
jid: "{{ _mumble_web_nginx_dhparam.ansible_job_id }}"
register: _mumble_web_nginx_dhparam_job
retries: 60
delay: 30 # will retry every 30s for 30min (60 retries)
until: _mumble_web_nginx_dhparam_job.finished

View File

@ -1,11 +1,51 @@
- name: Install and configure umurmur server
- name: Generate Diffie-Hellman parameters in async mode
import_tasks: dhparam/begin.yml
when: mumble_web_enabled and mumble_web_nginx_generate_dhparam
tags:
- certificate
- dhparam
- name: Install ACME certificates
import_role:
name: ppbe.acme
when: acme_enabled
tags:
- certificate
- acme
- name: Install Self-Signed certificates
include_tasks: self_signed.yml
loop: "{{ acme_domains | unique }}"
loop_control:
loop_var: domain_name
when: not acme_enabled
tags:
- certificate
- self_signed
- name: Deploy uMurmur server
import_tasks: umurmur.yml
when: umurmur_enabled
tags: umurmur
- name: Install and configure mumble web client
- name: Deploy Murmur server
import_tasks: murmur.yml
when: murmur_enabled
tags: murmur
- name: Deploy mumble web client
import_tasks: mumble_web.yml
when: mumble_web_enabled
tags: mumble_web
- name: Wait for Diffie-Hellman task to complete
import_tasks: dhparam/end.yml
when: mumble_web_enabled and mumble_web_nginx_generate_dhparam
tags:
- certificate
- dhparam
- name: Configure Nginx for mumble web client
import_tasks: nginx.yml
when: mumble_web_enabled and mumble_web_nginx_enabled
tags: nginx

View File

@ -1,5 +1,16 @@
- name: Install NodeJS
import_role:
name: geerlingguy.nodejs
tags: nodejs
- name: Install git package
package:
name: git
state: present
tags: mumble_web_install
- name: Install websockify
apt:
package:
name: websockify
state: present
notify: reload mumble-web
@ -36,13 +47,18 @@
become_user: "{{ mumble_web_owner }}"
tags: mumble_web_install
- name: Check if mumble-web dist directory exists
stat:
path: "{{ mumble_web_www_dir }}/dist"
register: _mumble_web_dist
- name: Build mumble-web from sources
command: npm clean-install
args:
chdir: "{{ mumble_web_www_dir }}"
register: _mumble_web_installed
become_user: "{{ mumble_web_owner }}"
when: mumble_web_cloned is changed
when: mumble_web_cloned is changed or not _mumble_web_dist.stat.exists
tags: [mumble_web_install,mumble_web_build]
- name: Copy mumble-web config file

95
tasks/murmur.yml 100644
View File

@ -0,0 +1,95 @@
- name: Install mumble-server package
package:
name: mumble-server
state: present
register: murmur_installed
- name: Install ICE dependencies for Python
package:
name: "{{ package }}"
state: present
loop:
- python3-zeroc-ice
- python3-yaml
- zeroc-ice-compilers
loop_control:
loop_var: package
- name: Append ssl-cert group to {{ murmur_owner }} user
user:
name: "{{ murmur_owner }}"
state: present
groups:
- "{{ acme_ssl_group }}"
append: yes
system: yes
notify: restart murmur
- name: Copy Murmur config file
template:
src: mumble-server.ini.j2
dest: /etc/mumble-server.ini
owner: root
group: "{{ murmur_group }}"
mode: "640"
notify: restart murmur
- name: Start mumble-server service
service:
name: mumble-server
enabled: yes
state: started
- name: Write superuser password to a file
copy:
content: "{{ murmur_superuser_password }}"
dest: /etc/mumble-server.secret
owner: root
group: root
mode: "600"
when: murmur_superuser_password is defined
notify: change murmur superuser password
- name: Trigger Murmur handlers
meta: flush_handlers
- name: Create mumble-ice directory
file:
path: "{{ murmur_ice_script_dir }}"
state: directory
owner: root
group: root
mode: "755"
- name: Copy mice Python script
copy:
src: murmur/scripts/mice.py
dest: "{{ murmur_ice_script_dir }}/mice.py"
owner: root
group: root
mode: "755"
notify: create murmur channels
register: _murmur_mice_script_copied
- name: Compile Murmur.ice slice file
command: |-
slice2py --checksum \
-I/usr/local/share/Ice \
-I/usr/share/Ice/slice \
-I/usr/share/ice/slice \
/usr/share/slice/Murmur.ice
args:
chdir: "{{ murmur_ice_script_dir }}"
when: _murmur_mice_script_copied is changed
- name: Copy mice config
copy:
src: murmur/mice.yml
dest: "{{ murmur_ice_config_path }}"
owner: root
group: root
mode: "644"
notify: create murmur channels
- name: Trigger Mice handlers
meta: flush_handlers

View File

@ -1,7 +1,7 @@
- name: Copy Nginx config file
template:
src: nginx.conf.j2
dest: /etc/nginx/sites-available/mumble.conf
dest: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
owner: root
group: www-data
mode: "755"
@ -9,8 +9,8 @@
- name: Enable Nginx config file
file:
src: /etc/nginx/sites-available/mumble.conf
path: /etc/nginx/sites-enabled/mumble.conf
src: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
path: "{{ mumble_web_nginx_config_dir }}/sites-enabled/mumble.conf"
state: link
notify: reload nginx

View File

@ -0,0 +1,64 @@
- name: Install SSL dependencies
package:
name: "{{ package }}"
state: present
loop:
- ssl-cert
- python3-openssl
loop_control:
loop_var: package
tags: selfsigned_install
- name: Create SSL config directories
file:
path: "{{ config_dir }}"
state: directory
owner: root
group: "{{ acme_ssl_group }}"
mode: "711"
loop:
- "{{ acme_config_dir }}"
- "{{ acme_keys_dir }}"
- "{{ acme_accounts_dir }}"
- "{{ acme_csr_dir }}"
loop_control:
loop_var: config_dir
tags: selfsigned_install
- name: Create {{ domain_name }} certificates directory
file:
path: "{{ acme_certs_dir }}/{{ domain_name }}.d"
state: directory
owner: root
group: "{{ acme_ssl_group }}"
mode: "755"
tags: selfsigned_install
- name: Generate private key for {{ domain_name }} certificate
openssl_privatekey:
path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
owner: root
group: "{{ acme_ssl_group }}"
mode: "640"
type: RSA
size: 4096
- name: Generate CSR for {{ domain_name }} certificate
openssl_csr:
path: "{{ acme_csr_dir }}/{{ domain_name }}.csr"
owner: root
group: "{{ acme_ssl_group }}"
mode: "644"
privatekey_path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
common_name: "{{ domain_name }}"
- name: Generate self-signed certificate
openssl_certificate:
path: "{{ acme_certs_dir }}/{{ domain_name }}.d/cert.pem"
csr_path: "{{ acme_csr_dir }}/{{ domain_name }}.csr"
privatekey_path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
provider: selfsigned
state: present
owner: root
group: "{{ acme_ssl_group }}"
mode: "644"

View File

@ -1,6 +1,7 @@
- name: Install umurmur build dependencies
apt:
package:
name: "{{ package }}"
state: present
loop:
- git
- build-essential
@ -82,10 +83,4 @@
register: umurmur_started
- name: Trigger umurmur handlers
meta: flush_handlers
- name: Open umurmur port with UFW
ufw:
rule: allow
port: "{{ umurmur_port }}"
when: umurmur_ispublic | bool
meta: flush_handlers

View File

@ -0,0 +1,325 @@
{{ ansible_managed | comment(decoration="; ") }}
; Murmur configuration file.
;
; General notes:
; * Settings in this file are default settings and many of them can be overridden
; with virtual server specific configuration via the Ice or DBus interface.
; * Due to the way this configuration file is read some rules have to be
; followed when specifying variable values (as in variable = value):
; * Make sure to quote the value when using commas in strings or passwords.
; NOT variable = super,secret BUT variable = "super,secret"
; * Make sure to escape special characters like '\' or '"' correctly
; NOT variable = """ BUT variable = "\""
; NOT regex = \w* BUT regex = \\w*
; Path to database. If blank, will search for
; murmur.sqlite in default locations or create it if not found.
database={{ murmur_database.path | to_json }}
; Murmur defaults to using SQLite with its default rollback journal.
; In some situations, using SQLite's write-ahead log (WAL) can be
; advantageous.
; If you encounter slowdowns when moving between channels and similar
; operations, enabling the SQLite write-ahead log might help.
;
; To use SQLite's write-ahead log, set sqlite_wal to one of the following
; values:
;
; 0 - Use SQLite's default rollback journal.
; 1 - Use write-ahead log with synchronous=NORMAL.
; If Murmur crashes, the database will be in a consistent state, but
; the most recent changes might be lost if the operating system did
; not write them to disk yet. This option can improve Murmur's
; interactivity on busy servers, or servers with slow storage.
; 2 - Use write-ahead log with synchronous=FULL.
; All database writes are synchronized to disk when they are made.
; If Murmur crashes, the database will be include all completed writes.
;sqlite_wal=0
; If you wish to use something other than SQLite, you'll need to set the name
; of the database above, and also uncomment the below.
; Sticking with SQLite is strongly recommended, as it's the most well tested
; and by far the fastest solution.
;
;dbDriver=QMYSQL
;dbUsername=
;dbPassword=
;dbHost=
;dbPort=
;dbPrefix=murmur_
;dbOpts=
{% if murmur_database.driver is defined %}
dbDriver={{ murmur_database.driver | to_json }}
dbUsername={{ murmur_database.username | to_json }}
dbPassword={{ murmur_database.password | to_json }}
dbHost={{ murmur_database.host | default('localhost') | to_json }}
dbPort={{ murmur_database.port }}
dbPrefix={{ murmur_database.prefix | default('') | to_json }}
dbOpts={{ murmur_database.opts | default('') | to_json }}
{% endif %}
; Murmur defaults to not using D-Bus. If you wish to use dbus, which is one of the
; RPC methods available in Murmur, please specify so here.
;
;dbus=session
; Alternate D-Bus service name. Only use if you are running distinct
; murmurd processes connected to the same D-Bus daemon.
;dbusservice=net.sourceforge.mumble.murmur
; If you want to use ZeroC Ice to communicate with Murmur, you need
; to specify the endpoint to use. Since there is no authentication
; with ICE, you should only use it if you trust all the users who have
; shell access to your machine.
; Please see the ICE documentation on how to specify endpoints.
ice="tcp -h {{ murmur_ice_host | quote }} -p {{ murmur_ice_port | int }}"
; Ice primarily uses local sockets. This means anyone who has a
; user account on your machine can connect to the Ice services.
; You can set a plaintext "secret" on the Ice connection, and
; any script attempting to access must then have this secret
; (as context with name "secret").
; Access is split in read (look only) and write (modify)
; operations. Write access always includes read access,
; unless read is explicitly denied (see note below).
;
; Note that if this is uncommented and with empty content,
; access will be denied.
{% if murmur_ice_secret_read is defined %}
icesecretread={{ murmur_ice_secret_read | to_json }}
{% else %}
;icesecretread=
{% endif %}
{% if murmur_ice_secret_write is defined %}
icesecretwrite={{ murmur_ice_secret_write | to_json }}
{% else %}
;icesecretwrite=
{% endif %}
; If you want to expose Murmur's experimental gRPC API, you
; need to specify an address to bind on.
; Note: not all builds of Murmur support gRPC. If gRPC is not
; available, Murmur will warn you in its log output.
;grpc="127.0.0.1:50051"
; Specifying both a certificate and key file below will cause gRPC to use
; secured, TLS connections.
;grpccert=""
;grpckey=""
; How many login attempts do we tolerate from one IP
; inside a given timeframe before we ban the connection?
; Note that this is global (shared between all virtual servers), and that
; it counts both successfull and unsuccessfull connection attempts.
; Set either Attempts or Timeframe to 0 to disable.
;autobanAttempts = 10
;autobanTimeframe = 120
;autobanTime = 300
autobanAttempts={{ murmur_autoban_attempts }}
autobanTimeframe={{ murmur_autoban_timeframe }}
autobanTime={{ murmur_autoban_time }}
; Specifies the file Murmur should log to. By default, Murmur
; logs to the file 'murmur.log'. If you leave this field blank
; on Unix-like systems, Murmur will force itself into foreground
; mode which logs to the console.
;logfile=murmur.log
logfile={{ murmur_log_file | to_json }}
; If set, Murmur will write its process ID to this file
; when running in daemon mode (when the -fg flag is not
; specified on the command line). Only available on
; Unix-like systems.
;pidfile=
pidfile={{ murmur_pid_file | to_json }}
; The below will be used as defaults for new configured servers.
; If you're just running one server (the default), it's easier to
; configure it here than through D-Bus or Ice.
;
; Welcome message sent to clients when they connect.
; If the welcome message is set to an empty string,
; no welcome message will be sent to clients.
welcometext={{ murmur_welcome_text | to_json }}
; Port to bind TCP and UDP sockets to.
port={{ murmur_port }}
; Specific IP or hostname to bind to.
; If this is left blank (default), Murmur will bind to all available addresses.
;host=
host={{ murmur_host | to_json }}
; Password to join server.
serverpassword={{ murmur_server_password | to_json }}
; Maximum bandwidth (in bits per second) clients are allowed
; to send speech at.
bandwidth={{ murmur_max_bandwidth }}
; Maximum number of concurrent clients allowed.
users={{ murmur_max_users }}
; Per-user rate limiting
;
; These two settings allow to configure the per-user rate limiter for some
; command messages sent from the client to the server. The messageburst setting
; specifies an amount of messages which are allowed in short bursts. The
; messagelimit setting specifies the number of messages per second allowed over
; a longer period. If a user hits the rate limit, his packages are then ignored
; for some time. Both of these settings have a minimum of 1 as setting either to
; 0 could render the server unusable.
messageburst=5
messagelimit=1
; Respond to UDP ping packets.
;
; Setting to true exposes the current user count, the maximum user count, and
; the server's maximum bandwidth per client to unauthenticated users. In the
; Mumble client, this information is shown in the Connect dialog.
allowping=true
; Amount of users with Opus support needed to force Opus usage, in percent.
; 0 = Always enable Opus, 100 = enable Opus if it's supported by all clients.
;opusthreshold=100
opusthreshold={{ murmur_opus_threshold }}
; Maximum depth of channel nesting. Note that some databases like MySQL using
; InnoDB will fail when operating on deeply nested channels.
;channelnestinglimit=10
channelnestinglimit={{ murmur_channel_nesting_limit }}
; Maximum number of channels per server. 0 for unlimited. Note that an
; excessive number of channels will impact server performance
;channelcountlimit=1000
channelcountlimit={{ murmur_channel_count_limit }}
; Regular expression used to validate channel names.
; (Note that you have to escape backslashes with \ )
;channelname=[ \\-=\\w\\#\\[\\]\\{\\}\\(\\)\\@\\|]+
{% if murmur_channel_name_regex is defined %}
channelname={{ murmur_channel_name_regex }}
{% endif %}
; Regular expression used to validate user names.
; (Note that you have to escape backslashes with \ )
;username=[-=\\w\\[\\]\\{\\}\\(\\)\\@\\|\\.]+
{% if murmur_username_regex is defined %}
username={{ murmur_username_regex }}
{% endif %}
; Maximum length of text messages in characters. 0 for no limit.
;textmessagelength=5000
textmessagelength={{ murmur_text_message_max_length }}
; Maximum length of text messages in characters, with image data. 0 for no limit.
;imagemessagelength=131072
imagemessagelength={{ murmur_image_message_max_length }}
; Allow clients to use HTML in messages, user comments and channel descriptions?
;allowhtml=true
allowhtml={{ murmur_allow_html }}
; Murmur retains the per-server log entries in an internal database which
; allows it to be accessed over D-Bus/ICE.
; How many days should such entries be kept?
; Set to 0 to keep forever, or -1 to disable logging to the DB.
;logdays=31
logdays={{ murmur_log_days }}
{% if murmur_register_enabled %}
; To enable public server registration, the serverpassword must be blank, and
; this must all be filled out.
; The password here is used to create a registry for the server name; subsequent
; updates will need the same password. Don't lose your password.
; The URL is your own website, and only set the registerHostname for static IP
; addresses.
; Only uncomment the 'registerName' parameter if you wish to give your "Root" channel a custom name.
;
registerName={{ murmur_register.name | to_json }}
registerPassword={{ murmur_register.password | to_json }}
registerUrl={{ murmur_register.url | to_json }}
registerHostname={{ murmur_register.hostname | to_json }}
{% endif %}
; If this option is enabled, the server will announce its presence via the
; bonjour service discovery protocol. To change the name announced by bonjour
; adjust the registerName variable.
; See http://developer.apple.com/networking/bonjour/index.html for more information
; about bonjour.
;bonjour=True
bonjour={{ murmur_bonjour_enabled }}
; If you have a proper SSL certificate, you can provide the filenames here.
; Otherwise, Murmur will create its own certificate automatically.
;sslCert=
;sslKey=
sslCert={{ murmur_certificate | to_json }}
sslKey={{ murmur_private_key | to_json }}
{% if acme_enabled %}
sslCa={{ murmur_trusted_certificate | to_json }}
{% endif %}
; The sslDHParams option allows you to specify a PEM-encoded file with
; Diffie-Hellman parameters, which will be used as the default Diffie-
; Hellman parameters for all virtual servers.
;
; Instead of pointing sslDHParams to a file, you can also use the option
; to specify a named set of Diffie-Hellman parameters for Murmur to use.
; Murmur comes bundled with the Diffie-Hellman parameters from RFC 7919.
; These parameters are available by using the following names:
;
; @ffdhe2048, @ffdhe3072, @ffdhe4096, @ffdhe6144, @ffdhe8192
;
; By default, Murmur uses @ffdhe2048.
sslDHParams={{ murmur_dhparam | to_json }}
; The sslCiphers option chooses the cipher suites to make available for use
; in SSL/TLS. This option is server-wide, and cannot be set on a
; per-virtual-server basis.
;
; This option is specified using OpenSSL cipher list notation (see
; https://www.openssl.org/docs/apps/ciphers.html#CIPHER-LIST-FORMAT).
;
; It is recommended that you try your cipher string using 'openssl ciphers <string>'
; before setting it here, to get a feel for which cipher suites you will get.
;
; After setting this option, it is recommend that you inspect your Murmur log
; to ensure that Murmur is using the cipher suites that you expected it to.
;
; Note: Changing this option may impact the backwards compatibility of your
; Murmur server, and can remove the ability for older Mumble clients to be able
; to connect to it.
;sslCiphers=EECDH+AESGCM:EDH+aRSA+AESGCM:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA
; If Murmur is started as root, which user should it switch to?
; This option is ignored if Murmur isn't started with root privileges.
;uname=
uname={{ murmur_owner }}
; If this options is enabled, only clients which have a certificate are allowed
; to connect.
;certrequired=False
certrequired={{ murmur_client_certificate_required }}
; If enabled, clients are sent information about the servers version and operating
; system.
;sendversion=True
sendversion={{ murmur_send_server_version }}
; This sets password hash storage to legacy mode (1.2.4 and before)
; (Note that setting this to true is insecure and should not be used unless absolutely necessary)
;legacyPasswordHash=false
; By default a strong amount of PBKDF2 iterations are chosen automatically. If >0 this setting
; overrides the automatic benchmark and forces a specific number of iterations.
; (Note that you should only change this value if you know what you are doing)
;kdfIterations=-1
; You can configure any of the configuration options for Ice here. We recommend
; leave the defaults as they are.
; Please note that this section has to be last in the configuration file.
;
[Ice]
Ice.Warn.UnknownProperties={{ murmur_ice_warn_unknown_properties | int }}
Ice.MessageSizeMax={{ murmur_ice_message_size_max }}

View File

@ -13,7 +13,7 @@ let config = window.mumbleWebConfig // eslint-disable-line no-unused-vars
config.connectDialog.address = false
config.connectDialog.port = false
config.connectDialog.token = false
config.connectDialog.password = {{ (umurmur_user_password != '') | lower }}
config.connectDialog.password = {{ (umurmur_server_password != '') | lower }}
// Default values for user settings
// You can see your current value by typing `localStorage.getItem('mumble.$setting')` in the web console.

View File

@ -8,7 +8,7 @@ server {
return 301 https://$host$request_uri;
}
{% if acme_challenge_dir is defined %}
{% if acme_enabled and acme_challenge_dir is defined %}
location ^~ /.well-known/acme-challenge/ {
allow all;
root {{ acme_challenge_dir }};
@ -30,8 +30,8 @@ server {
ssl_session_cache shared:AnsibleSSL:10m; # about 40000 sessions
ssl_session_tickets off;
{% if mumble_web_dhparam is defined and mumble_web_dhparam != '' %}
ssl_dhparam {{ mumble_web_dhparam }};
{% if mumble_web_nginx_dhparam %}
ssl_dhparam {{ mumble_web_nginx_dhparam }};
{% endif %}
ssl_protocols TLSv1.2 TLSv1.3;
@ -44,8 +44,10 @@ server {
ssl_stapling on;
ssl_stapling_verify on;
{% if acme_enabled %}
# Verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate {{ mumble_web_trusted_certificate }};
{% endif %}
location / {
root /var/www/mumble-web/dist/;

View File

@ -1,12 +1,13 @@
{{ ansible_managed | comment }}
max_bandwidth = 48000;
welcometext = {{ umurmur_welcome_text
if umurmur_welcome_text is string
else (umurmur_welcome_text | join('<br />'))
| to_json }};
max_bandwidth = {{ umurmur_max_bandwidth }};
{% if umurmur_welcome_text is string %}
welcometext = {{ umurmur_welcome_text | to_json }};
{% else %}
welcometext = {{ umurmur_welcome_text | join('<br />') | to_json }};
{% endif %}
certificate = {{ umurmur_certificate | to_json }};
private_key = {{ umurmur_private_key | to_json }};
password = {{ umurmur_user_password | to_json }};
password = {{ umurmur_server_password | to_json }};
{% if umurmur_admin_password is defined %}
admin_password = {{ umurmur_admin_password | to_json }}; # Set to enable admin functionality.
{% endif %}

2
vars/main.yml 100644
View File

@ -0,0 +1,2 @@
murmur_ice_script_dir: /opt/mice
murmur_ice_config_path: /etc/mice.yml