diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..fc3643d --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +.venv +.vscode +.gitignore \ No newline at end of file diff --git a/defaults/main.yml b/defaults/main.yml index 4e170b2..00c280a 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,4 +1,107 @@ -umurmur_user_password: "" +acme_enabled: yes +acme_domains: + - "{{ umurmur_domain }}" + - "{{ mumble_web_domain }}" + +mumble_web_enabled: yes +mumble_web_domain: "{{ inventory_hostname }}.local" +mumble_web_owner: mumble-web +mumble_web_group: "{{ mumble_web_owner }}" +mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/{{ acme_enabled | ternary('fullchain','cert') }}.pem" +mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem" +mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.pem" +mumble_web_www_dir: /var/www/mumble-web +mumble_web_version: master +mumble_web_websockify_port: "64737" + +mumble_web_nginx_enabled: yes +mumble_web_nginx_config_dir: /etc/nginx +mumble_web_nginx_generate_dhparam: yes +mumble_web_nginx_dhparam: "{{ mumble_web_nginx_config_dir }}/ssl/dhparam.pem" +mumble_web_nginx_dhparam_size: 2048 + +murmur_enabled: yes +murmur_domain: "{{ mumble_web_domain }}" +murmur_superuser_password: supersecret +murmur_database: + path: "/var/lib/mumble-server/mumble-server.sqlite" + # driver: "QMYSQL" + # username: "mumble" + # password: "password" + # host: "localhost" + # port: 3306 + # prefix: "murmur_" +murmur_ice_host: "127.0.0.1" +murmur_ice_port: 6502 +# Give read permission on ICE connection. Empty secret will deny read permission to anybody. +murmur_ice_secret_read: "{{ lookup('password', '/tmp/murmur-ice-read.secret length=50') }}" +# Give write permission on ICE connection. Empty secret will deny write permission to anybody. +murmur_ice_secret_write: "{{ lookup('password', '/tmp/murmur-ice-write.secret length=50') }}" + +murmur_autoban_attempts: 10 +murmur_autoban_timeframe: 120 +murmur_autoban_time: 300 +murmur_log_file: "/var/log/mumble-server/mumble-server.log" +murmur_pid_file: "/var/run/mumble-server/mumble-server.pid" +murmur_welcome_text: "Welcome on the {{ inventory_hostname }} Mumble server!" +# Leave blank to let Murmur bind to all available addresses +murmur_host: "" +murmur_port: 64738 +# Password to join the server +murmur_server_password: "" +murmur_max_bandwidth: 72000 +murmur_max_users: 100 +murmur_opus_threshold: 100 +murmur_channel_nesting_limit: 10 +murmur_channel_count_limit: 1000 +# Regex to validate channel or usernames +# murmur_channel_name_regex: "" +# murmur_username_regex: "" +murmur_text_message_max_length: 5000 +murmur_image_message_max_length: 131072 +murmur_allow_html: yes +# Set to 0 to keep logs forever, or -1 to disable logging to the DB. +murmur_log_days: -1 +# Name for root channel and entry in mumble main server list +murmur_register_enabled: no +murmur_register: + name: "MyMumbleServerRegisterName" + password: "password" + url: "https://mymumbleserverurl.org" + hostname: "mymumblehostname.domain.org" +# Enable Bonjour for dev purpose +murmur_bonjour_enabled: no +murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem" +murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/chain.pem" +murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domain }}.pem" +murmur_dhparam: "@ffdhe4096" +murmur_owner: "mumble-server" +murmur_group: "{{ murmur_owner }}" +murmur_client_certificate_required: no +murmur_send_server_version: yes +murmur_ice_warn_unknown_properties: yes +murmur_ice_message_size_max: 65536 + +umurmur_enabled: yes +umurmur_domain: "{{ mumble_web_domain }}" +umurmur_max_bandwidth: 48000 +umurmur_max_users: 100 +umurmur_server_password: "" +umurmur_channels: +- name: Root + description: Root channel. No entry. + noenter: yes +- name: Welcome + parent: Root + description: Welcome channel + position: 0 +- name: Silent + parent: Root + description: Silent channel + silent: yes + position: 1 +umurmur_default_channel: Welcome +umurmur_welcome_text: "Welcome on the {{ inventory_hostname }} Mumble server!" umurmur_channel_links: - source: "{{ umurmur_default_channel }}" destinations: >- @@ -9,18 +112,7 @@ umurmur_channel_links: | list }} umurmur_ssl_group: "{{ acme_ssl_group }}" -umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/fullchain.pem" +umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem" umurmur_private_key: "{{ acme_keys_dir }}/{{ umurmur_domain }}.pem" umurmur_version: master -umurmur_ispublic: yes -umurmur_port: "64738" - -mumble_web_owner: mumble-web -mumble_web_group: "{{ mumble_web_owner }}" -mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/fullchain.pem" -mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem" -mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.pem" -mumble_web_dhparam: "/etc/nginx/ssl/dhparam.pem" -mumble_web_www_dir: /var/www/mumble-web -mumble_web_version: master -mumble_web_websockify_port: "64737" \ No newline at end of file +umurmur_port: 64738 diff --git a/files/murmur/mice.yml b/files/murmur/mice.yml new file mode 100644 index 0000000..5d47323 --- /dev/null +++ b/files/murmur/mice.yml @@ -0,0 +1,42 @@ +channels: +- name: Root + description: Root channel. No entry. + groups: + admin: + inherit: true + inheritable: true + permissions: + - group: all + deny: + - Enter + recursive: false + enabled: true + - group: all + allow: + - RegisterSelf + - MakeTempChannel + - group: admin + allow: + - MuteDeafen + - Move + - Kick + - Ban + - Register +- name: Welcome + parent: Root + description: Welcome channel + position: 0 + isdefault: true +- name: Silent + parent: Root + description: Silent channel + position: 1 + permissions: + - group: all + deny: + - Speak + - MakeTempChannel + enabled: true + - group: admin + allow: + - MakeTempChannel \ No newline at end of file diff --git a/files/murmur/scripts/mice.py b/files/murmur/scripts/mice.py new file mode 100644 index 0000000..26b5cb9 --- /dev/null +++ b/files/murmur/scripts/mice.py @@ -0,0 +1,345 @@ +#!/usr/bin/python3 + +import argparse +import logging +import os +import sys +from typing import List, Dict + +import Ice +import yaml + +import Murmur + +CONFIG_SEARCH_PATH = [".", "/etc"] +CONFIG_DEFAULT_NAME = "mice.yml" + +ICE_DEFAULT_HOST = "127.0.0.1" +ICE_DEFAULT_PORT = 6502 +ICE_DEFAULT_TIMEOUT = 1000 + + +class Mice: + def __init__(self, host: str = ICE_DEFAULT_HOST, + port: int = ICE_DEFAULT_PORT, secret: str = None, + timeout: int = ICE_DEFAULT_TIMEOUT): + logging.debug("Initializing ICE connection") + properties = Ice.createProperties() + properties.setProperty("Ice.ImplicitContext", "Shared") + init_data = Ice.InitializationData() + init_data.properties = properties + self._communicator = Ice.initialize(init_data) + + if secret: + logging.debug("Providing ICE secret") + self._communicator.getImplicitContext().put("secret", secret) + + logging.debug("Creating meta proxy") + proxy_str = f"Meta: tcp -h {host} -p {port} -t {timeout}" + proxy = self._communicator.stringToProxy(proxy_str) + self.meta = Murmur.MetaPrx.checkedCast(proxy) + + if not self.meta: + self._communicator.destroy() + raise RuntimeError(f"Invalid Proxy: {proxy_str}") + + try: + logging.debug("Retrieving the list of Mumble servers") + servers = self.meta.getAllServers() + except Murmur.InvalidSecretException: + self._communicator.destroy() + raise RuntimeError(f"Failed to connect to {host} " + f"on port {port}: Invalid secret.") from None + self.servers = [MurmurServer(server) for server in servers] + + if len(self.servers) == 0: + self._communicator.destroy() + raise RuntimeError("No Mumble server found") + + def __enter__(self): + return self + + def __exit__(self, exc_type, exc_value, traceback): + self._communicator.destroy() + + +class ChannelGroup: + def __init__(self, name: str, inherit: bool = True, + inheritable: bool = True): + self.name = name + self.inherit = inherit + self.inheritable = inheritable + + def get_state(self) -> Murmur.Group: + return Murmur.Group( + name=self.name, + inherit=self.inherit, + inheritable=self.inheritable + ) + + @staticmethod + def from_dict(group_dict: Dict[str, object]) -> "ChannelGroup": + return ChannelGroup( + name=group_dict["name"], + inherit=group_dict.get("inherit", True), + inheritable=group_dict.get("inheritable", True) + ) + + +class ChannelPermission: + def __init__(self, group: str = "all", userid: int = -1, + allow: int = 0, deny: int = 0, + recursive: bool = True, enabled: bool = True): + self.group = group + self.userid = userid + self.allow = allow + self.deny = deny + self.recursive = recursive + self.enabled = enabled + + def get_acl(self) -> Murmur.ACL: + return Murmur.ACL( + applyHere=self.enabled, + applySubs=self.recursive, + userid=self.userid, + group=self.group, + allow=self.allow, + deny=self.deny) + + @staticmethod + def from_dict(permission_dict: Dict[str, object]) -> "ChannelPermission": + allow = ChannelPermission._parse_rules( + permission_dict.get("allow", [])) + deny = ChannelPermission._parse_rules( + permission_dict.get("deny", [])) + + return ChannelPermission( + group=permission_dict["group"], + allow=allow, + deny=deny, + recursive=permission_dict.get("recursive", True), + enabled=permission_dict.get("enabled", True)) + + @staticmethod + def _parse_rule(rule: str) -> int: + return getattr(Murmur, "Permission" + rule) + + @staticmethod + def _parse_rules(rules: List[str]) -> int: + result = 0 + for rule in rules: + result |= ChannelPermission._parse_rule(rule) + return result + + +class Channel: + def __init__(self, name: str, description: str = "", position: int = 0, + groups: List[ChannelGroup] = [], + permissions: List[ChannelPermission] = [], + inherit: bool = True, isdefault: bool = False, + parent: "Channel" = None): + self.id = -1 + self.name = name + self.description = description + self.position = position + self.groups = groups + self.permissions = permissions + self.inherit = inherit + self.isdefault = isdefault + self.parent = parent + self.children = [] + + def __str__(self) -> str: + return self.name + + def get_state(self) -> Murmur.Channel: + if self.parent is None: + parent_id = 0 + else: + parent_id = self.parent.id + + return Murmur.Channel( + id=self.id, + name=self.name, + description=self.description, + position=self.position, + parent=parent_id) + + def add(self, channel: "Channel") -> None: + self.children.append(channel) + channel.parent = self + + @staticmethod + def from_dict(channel_dict: Dict[str, object]) -> "Channel": + if "parent" in channel_dict: + parent = Channel(channel_dict["parent"]) + else: + parent = None + + groups = [] + for group_name, group_dict in channel_dict.get("groups", {}).items(): + group_dict["name"] = group_name + group = ChannelGroup.from_dict(group_dict) + groups.append(group) + + permissions = [] + for permission_dict in channel_dict.get("permissions", []): + permission = ChannelPermission.from_dict(permission_dict) + permissions.append(permission) + + return Channel( + name=channel_dict["name"], + description=channel_dict.get("description", ''), + position=channel_dict.get("position", 0), + groups=groups, + permissions=permissions, + inherit=channel_dict.get("inherit", True), + isdefault=channel_dict.get("isdefault", False), + parent=parent) + + +class MurmurServer: + def __init__(self, server: Murmur.Server): + self._server = server + + def clear_acls(self, channel_id=0): + _, groups, inherit = self._server.getACL(0) + self._server.setACL(channel_id, [], groups, inherit) + + def clear_channels(self) -> None: + for channel_state in self._server.getChannels().values(): + if channel_state.id != 0 and channel_state.parent == 0: + self._server.removeChannel(channel_state.id) + self.clear_acls() + + def set_channel_acls(self, channel: Channel) -> None: + acls = [] + for permission in channel.permissions: + acl = permission.get_acl() + acls.append(acl) + + _, current_groups, _ = self._server.getACL(channel.id) + current_group_names = {group.name: group for group in current_groups} + + groups = [] + for group in channel.groups: + group_state = group.get_state() + if group.name in current_group_names: + current_group_state = current_group_names[group.name] + group_state.add = current_group_state.add + group_state.remove = current_group_state.remove + del current_group_names[group.name] + groups.append(group_state) + groups.extend(current_group_names.values()) + + self._server.setACL(channel.id, acls, groups, channel.inherit) + + def create_channels(self, channel: Channel) -> None: + if channel.parent is None: + channel.id = 0 + else: + channel.id = self._server.addChannel( + channel.name, + channel.parent.id) + + self._server.setChannelState(channel.get_state()) + self.set_channel_acls(channel) + + if channel.isdefault: + self._server.setConf("defaultchannel", str(channel.id)) + + for child in channel.children: + self.create_channels(child) + + +class Config: + def __init__(self, filename: str = None): + self.filename = filename + self._data = {} + + self.load(filename) + + def load(self, filename: str = None): + if not filename: + for config_path in CONFIG_SEARCH_PATH: + filename = os.path.join(config_path, CONFIG_DEFAULT_NAME) + if os.path.exists(filename) and os.path.isfile(filename): + break + + with open(filename, 'r') as ifd: + self._data = yaml.safe_load(ifd) + + def parse_channels(self) -> Channel: + channels = [] + for channel_dict in self._data["channels"]: + channel = Channel.from_dict(channel_dict) + channels.append(channel) + + channel_names = {channel.name: channel for channel in channels} + for channel in channels: + if channel.parent is None: + continue + if channel.parent.name not in channel_names: + continue + channel_names[channel.parent.name].add(channel) + + root_channels = [channel for channel in channels + if channel.parent is None] + + if len(root_channels) == 0: + raise RuntimeError("No root channel found.") + + if len(root_channels) > 1: + root_names = root_channels.join(', ') + raise RuntimeError(f"Multiple root channels found: {root_names}") + + default_channels = [channel for channel in channels + if channel.isdefault] + + if len(default_channels) > 1: + default_names = default_channels.join(', ') + raise RuntimeError("Multiple default channels found: " + f"{default_names}") + + return root_channels[0] + + +def main(): + parser = argparse.ArgumentParser( + description="Manage Mumble server through ICE connection", + formatter_class=argparse.ArgumentDefaultsHelpFormatter + ) + parser.add_argument("--host", "-H", default=ICE_DEFAULT_HOST, + help="ICE host or ip") + parser.add_argument("--port", "-p", default=ICE_DEFAULT_PORT, + help="ICE port number") + parser.add_argument("--timeout", "-t", default=ICE_DEFAULT_TIMEOUT, + help="Connection timeout in milliseconds") + parser.add_argument("--secret", "-s", + default=os.environ.get("MICE_SECRET"), + help="ICE write secret") + parser.add_argument("--server-id", "-i", type=int, default=0, + help="Server ID to manage") + parser.add_argument("--config", "-c", + help="Path to the config file.") + args = parser.parse_args() + + config = Config(args.config) + root_channel = config.parse_channels() + + server_id = args.server_id + try: + with Mice(args.host, args.port, args.secret, args.timeout) as mice: + if not 0 <= server_id < len(mice.servers): + raise RuntimeError(f"Cannot find server with ID {server_id}") + server = mice.servers[server_id] + + server.clear_channels() + server.create_channels(root_channel) + except RuntimeError as e: + logging.error(e, exc_info=e) + return 1 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/handlers/main.yml b/handlers/main.yml index bb55ed2..e2c4a57 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -12,6 +12,13 @@ when: - not (umurmur_started.changed | default(false)) +- name: restart murmur + service: + name: mumble-server + state: restarted + when: + - not (murmur_started.changed | default(false)) + - name: reload mumble-web service: name: mumble-web @@ -20,4 +27,17 @@ - not (mumble_web_started.changed | default(false)) - name: reload nginx - include_tasks: ../handlers/nginx.yml \ No newline at end of file + include_tasks: ../handlers/nginx.yml + +- name: change murmur superuser password + command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}" + # See https://github.com/mumble-voip/mumble/issues/3911 + # Should be fixed in 1.3.1 + failed_when: no + +- name: create murmur channels + command: + cmd: ./mice.py -c {{ murmur_ice_config_path | quote }} + chdir: "{{ murmur_ice_script_dir }}" + environment: + MICE_SECRET: "{{ murmur_ice_secret_write }}" \ No newline at end of file diff --git a/meta/main.yml b/meta/main.yml index e2d533c..2c1a29d 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -1,11 +1,11 @@ dependencies: - role: ppbe.acme - tags: [acme] + tags: [never] - role: geerlingguy.nodejs vars: nodejs_install_npm_user: root - tags: [nodejs,mumble_web] + tags: [never] galaxy_info: role_name: mumble diff --git a/molecule/default/INSTALL.rst b/molecule/default/INSTALL.rst new file mode 100644 index 0000000..0c4bf5c --- /dev/null +++ b/molecule/default/INSTALL.rst @@ -0,0 +1,23 @@ +********************************* +Vagrant driver installation guide +********************************* + +Requirements +============ + +* Vagrant +* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop + +Install +======= + +Please refer to the `Virtual environment`_ documentation for installation best +practices. If not using a virtual environment, please consider passing the +widely recommended `'--user' flag`_ when invoking ``pip``. + +.. _Virtual environment: https://virtualenv.pypa.io/en/latest/ +.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site + +.. code-block:: bash + + $ pip install 'molecule_vagrant' diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml new file mode 100644 index 0000000..16fe642 --- /dev/null +++ b/molecule/default/converge.yml @@ -0,0 +1,14 @@ +--- +- name: Converge + hosts: all + become: yes + + vars: + mumble_web_enabled: yes + murmur_enabled: yes + umurmur_enabled: yes + umurmur_port: 64739 + acme_enabled: no + + roles: + - ansible-role-mumble \ No newline at end of file diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml new file mode 100644 index 0000000..a7c6836 --- /dev/null +++ b/molecule/default/molecule.yml @@ -0,0 +1,79 @@ +--- +.hardware: &hardware + memory: 1024 + cpu: 2 + +dependency: + name: galaxy +driver: + name: vagrant + provider: + name: virtualbox +platforms: + - name: buster-mumble-molecule + box: debian/buster64 + <<: *hardware + interfaces: + # Mumble web client + - network_name: forwarded_port + guest: 80 + host: 8080 + - network_name: forwarded_port + guest: 443 + host: 8443 + # Murmur server + - network_name: forwarded_port + guest: 64738 + host: 14738 + protocol: udp + - network_name: forwarded_port + guest: 64738 + host: 14738 + protocol: tcp + # Umurmur server + - network_name: forwarded_port + guest: 64739 + host: 14739 + protocol: udp + - network_name: forwarded_port + guest: 64739 + host: 14739 + protocol: tcp + - name: focal-mumble-molecule + box: ubuntu/focal64 + <<: *hardware + interfaces: + # Mumble web client + - network_name: forwarded_port + guest: 80 + host: 9080 + - network_name: forwarded_port + guest: 443 + host: 9443 + # Murmur server + - network_name: forwarded_port + guest: 64738 + host: 24738 + protocol: udp + - network_name: forwarded_port + guest: 64738 + host: 24738 + protocol: tcp + # Umurmur server + - network_name: forwarded_port + guest: 64739 + host: 24739 + protocol: udp + - network_name: forwarded_port + guest: 64739 + host: 24739 + protocol: tcp +provisioner: + name: ansible + config_options: + defaults: + interpreter_python: /usr/bin/python3 + ssh_connection: + pipelining: true +verifier: + name: ansible \ No newline at end of file diff --git a/molecule/default/prepare.yml b/molecule/default/prepare.yml new file mode 100644 index 0000000..3ebb94c --- /dev/null +++ b/molecule/default/prepare.yml @@ -0,0 +1,14 @@ +- name: Prepare + hosts: all + become: yes + + tasks: + - name: Update apt cache + apt: + update_cache: yes + cache_valid_time: 3600 + + - name: Install nginx package + package: + name: nginx-light + state: present \ No newline at end of file diff --git a/molecule/mumble-web/INSTALL.rst b/molecule/mumble-web/INSTALL.rst new file mode 100644 index 0000000..0c4bf5c --- /dev/null +++ b/molecule/mumble-web/INSTALL.rst @@ -0,0 +1,23 @@ +********************************* +Vagrant driver installation guide +********************************* + +Requirements +============ + +* Vagrant +* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop + +Install +======= + +Please refer to the `Virtual environment`_ documentation for installation best +practices. If not using a virtual environment, please consider passing the +widely recommended `'--user' flag`_ when invoking ``pip``. + +.. _Virtual environment: https://virtualenv.pypa.io/en/latest/ +.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site + +.. code-block:: bash + + $ pip install 'molecule_vagrant' diff --git a/molecule/mumble-web/converge.yml b/molecule/mumble-web/converge.yml new file mode 100644 index 0000000..2f3911c --- /dev/null +++ b/molecule/mumble-web/converge.yml @@ -0,0 +1,13 @@ +--- +- name: Converge + hosts: all + become: yes + + vars: + mumble_web_enabled: yes + murmur_enabled: yes + umurmur_enabled: no + acme_enabled: no + + roles: + - ansible-role-mumble \ No newline at end of file diff --git a/molecule/mumble-web/molecule.yml b/molecule/mumble-web/molecule.yml new file mode 100644 index 0000000..e20127c --- /dev/null +++ b/molecule/mumble-web/molecule.yml @@ -0,0 +1,43 @@ +--- +.hardware: &hardware + memory: 1024 + cpu: 2 + +dependency: + name: galaxy +driver: + name: vagrant + provider: + name: virtualbox +platforms: + - name: buster-mumble-molecule + box: debian/buster64 + <<: *hardware + interfaces: + # Mumble web client + - network_name: forwarded_port + guest: 80 + host: 8080 + - network_name: forwarded_port + guest: 443 + host: 8443 + - name: focal-mumble-molecule + box: ubuntu/focal64 + <<: *hardware + interfaces: + # Mumble web client + - network_name: forwarded_port + guest: 80 + host: 9080 + - network_name: forwarded_port + guest: 443 + host: 9443 +provisioner: + name: ansible + config_options: + defaults: + interpreter_python: /usr/bin/python3 + ssh_connection: + pipelining: true +verifier: + name: ansible \ No newline at end of file diff --git a/molecule/mumble-web/prepare.yml b/molecule/mumble-web/prepare.yml new file mode 100644 index 0000000..3ebb94c --- /dev/null +++ b/molecule/mumble-web/prepare.yml @@ -0,0 +1,14 @@ +- name: Prepare + hosts: all + become: yes + + tasks: + - name: Update apt cache + apt: + update_cache: yes + cache_valid_time: 3600 + + - name: Install nginx package + package: + name: nginx-light + state: present \ No newline at end of file diff --git a/molecule/murmur/INSTALL.rst b/molecule/murmur/INSTALL.rst new file mode 100644 index 0000000..0c4bf5c --- /dev/null +++ b/molecule/murmur/INSTALL.rst @@ -0,0 +1,23 @@ +********************************* +Vagrant driver installation guide +********************************* + +Requirements +============ + +* Vagrant +* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop + +Install +======= + +Please refer to the `Virtual environment`_ documentation for installation best +practices. If not using a virtual environment, please consider passing the +widely recommended `'--user' flag`_ when invoking ``pip``. + +.. _Virtual environment: https://virtualenv.pypa.io/en/latest/ +.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site + +.. code-block:: bash + + $ pip install 'molecule_vagrant' diff --git a/molecule/murmur/converge.yml b/molecule/murmur/converge.yml new file mode 100644 index 0000000..da7913e --- /dev/null +++ b/molecule/murmur/converge.yml @@ -0,0 +1,14 @@ +--- +- name: Converge + hosts: all + become: yes + + vars: + mumble_web_enabled: no + murmur_enabled: yes + umurmur_enabled: no + umurmur_port: 64739 + acme_enabled: no + + roles: + - ansible-role-mumble \ No newline at end of file diff --git a/molecule/murmur/molecule.yml b/molecule/murmur/molecule.yml new file mode 100644 index 0000000..811c299 --- /dev/null +++ b/molecule/murmur/molecule.yml @@ -0,0 +1,47 @@ +--- +.hardware: &hardware + memory: 1024 + cpu: 2 + +dependency: + name: galaxy +driver: + name: vagrant + provider: + name: virtualbox +platforms: + - name: buster-mumble-molecule + box: debian/buster64 + <<: *hardware + interfaces: + # Murmur server + - network_name: forwarded_port + guest: 64738 + host: 14738 + protocol: udp + - network_name: forwarded_port + guest: 64738 + host: 14738 + protocol: tcp + - name: focal-mumble-molecule + box: ubuntu/focal64 + <<: *hardware + interfaces: + # Murmur server + - network_name: forwarded_port + guest: 64738 + host: 24738 + protocol: udp + - network_name: forwarded_port + guest: 64738 + host: 24738 + protocol: tcp +provisioner: + name: ansible + config_options: + defaults: + interpreter_python: /usr/bin/python3 + ssh_connection: + pipelining: true +verifier: + name: ansible \ No newline at end of file diff --git a/molecule/murmur/prepare.yml b/molecule/murmur/prepare.yml new file mode 100644 index 0000000..bc3a569 --- /dev/null +++ b/molecule/murmur/prepare.yml @@ -0,0 +1,9 @@ +- name: Prepare + hosts: all + become: yes + + tasks: + - name: Update apt cache + apt: + update_cache: yes + cache_valid_time: 3600 \ No newline at end of file diff --git a/molecule/umurmur/INSTALL.rst b/molecule/umurmur/INSTALL.rst new file mode 100644 index 0000000..0c4bf5c --- /dev/null +++ b/molecule/umurmur/INSTALL.rst @@ -0,0 +1,23 @@ +********************************* +Vagrant driver installation guide +********************************* + +Requirements +============ + +* Vagrant +* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop + +Install +======= + +Please refer to the `Virtual environment`_ documentation for installation best +practices. If not using a virtual environment, please consider passing the +widely recommended `'--user' flag`_ when invoking ``pip``. + +.. _Virtual environment: https://virtualenv.pypa.io/en/latest/ +.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site + +.. code-block:: bash + + $ pip install 'molecule_vagrant' diff --git a/molecule/umurmur/converge.yml b/molecule/umurmur/converge.yml new file mode 100644 index 0000000..cd7c341 --- /dev/null +++ b/molecule/umurmur/converge.yml @@ -0,0 +1,13 @@ +--- +- name: Converge + hosts: all + become: yes + + vars: + mumble_web_enabled: no + murmur_enabled: no + umurmur_enabled: yes + acme_enabled: no + + roles: + - ansible-role-mumble \ No newline at end of file diff --git a/molecule/umurmur/molecule.yml b/molecule/umurmur/molecule.yml new file mode 100644 index 0000000..651da13 --- /dev/null +++ b/molecule/umurmur/molecule.yml @@ -0,0 +1,47 @@ +--- +.hardware: &hardware + memory: 1024 + cpu: 2 + +dependency: + name: galaxy +driver: + name: vagrant + provider: + name: virtualbox +platforms: + - name: buster-mumble-molecule + box: debian/buster64 + <<: *hardware + interfaces: + # Umurmur server + - network_name: forwarded_port + guest: 64738 + host: 14738 + protocol: udp + - network_name: forwarded_port + guest: 64738 + host: 14738 + protocol: tcp + - name: focal-mumble-molecule + box: ubuntu/focal64 + <<: *hardware + interfaces: + # Umurmur server + - network_name: forwarded_port + guest: 64738 + host: 24738 + protocol: udp + - network_name: forwarded_port + guest: 64738 + host: 24738 + protocol: tcp +provisioner: + name: ansible + config_options: + defaults: + interpreter_python: /usr/bin/python3 + ssh_connection: + pipelining: true +verifier: + name: ansible \ No newline at end of file diff --git a/molecule/umurmur/prepare.yml b/molecule/umurmur/prepare.yml new file mode 100644 index 0000000..bc3a569 --- /dev/null +++ b/molecule/umurmur/prepare.yml @@ -0,0 +1,9 @@ +- name: Prepare + hosts: all + become: yes + + tasks: + - name: Update apt cache + apt: + update_cache: yes + cache_valid_time: 3600 \ No newline at end of file diff --git a/tasks/dhparam/begin.yml b/tasks/dhparam/begin.yml new file mode 100644 index 0000000..48d7c39 --- /dev/null +++ b/tasks/dhparam/begin.yml @@ -0,0 +1,21 @@ +- name: Ensure Diffie-Hellman directory exists + file: + path: "{{ mumble_web_nginx_dhparam | dirname }}" + state: directory + owner: root + group: www-data + mode: "755" + +- name: Generate Diffie-Hellman parameters + # This can take a long time... So we are doing it in async mode + openssl_dhparam: + path: "{{ mumble_web_nginx_dhparam }}" + state: present + owner: root + group: www-data + mode: "640" + size: "{{ mumble_web_nginx_dhparam_size }}" + async: 3600 + poll: 0 + changed_when: no + register: _mumble_web_nginx_dhparam \ No newline at end of file diff --git a/tasks/dhparam/end.yml b/tasks/dhparam/end.yml new file mode 100644 index 0000000..0279618 --- /dev/null +++ b/tasks/dhparam/end.yml @@ -0,0 +1,7 @@ +- name: Waiting for Diffie-Hellman task to complete… + async_status: + jid: "{{ _mumble_web_nginx_dhparam.ansible_job_id }}" + register: _mumble_web_nginx_dhparam_job + retries: 60 + delay: 30 # will retry every 30s for 30min (60 retries) + until: _mumble_web_nginx_dhparam_job.finished \ No newline at end of file diff --git a/tasks/main.yml b/tasks/main.yml index ead630d..b9b3bd8 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,11 +1,51 @@ -- name: Install and configure umurmur server +- name: Generate Diffie-Hellman parameters in async mode + import_tasks: dhparam/begin.yml + when: mumble_web_enabled and mumble_web_nginx_generate_dhparam + tags: + - certificate + - dhparam + +- name: Install ACME certificates + import_role: + name: ppbe.acme + when: acme_enabled + tags: + - certificate + - acme + +- name: Install Self-Signed certificates + include_tasks: self_signed.yml + loop: "{{ acme_domains | unique }}" + loop_control: + loop_var: domain_name + when: not acme_enabled + tags: + - certificate + - self_signed + +- name: Deploy uMurmur server import_tasks: umurmur.yml + when: umurmur_enabled tags: umurmur -- name: Install and configure mumble web client +- name: Deploy Murmur server + import_tasks: murmur.yml + when: murmur_enabled + tags: murmur + +- name: Deploy mumble web client import_tasks: mumble_web.yml + when: mumble_web_enabled tags: mumble_web +- name: Wait for Diffie-Hellman task to complete + import_tasks: dhparam/end.yml + when: mumble_web_enabled and mumble_web_nginx_generate_dhparam + tags: + - certificate + - dhparam + - name: Configure Nginx for mumble web client import_tasks: nginx.yml + when: mumble_web_enabled and mumble_web_nginx_enabled tags: nginx \ No newline at end of file diff --git a/tasks/mumble_web.yml b/tasks/mumble_web.yml index df835a9..764af2d 100644 --- a/tasks/mumble_web.yml +++ b/tasks/mumble_web.yml @@ -1,5 +1,16 @@ +- name: Install NodeJS + import_role: + name: geerlingguy.nodejs + tags: nodejs + +- name: Install git package + package: + name: git + state: present + tags: mumble_web_install + - name: Install websockify - apt: + package: name: websockify state: present notify: reload mumble-web @@ -36,13 +47,18 @@ become_user: "{{ mumble_web_owner }}" tags: mumble_web_install +- name: Check if mumble-web dist directory exists + stat: + path: "{{ mumble_web_www_dir }}/dist" + register: _mumble_web_dist + - name: Build mumble-web from sources command: npm clean-install args: chdir: "{{ mumble_web_www_dir }}" register: _mumble_web_installed become_user: "{{ mumble_web_owner }}" - when: mumble_web_cloned is changed + when: mumble_web_cloned is changed or not _mumble_web_dist.stat.exists tags: [mumble_web_install,mumble_web_build] - name: Copy mumble-web config file diff --git a/tasks/murmur.yml b/tasks/murmur.yml new file mode 100644 index 0000000..81c2b8b --- /dev/null +++ b/tasks/murmur.yml @@ -0,0 +1,95 @@ +- name: Install mumble-server package + package: + name: mumble-server + state: present + register: murmur_installed + +- name: Install ICE dependencies for Python + package: + name: "{{ package }}" + state: present + loop: + - python3-zeroc-ice + - python3-yaml + - zeroc-ice-compilers + loop_control: + loop_var: package + +- name: Append ssl-cert group to {{ murmur_owner }} user + user: + name: "{{ murmur_owner }}" + state: present + groups: + - "{{ acme_ssl_group }}" + append: yes + system: yes + notify: restart murmur + +- name: Copy Murmur config file + template: + src: mumble-server.ini.j2 + dest: /etc/mumble-server.ini + owner: root + group: "{{ murmur_group }}" + mode: "640" + notify: restart murmur + +- name: Start mumble-server service + service: + name: mumble-server + enabled: yes + state: started + +- name: Write superuser password to a file + copy: + content: "{{ murmur_superuser_password }}" + dest: /etc/mumble-server.secret + owner: root + group: root + mode: "600" + when: murmur_superuser_password is defined + notify: change murmur superuser password + +- name: Trigger Murmur handlers + meta: flush_handlers + +- name: Create mumble-ice directory + file: + path: "{{ murmur_ice_script_dir }}" + state: directory + owner: root + group: root + mode: "755" + +- name: Copy mice Python script + copy: + src: murmur/scripts/mice.py + dest: "{{ murmur_ice_script_dir }}/mice.py" + owner: root + group: root + mode: "755" + notify: create murmur channels + register: _murmur_mice_script_copied + +- name: Compile Murmur.ice slice file + command: |- + slice2py --checksum \ + -I/usr/local/share/Ice \ + -I/usr/share/Ice/slice \ + -I/usr/share/ice/slice \ + /usr/share/slice/Murmur.ice + args: + chdir: "{{ murmur_ice_script_dir }}" + when: _murmur_mice_script_copied is changed + +- name: Copy mice config + copy: + src: murmur/mice.yml + dest: "{{ murmur_ice_config_path }}" + owner: root + group: root + mode: "644" + notify: create murmur channels + +- name: Trigger Mice handlers + meta: flush_handlers \ No newline at end of file diff --git a/tasks/nginx.yml b/tasks/nginx.yml index 5e89113..5f9f7aa 100644 --- a/tasks/nginx.yml +++ b/tasks/nginx.yml @@ -1,7 +1,7 @@ - name: Copy Nginx config file template: src: nginx.conf.j2 - dest: /etc/nginx/sites-available/mumble.conf + dest: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf" owner: root group: www-data mode: "755" @@ -9,8 +9,8 @@ - name: Enable Nginx config file file: - src: /etc/nginx/sites-available/mumble.conf - path: /etc/nginx/sites-enabled/mumble.conf + src: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf" + path: "{{ mumble_web_nginx_config_dir }}/sites-enabled/mumble.conf" state: link notify: reload nginx diff --git a/tasks/self_signed.yml b/tasks/self_signed.yml new file mode 100644 index 0000000..c3b38df --- /dev/null +++ b/tasks/self_signed.yml @@ -0,0 +1,64 @@ +- name: Install SSL dependencies + package: + name: "{{ package }}" + state: present + loop: + - ssl-cert + - python3-openssl + loop_control: + loop_var: package + tags: selfsigned_install + +- name: Create SSL config directories + file: + path: "{{ config_dir }}" + state: directory + owner: root + group: "{{ acme_ssl_group }}" + mode: "711" + loop: + - "{{ acme_config_dir }}" + - "{{ acme_keys_dir }}" + - "{{ acme_accounts_dir }}" + - "{{ acme_csr_dir }}" + loop_control: + loop_var: config_dir + tags: selfsigned_install + +- name: Create {{ domain_name }} certificates directory + file: + path: "{{ acme_certs_dir }}/{{ domain_name }}.d" + state: directory + owner: root + group: "{{ acme_ssl_group }}" + mode: "755" + tags: selfsigned_install + +- name: Generate private key for {{ domain_name }} certificate + openssl_privatekey: + path: "{{ acme_keys_dir }}/{{ domain_name }}.pem" + owner: root + group: "{{ acme_ssl_group }}" + mode: "640" + type: RSA + size: 4096 + +- name: Generate CSR for {{ domain_name }} certificate + openssl_csr: + path: "{{ acme_csr_dir }}/{{ domain_name }}.csr" + owner: root + group: "{{ acme_ssl_group }}" + mode: "644" + privatekey_path: "{{ acme_keys_dir }}/{{ domain_name }}.pem" + common_name: "{{ domain_name }}" + +- name: Generate self-signed certificate + openssl_certificate: + path: "{{ acme_certs_dir }}/{{ domain_name }}.d/cert.pem" + csr_path: "{{ acme_csr_dir }}/{{ domain_name }}.csr" + privatekey_path: "{{ acme_keys_dir }}/{{ domain_name }}.pem" + provider: selfsigned + state: present + owner: root + group: "{{ acme_ssl_group }}" + mode: "644" \ No newline at end of file diff --git a/tasks/umurmur.yml b/tasks/umurmur.yml index 2996b35..d42af55 100644 --- a/tasks/umurmur.yml +++ b/tasks/umurmur.yml @@ -1,6 +1,7 @@ - name: Install umurmur build dependencies - apt: + package: name: "{{ package }}" + state: present loop: - git - build-essential @@ -82,10 +83,4 @@ register: umurmur_started - name: Trigger umurmur handlers - meta: flush_handlers - -- name: Open umurmur port with UFW - ufw: - rule: allow - port: "{{ umurmur_port }}" - when: umurmur_ispublic | bool \ No newline at end of file + meta: flush_handlers \ No newline at end of file diff --git a/templates/mumble-server.ini.j2 b/templates/mumble-server.ini.j2 new file mode 100644 index 0000000..7218af8 --- /dev/null +++ b/templates/mumble-server.ini.j2 @@ -0,0 +1,325 @@ +{{ ansible_managed | comment(decoration="; ") }} +; Murmur configuration file. +; +; General notes: +; * Settings in this file are default settings and many of them can be overridden +; with virtual server specific configuration via the Ice or DBus interface. +; * Due to the way this configuration file is read some rules have to be +; followed when specifying variable values (as in variable = value): +; * Make sure to quote the value when using commas in strings or passwords. +; NOT variable = super,secret BUT variable = "super,secret" +; * Make sure to escape special characters like '\' or '"' correctly +; NOT variable = """ BUT variable = "\"" +; NOT regex = \w* BUT regex = \\w* + +; Path to database. If blank, will search for +; murmur.sqlite in default locations or create it if not found. +database={{ murmur_database.path | to_json }} + +; Murmur defaults to using SQLite with its default rollback journal. +; In some situations, using SQLite's write-ahead log (WAL) can be +; advantageous. +; If you encounter slowdowns when moving between channels and similar +; operations, enabling the SQLite write-ahead log might help. +; +; To use SQLite's write-ahead log, set sqlite_wal to one of the following +; values: +; +; 0 - Use SQLite's default rollback journal. +; 1 - Use write-ahead log with synchronous=NORMAL. +; If Murmur crashes, the database will be in a consistent state, but +; the most recent changes might be lost if the operating system did +; not write them to disk yet. This option can improve Murmur's +; interactivity on busy servers, or servers with slow storage. +; 2 - Use write-ahead log with synchronous=FULL. +; All database writes are synchronized to disk when they are made. +; If Murmur crashes, the database will be include all completed writes. +;sqlite_wal=0 + +; If you wish to use something other than SQLite, you'll need to set the name +; of the database above, and also uncomment the below. +; Sticking with SQLite is strongly recommended, as it's the most well tested +; and by far the fastest solution. +; +;dbDriver=QMYSQL +;dbUsername= +;dbPassword= +;dbHost= +;dbPort= +;dbPrefix=murmur_ +;dbOpts= +{% if murmur_database.driver is defined %} +dbDriver={{ murmur_database.driver | to_json }} +dbUsername={{ murmur_database.username | to_json }} +dbPassword={{ murmur_database.password | to_json }} +dbHost={{ murmur_database.host | default('localhost') | to_json }} +dbPort={{ murmur_database.port }} +dbPrefix={{ murmur_database.prefix | default('') | to_json }} +dbOpts={{ murmur_database.opts | default('') | to_json }} +{% endif %} + +; Murmur defaults to not using D-Bus. If you wish to use dbus, which is one of the +; RPC methods available in Murmur, please specify so here. +; +;dbus=session + +; Alternate D-Bus service name. Only use if you are running distinct +; murmurd processes connected to the same D-Bus daemon. +;dbusservice=net.sourceforge.mumble.murmur + +; If you want to use ZeroC Ice to communicate with Murmur, you need +; to specify the endpoint to use. Since there is no authentication +; with ICE, you should only use it if you trust all the users who have +; shell access to your machine. +; Please see the ICE documentation on how to specify endpoints. +ice="tcp -h {{ murmur_ice_host | quote }} -p {{ murmur_ice_port | int }}" + +; Ice primarily uses local sockets. This means anyone who has a +; user account on your machine can connect to the Ice services. +; You can set a plaintext "secret" on the Ice connection, and +; any script attempting to access must then have this secret +; (as context with name "secret"). +; Access is split in read (look only) and write (modify) +; operations. Write access always includes read access, +; unless read is explicitly denied (see note below). +; +; Note that if this is uncommented and with empty content, +; access will be denied. + +{% if murmur_ice_secret_read is defined %} +icesecretread={{ murmur_ice_secret_read | to_json }} +{% else %} +;icesecretread= +{% endif %} +{% if murmur_ice_secret_write is defined %} +icesecretwrite={{ murmur_ice_secret_write | to_json }} +{% else %} +;icesecretwrite= +{% endif %} + +; If you want to expose Murmur's experimental gRPC API, you +; need to specify an address to bind on. +; Note: not all builds of Murmur support gRPC. If gRPC is not +; available, Murmur will warn you in its log output. +;grpc="127.0.0.1:50051" +; Specifying both a certificate and key file below will cause gRPC to use +; secured, TLS connections. +;grpccert="" +;grpckey="" + +; How many login attempts do we tolerate from one IP +; inside a given timeframe before we ban the connection? +; Note that this is global (shared between all virtual servers), and that +; it counts both successfull and unsuccessfull connection attempts. +; Set either Attempts or Timeframe to 0 to disable. +;autobanAttempts = 10 +;autobanTimeframe = 120 +;autobanTime = 300 +autobanAttempts={{ murmur_autoban_attempts }} +autobanTimeframe={{ murmur_autoban_timeframe }} +autobanTime={{ murmur_autoban_time }} + +; Specifies the file Murmur should log to. By default, Murmur +; logs to the file 'murmur.log'. If you leave this field blank +; on Unix-like systems, Murmur will force itself into foreground +; mode which logs to the console. +;logfile=murmur.log +logfile={{ murmur_log_file | to_json }} + +; If set, Murmur will write its process ID to this file +; when running in daemon mode (when the -fg flag is not +; specified on the command line). Only available on +; Unix-like systems. +;pidfile= +pidfile={{ murmur_pid_file | to_json }} + +; The below will be used as defaults for new configured servers. +; If you're just running one server (the default), it's easier to +; configure it here than through D-Bus or Ice. +; +; Welcome message sent to clients when they connect. +; If the welcome message is set to an empty string, +; no welcome message will be sent to clients. +welcometext={{ murmur_welcome_text | to_json }} + +; Port to bind TCP and UDP sockets to. +port={{ murmur_port }} + +; Specific IP or hostname to bind to. +; If this is left blank (default), Murmur will bind to all available addresses. +;host= +host={{ murmur_host | to_json }} + +; Password to join server. +serverpassword={{ murmur_server_password | to_json }} + +; Maximum bandwidth (in bits per second) clients are allowed +; to send speech at. +bandwidth={{ murmur_max_bandwidth }} + +; Maximum number of concurrent clients allowed. +users={{ murmur_max_users }} + +; Per-user rate limiting +; +; These two settings allow to configure the per-user rate limiter for some +; command messages sent from the client to the server. The messageburst setting +; specifies an amount of messages which are allowed in short bursts. The +; messagelimit setting specifies the number of messages per second allowed over +; a longer period. If a user hits the rate limit, his packages are then ignored +; for some time. Both of these settings have a minimum of 1 as setting either to +; 0 could render the server unusable. +messageburst=5 +messagelimit=1 + +; Respond to UDP ping packets. +; +; Setting to true exposes the current user count, the maximum user count, and +; the server's maximum bandwidth per client to unauthenticated users. In the +; Mumble client, this information is shown in the Connect dialog. +allowping=true + +; Amount of users with Opus support needed to force Opus usage, in percent. +; 0 = Always enable Opus, 100 = enable Opus if it's supported by all clients. +;opusthreshold=100 +opusthreshold={{ murmur_opus_threshold }} + +; Maximum depth of channel nesting. Note that some databases like MySQL using +; InnoDB will fail when operating on deeply nested channels. +;channelnestinglimit=10 +channelnestinglimit={{ murmur_channel_nesting_limit }} + +; Maximum number of channels per server. 0 for unlimited. Note that an +; excessive number of channels will impact server performance +;channelcountlimit=1000 +channelcountlimit={{ murmur_channel_count_limit }} + +; Regular expression used to validate channel names. +; (Note that you have to escape backslashes with \ ) +;channelname=[ \\-=\\w\\#\\[\\]\\{\\}\\(\\)\\@\\|]+ +{% if murmur_channel_name_regex is defined %} +channelname={{ murmur_channel_name_regex }} +{% endif %} + +; Regular expression used to validate user names. +; (Note that you have to escape backslashes with \ ) +;username=[-=\\w\\[\\]\\{\\}\\(\\)\\@\\|\\.]+ +{% if murmur_username_regex is defined %} +username={{ murmur_username_regex }} +{% endif %} + +; Maximum length of text messages in characters. 0 for no limit. +;textmessagelength=5000 +textmessagelength={{ murmur_text_message_max_length }} + +; Maximum length of text messages in characters, with image data. 0 for no limit. +;imagemessagelength=131072 +imagemessagelength={{ murmur_image_message_max_length }} + +; Allow clients to use HTML in messages, user comments and channel descriptions? +;allowhtml=true +allowhtml={{ murmur_allow_html }} + +; Murmur retains the per-server log entries in an internal database which +; allows it to be accessed over D-Bus/ICE. +; How many days should such entries be kept? +; Set to 0 to keep forever, or -1 to disable logging to the DB. +;logdays=31 +logdays={{ murmur_log_days }} + +{% if murmur_register_enabled %} +; To enable public server registration, the serverpassword must be blank, and +; this must all be filled out. +; The password here is used to create a registry for the server name; subsequent +; updates will need the same password. Don't lose your password. +; The URL is your own website, and only set the registerHostname for static IP +; addresses. +; Only uncomment the 'registerName' parameter if you wish to give your "Root" channel a custom name. +; +registerName={{ murmur_register.name | to_json }} +registerPassword={{ murmur_register.password | to_json }} +registerUrl={{ murmur_register.url | to_json }} +registerHostname={{ murmur_register.hostname | to_json }} +{% endif %} + +; If this option is enabled, the server will announce its presence via the +; bonjour service discovery protocol. To change the name announced by bonjour +; adjust the registerName variable. +; See http://developer.apple.com/networking/bonjour/index.html for more information +; about bonjour. +;bonjour=True +bonjour={{ murmur_bonjour_enabled }} + +; If you have a proper SSL certificate, you can provide the filenames here. +; Otherwise, Murmur will create its own certificate automatically. +;sslCert= +;sslKey= +sslCert={{ murmur_certificate | to_json }} +sslKey={{ murmur_private_key | to_json }} +{% if acme_enabled %} +sslCa={{ murmur_trusted_certificate | to_json }} +{% endif %} + +; The sslDHParams option allows you to specify a PEM-encoded file with +; Diffie-Hellman parameters, which will be used as the default Diffie- +; Hellman parameters for all virtual servers. +; +; Instead of pointing sslDHParams to a file, you can also use the option +; to specify a named set of Diffie-Hellman parameters for Murmur to use. +; Murmur comes bundled with the Diffie-Hellman parameters from RFC 7919. +; These parameters are available by using the following names: +; +; @ffdhe2048, @ffdhe3072, @ffdhe4096, @ffdhe6144, @ffdhe8192 +; +; By default, Murmur uses @ffdhe2048. +sslDHParams={{ murmur_dhparam | to_json }} + +; The sslCiphers option chooses the cipher suites to make available for use +; in SSL/TLS. This option is server-wide, and cannot be set on a +; per-virtual-server basis. +; +; This option is specified using OpenSSL cipher list notation (see +; https://www.openssl.org/docs/apps/ciphers.html#CIPHER-LIST-FORMAT). +; +; It is recommended that you try your cipher string using 'openssl ciphers ' +; before setting it here, to get a feel for which cipher suites you will get. +; +; After setting this option, it is recommend that you inspect your Murmur log +; to ensure that Murmur is using the cipher suites that you expected it to. +; +; Note: Changing this option may impact the backwards compatibility of your +; Murmur server, and can remove the ability for older Mumble clients to be able +; to connect to it. +;sslCiphers=EECDH+AESGCM:EDH+aRSA+AESGCM:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA + +; If Murmur is started as root, which user should it switch to? +; This option is ignored if Murmur isn't started with root privileges. +;uname= +uname={{ murmur_owner }} + +; If this options is enabled, only clients which have a certificate are allowed +; to connect. +;certrequired=False +certrequired={{ murmur_client_certificate_required }} + +; If enabled, clients are sent information about the servers version and operating +; system. +;sendversion=True +sendversion={{ murmur_send_server_version }} + +; This sets password hash storage to legacy mode (1.2.4 and before) +; (Note that setting this to true is insecure and should not be used unless absolutely necessary) +;legacyPasswordHash=false + +; By default a strong amount of PBKDF2 iterations are chosen automatically. If >0 this setting +; overrides the automatic benchmark and forces a specific number of iterations. +; (Note that you should only change this value if you know what you are doing) +;kdfIterations=-1 + +; You can configure any of the configuration options for Ice here. We recommend +; leave the defaults as they are. +; Please note that this section has to be last in the configuration file. +; +[Ice] +Ice.Warn.UnknownProperties={{ murmur_ice_warn_unknown_properties | int }} +Ice.MessageSizeMax={{ murmur_ice_message_size_max }} diff --git a/templates/mumble-web.js.j2 b/templates/mumble-web.js.j2 index b18d954..e118056 100644 --- a/templates/mumble-web.js.j2 +++ b/templates/mumble-web.js.j2 @@ -13,7 +13,7 @@ let config = window.mumbleWebConfig // eslint-disable-line no-unused-vars config.connectDialog.address = false config.connectDialog.port = false config.connectDialog.token = false -config.connectDialog.password = {{ (umurmur_user_password != '') | lower }} +config.connectDialog.password = {{ (umurmur_server_password != '') | lower }} // Default values for user settings // You can see your current value by typing `localStorage.getItem('mumble.$setting')` in the web console. diff --git a/templates/nginx.conf.j2 b/templates/nginx.conf.j2 index 976abe9..b82c172 100644 --- a/templates/nginx.conf.j2 +++ b/templates/nginx.conf.j2 @@ -8,7 +8,7 @@ server { return 301 https://$host$request_uri; } -{% if acme_challenge_dir is defined %} +{% if acme_enabled and acme_challenge_dir is defined %} location ^~ /.well-known/acme-challenge/ { allow all; root {{ acme_challenge_dir }}; @@ -30,8 +30,8 @@ server { ssl_session_cache shared:AnsibleSSL:10m; # about 40000 sessions ssl_session_tickets off; -{% if mumble_web_dhparam is defined and mumble_web_dhparam != '' %} - ssl_dhparam {{ mumble_web_dhparam }}; +{% if mumble_web_nginx_dhparam %} + ssl_dhparam {{ mumble_web_nginx_dhparam }}; {% endif %} ssl_protocols TLSv1.2 TLSv1.3; @@ -44,8 +44,10 @@ server { ssl_stapling on; ssl_stapling_verify on; +{% if acme_enabled %} # Verify chain of trust of OCSP response using Root CA and Intermediate certs ssl_trusted_certificate {{ mumble_web_trusted_certificate }}; +{% endif %} location / { root /var/www/mumble-web/dist/; diff --git a/templates/umurmur.conf.j2 b/templates/umurmur.conf.j2 index eeb63fa..50c67f8 100644 --- a/templates/umurmur.conf.j2 +++ b/templates/umurmur.conf.j2 @@ -1,12 +1,13 @@ {{ ansible_managed | comment }} -max_bandwidth = 48000; -welcometext = {{ umurmur_welcome_text - if umurmur_welcome_text is string - else (umurmur_welcome_text | join('
')) - | to_json }}; +max_bandwidth = {{ umurmur_max_bandwidth }}; +{% if umurmur_welcome_text is string %} +welcometext = {{ umurmur_welcome_text | to_json }}; +{% else %} +welcometext = {{ umurmur_welcome_text | join('
') | to_json }}; +{% endif %} certificate = {{ umurmur_certificate | to_json }}; private_key = {{ umurmur_private_key | to_json }}; -password = {{ umurmur_user_password | to_json }}; +password = {{ umurmur_server_password | to_json }}; {% if umurmur_admin_password is defined %} admin_password = {{ umurmur_admin_password | to_json }}; # Set to enable admin functionality. {% endif %} diff --git a/vars/main.yml b/vars/main.yml new file mode 100644 index 0000000..3dcd39e --- /dev/null +++ b/vars/main.yml @@ -0,0 +1,2 @@ +murmur_ice_script_dir: /opt/mice +murmur_ice_config_path: /etc/mice.yml \ No newline at end of file