From 656c3a1cb150b055eb0caec347899de7256a8b70 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 14:01:16 +0200
Subject: [PATCH 01/14] allow to install murmur server

---
 defaults/main.yml              |  81 +++++++--
 handlers/main.yml              |   7 +
 tasks/main.yml                 |  12 +-
 tasks/murmur.yml               |  36 ++++
 templates/mumble-server.ini.j2 | 323 +++++++++++++++++++++++++++++++++
 templates/mumble-web.js.j2     |   2 +-
 templates/umurmur.conf.j2      |   4 +-
 7 files changed, 449 insertions(+), 16 deletions(-)
 create mode 100644 tasks/murmur.yml
 create mode 100644 templates/mumble-server.ini.j2

diff --git a/defaults/main.yml b/defaults/main.yml
index 4e170b2..c9961be 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,4 +1,73 @@
-umurmur_user_password: ""
+mumble_web_domain: "mumble.example.com"
+mumble_web_owner: mumble-web
+mumble_web_group: "{{ mumble_web_owner }}"
+mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/fullchain.pem"
+mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem"
+mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.pem"
+mumble_web_dhparam: "/etc/nginx/ssl/dhparam.pem"
+mumble_web_www_dir: /var/www/mumble-web
+mumble_web_version: master
+mumble_web_websockify_port: "64737"
+
+murmur_domain: "{{ mumble_web_domain }}"
+murmur_enabled: yes
+murmur_database:
+  path: "/var/lib/mumble-server/mumble-server.sqlite"
+  # driver: "QMYSQL"
+  # username: "mumble"
+  # password: "password"
+  # host: "localhost"
+  # port: 3306
+  # prefix: "murmur_"
+murmur_ice: "tcp -h 127.0.0.1 -p 6502"
+# murmur_icesecret_read: "somesecret"
+# murmur_ice_secret_write: "anothersecret"
+murmur_autoban_attempts: 10
+murmur_autoban_timeframe: 120
+murmur_autoban_time: 300
+murmur_log_file: "/var/log/mumble-server/mumble-server.log"
+murmur_pid_file: "/var/run/mumble-server/mumble-server.pid"
+murmur_welcome_text: "Welcome on the {{ inventory_hostname }} Mumble server!"
+murmur_port: 64738
+# Leave blank to let Murmur bind to all available addresses
+murmur_host: ""
+murmur_server_password: ""
+murmur_max_bandwidth: 72000
+murmur_max_users: 100
+murmur_opusthreshold: 100
+murmur_channel_nesting_limit: 10
+murmur_channel_count_limit: 1000
+# Regex to validate channel or usernames
+# murmur_channel_name_regex: ""
+# murmur_username_regex: ""
+murmur_text_message_max_length: 5000
+murmur_image_message_length: 131072
+murmur_allow_html: yes
+# Set to 0 to keep logs forever, or -1 to disable logging to the DB.
+murmur_log_days: -1
+# Name for root channel and entry in mumble main server list
+# murmur_register:
+#   name: "MyMumbleServerRegisterName"
+#   password: "password"
+#   url: "https://mymumbleserverurl.org"
+#   hostname: "mymumblehostname.domain.org"
+# Enable Bonjour for dev purpose
+murmur_bonjour_enabled: no
+murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/fullchain.pem"
+murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/chain.pem"
+murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domain }}.pem"
+murmur_dhparam: "@ffdhe4096"
+murmur_owner: "mumble-server"
+murmur_group: "{{ murmur_owner }}"
+murmur_client_certificate_required: no
+murmur_send_server_version: yes
+murmur_ice_warn_unknown_properties: 1
+murmur_ice_message_size_max: 65536
+
+umurmur_domain: "{{ mumble_web_domain }}"
+umurmur_enabled: yes
+umurmur_max_bandwidth: 48000
+umurmur_server_password: ""
 umurmur_channel_links:
 - source: "{{ umurmur_default_channel }}"
   destinations: >-
@@ -14,13 +83,3 @@ umurmur_private_key: "{{ acme_keys_dir }}/{{ umurmur_domain }}.pem"
 umurmur_version: master
 umurmur_ispublic: yes
 umurmur_port: "64738"
-
-mumble_web_owner: mumble-web
-mumble_web_group: "{{ mumble_web_owner }}"
-mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/fullchain.pem"
-mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem"
-mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.pem"
-mumble_web_dhparam: "/etc/nginx/ssl/dhparam.pem"
-mumble_web_www_dir: /var/www/mumble-web
-mumble_web_version: master
-mumble_web_websockify_port: "64737"
\ No newline at end of file
diff --git a/handlers/main.yml b/handlers/main.yml
index bb55ed2..8725e14 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -12,6 +12,13 @@
   when:
   - not (umurmur_started.changed | default(false))
 
+- name: restart murmur
+  service:
+    name: mumble-server
+    state: restarted
+  when:
+  - not (murmur_started.changed | default(false))
+
 - name: reload mumble-web
   service:
     name: mumble-web
diff --git a/tasks/main.yml b/tasks/main.yml
index ead630d..b8d5753 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -1,11 +1,19 @@
-- name: Install and configure umurmur server
+- name: Deploy uMurmur server
   import_tasks: umurmur.yml
+  when: umurmur_enabled
   tags: umurmur
 
-- name: Install and configure mumble web client
+- name: Deploy Murmur server
+  import_tasks: murmur.yml
+  when: murmur_enabled
+  tags: murmur
+
+- name: Deploy mumble web client
   import_tasks: mumble_web.yml
+  when: mumble_web_enabled
   tags: mumble_web
 
 - name: Configure Nginx for mumble web client
   import_tasks: nginx.yml
+  when: mumble_web_enabled
   tags: nginx
\ No newline at end of file
diff --git a/tasks/murmur.yml b/tasks/murmur.yml
new file mode 100644
index 0000000..b52b5d2
--- /dev/null
+++ b/tasks/murmur.yml
@@ -0,0 +1,36 @@
+- name: Install mumble-server package
+  apt:
+    name: mumble-server
+    state: present
+  register: murmur_installed
+
+- name: Copy Murmur config file
+  template:
+    src: mumble-server.ini.j2
+    dest: /etc/mumble-server.ini
+    owner: root
+    group: "{{ murmur_group }}"
+    mode: "640"
+  notify: restart murmur
+
+- name: Start mumble-server service
+  service:
+    name: mumble-server
+    enabled: yes
+    state: started
+
+# TODO: Handle superuser password
+
+# - name: Write superuser password to a file
+#   copy:
+#     content: "{{ murmur_superuser_password }}"
+#     dest: /etc/mumble-superuser
+#     owner: root
+#     group: root
+#     mode: "600"
+#   when: murmur_superuser_password is defined
+#   notify: set superuser password
+
+# - name: set superuser password
+#   command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}"
+#   failed_when: False
\ No newline at end of file
diff --git a/templates/mumble-server.ini.j2 b/templates/mumble-server.ini.j2
new file mode 100644
index 0000000..a4e1063
--- /dev/null
+++ b/templates/mumble-server.ini.j2
@@ -0,0 +1,323 @@
+{{ ansible_managed | comment(decoration="; ") }}
+; Murmur configuration file.
+;
+; General notes:
+; * Settings in this file are default settings and many of them can be overridden
+;   with virtual server specific configuration via the Ice or DBus interface.
+; * Due to the way this configuration file is read some rules have to be
+;   followed when specifying variable values (as in variable = value):
+;     * Make sure to quote the value when using commas in strings or passwords.
+;        NOT variable = super,secret BUT variable = "super,secret"
+;     * Make sure to escape special characters like '\' or '"' correctly
+;        NOT variable = """ BUT variable = "\""
+;        NOT regex = \w* BUT regex = \\w*
+
+; Path to database. If blank, will search for
+; murmur.sqlite in default locations or create it if not found.
+database={{ murmur_database.path | to_json }}
+
+; Murmur defaults to using SQLite with its default rollback journal.
+; In some situations, using SQLite's write-ahead log (WAL) can be
+; advantageous.
+; If you encounter slowdowns when moving between channels and similar
+; operations, enabling the SQLite write-ahead log might help.
+;
+; To use SQLite's write-ahead log, set sqlite_wal to one of the following
+; values:
+;
+; 0 - Use SQLite's default rollback journal.
+; 1 - Use write-ahead log with synchronous=NORMAL.
+;     If Murmur crashes, the database will be in a consistent state, but
+;     the most recent changes might be lost if the operating system did
+;     not write them to disk yet. This option can improve Murmur's
+;     interactivity on busy servers, or servers with slow storage.
+; 2 - Use write-ahead log with synchronous=FULL.
+;     All database writes are synchronized to disk when they are made.
+;     If Murmur crashes, the database will be include all completed writes.
+;sqlite_wal=0
+
+; If you wish to use something other than SQLite, you'll need to set the name
+; of the database above, and also uncomment the below.
+; Sticking with SQLite is strongly recommended, as it's the most well tested
+; and by far the fastest solution.
+;
+;dbDriver=QMYSQL
+;dbUsername=
+;dbPassword=
+;dbHost=
+;dbPort=
+;dbPrefix=murmur_
+;dbOpts=
+{% if murmur_database.driver is defined %}
+dbDriver={{ murmur_database.driver | to_json }}
+dbUsername={{ murmur_database.username | to_json }}
+dbPassword={{ murmur_database.password | to_json }}
+dbHost={{ murmur_database.host | default('localhost') | to_json }}
+dbPort={{ murmur_database.port }}
+dbPrefix={{ murmur_database.prefix | default('') | to_json }}
+dbOpts={{ murmur_database.opts | default('') | to_json }}
+{% endif %}
+
+; Murmur defaults to not using D-Bus. If you wish to use dbus, which is one of the
+; RPC methods available in Murmur, please specify so here.
+;
+;dbus=session
+
+; Alternate D-Bus service name. Only use if you are running distinct
+; murmurd processes connected to the same D-Bus daemon.
+;dbusservice=net.sourceforge.mumble.murmur
+
+; If you want to use ZeroC Ice to communicate with Murmur, you need
+; to specify the endpoint to use. Since there is no authentication
+; with ICE, you should only use it if you trust all the users who have
+; shell access to your machine.
+; Please see the ICE documentation on how to specify endpoints.
+ice="{{ murmur_ice }}"
+
+; Ice primarily uses local sockets. This means anyone who has a
+; user account on your machine can connect to the Ice services.
+; You can set a plaintext "secret" on the Ice connection, and
+; any script attempting to access must then have this secret
+; (as context with name "secret").
+; Access is split in read (look only) and write (modify)
+; operations. Write access always includes read access,
+; unless read is explicitly denied (see note below).
+;
+; Note that if this is uncommented and with empty content,
+; access will be denied.
+
+{% if murmur_ice_secret_read is defined %}
+icesecretread={{ murmur_ice_secret_read | to_json }}
+{% else %}
+;icesecretread=
+{% endif %}
+{% if murmur_ice_secret_write is defined %}
+icesecretwrite={{ murmur_ice_secret_write | to_json }}
+{% else %}
+icesecretwrite=
+{% endif %}
+
+; If you want to expose Murmur's experimental gRPC API, you
+; need to specify an address to bind on.
+; Note: not all builds of Murmur support gRPC. If gRPC is not
+; available, Murmur will warn you in its log output.
+;grpc="127.0.0.1:50051"
+; Specifying both a certificate and key file below will cause gRPC to use
+; secured, TLS connections.
+;grpccert=""
+;grpckey=""
+
+; How many login attempts do we tolerate from one IP
+; inside a given timeframe before we ban the connection?
+; Note that this is global (shared between all virtual servers), and that
+; it counts both successfull and unsuccessfull connection attempts.
+; Set either Attempts or Timeframe to 0 to disable.
+;autobanAttempts = 10
+;autobanTimeframe = 120
+;autobanTime = 300
+autobanAttempts={{ murmur_autoban_attempts }}
+autobanTimeframe={{ murmur_autoban_timeframe }}
+autobanTime={{ murmur_autoban_time }}
+
+; Specifies the file Murmur should log to. By default, Murmur
+; logs to the file 'murmur.log'. If you leave this field blank
+; on Unix-like systems, Murmur will force itself into foreground
+; mode which logs to the console.
+;logfile=murmur.log
+logfile={{ murmur_log_file | to_json }}
+
+; If set, Murmur will write its process ID to this file
+; when running in daemon mode (when the -fg flag is not
+; specified on the command line). Only available on
+; Unix-like systems.
+;pidfile=
+pidfile={{ murmur_pid_file | to_json }}
+
+; The below will be used as defaults for new configured servers.
+; If you're just running one server (the default), it's easier to
+; configure it here than through D-Bus or Ice.
+;
+; Welcome message sent to clients when they connect.
+; If the welcome message is set to an empty string,
+; no welcome message will be sent to clients.
+welcometext={{ murmur_welcome_text | to_json }}
+
+; Port to bind TCP and UDP sockets to.
+port={{ murmur_port }}
+
+; Specific IP or hostname to bind to.
+; If this is left blank (default), Murmur will bind to all available addresses.
+;host=
+host={{ murmur_host | to_json }}
+
+; Password to join server.
+serverpassword={{ murmur_server_password | to_json }}
+
+; Maximum bandwidth (in bits per second) clients are allowed
+; to send speech at.
+bandwidth={{ murmur_max_bandwidth }}
+
+; Maximum number of concurrent clients allowed.
+users={{ murmur_max_users }}
+
+; Per-user rate limiting
+;
+; These two settings allow to configure the per-user rate limiter for some
+; command messages sent from the client to the server. The messageburst setting
+; specifies an amount of messages which are allowed in short bursts. The
+; messagelimit setting specifies the number of messages per second allowed over
+; a longer period. If a user hits the rate limit, his packages are then ignored
+; for some time. Both of these settings have a minimum of 1 as setting either to
+; 0 could render the server unusable.
+messageburst=5
+messagelimit=1
+
+; Respond to UDP ping packets.
+;
+; Setting to true exposes the current user count, the maximum user count, and
+; the server's maximum bandwidth per client to unauthenticated users. In the
+; Mumble client, this information is shown in the Connect dialog.
+allowping=true
+
+; Amount of users with Opus support needed to force Opus usage, in percent.
+; 0 = Always enable Opus, 100 = enable Opus if it's supported by all clients.
+;opusthreshold=100
+opusthreshold={{ murmur_opus_threshold }}
+
+; Maximum depth of channel nesting. Note that some databases like MySQL using
+; InnoDB will fail when operating on deeply nested channels.
+;channelnestinglimit=10
+channelnestinglimit={{ murmur_channel_nesting_limit }}
+
+; Maximum number of channels per server. 0 for unlimited. Note that an
+; excessive number of channels will impact server performance
+;channelcountlimit=1000
+channelcountlimit={{ murmur_channel_count_limit }}
+
+; Regular expression used to validate channel names.
+; (Note that you have to escape backslashes with \ )
+;channelname=[ \\-=\\w\\#\\[\\]\\{\\}\\(\\)\\@\\|]+
+{% if murmur_channel_name_regex is defined %}
+channelname={{ murmur_channel_name_regex }}
+{% endif %}
+
+; Regular expression used to validate user names.
+; (Note that you have to escape backslashes with \ )
+;username=[-=\\w\\[\\]\\{\\}\\(\\)\\@\\|\\.]+
+{% if murmur_username_regex is defined %}
+username={{ murmur_username_regex }}
+{% endif %}
+
+; Maximum length of text messages in characters. 0 for no limit.
+;textmessagelength=5000
+textmessagelength={{ murmur_text_message_max_length }}
+
+; Maximum length of text messages in characters, with image data. 0 for no limit.
+;imagemessagelength=131072
+imagemessagelength={{ murmur_image_message_max_length }}
+
+; Allow clients to use HTML in messages, user comments and channel descriptions?
+;allowhtml=true
+allowhtml={{ murmur_allow_html }}
+
+; Murmur retains the per-server log entries in an internal database which
+; allows it to be accessed over D-Bus/ICE.
+; How many days should such entries be kept?
+; Set to 0 to keep forever, or -1 to disable logging to the DB.
+;logdays=31
+logdays={{ murmur_log_days }}
+
+{% if murmur_register.name is defined %}
+; To enable public server registration, the serverpassword must be blank, and
+; this must all be filled out.
+; The password here is used to create a registry for the server name; subsequent
+; updates will need the same password. Don't lose your password.
+; The URL is your own website, and only set the registerHostname for static IP
+; addresses.
+; Only uncomment the 'registerName' parameter if you wish to give your "Root" channel a custom name.
+;
+registerName={{ murmur_register.name | to_json }}
+registerPassword={{ murmur_register.password | to_json }}
+registerUrl={{ murmur_register.url | to_json }}
+registerHostname={{ murmur_register.hostname | to_json }}
+{% endif %}
+
+; If this option is enabled, the server will announce its presence via the
+; bonjour service discovery protocol. To change the name announced by bonjour
+; adjust the registerName variable.
+; See http://developer.apple.com/networking/bonjour/index.html for more information
+; about bonjour.
+;bonjour=True
+bonjour={{ murmur_bonjour_enabled }}
+
+; If you have a proper SSL certificate, you can provide the filenames here.
+; Otherwise, Murmur will create its own certificate automatically.
+;sslCert=
+;sslKey=
+sslCert={{ murmur_certificate | to_json }}
+sslKey={{ murmur_private_key | to_json }}
+sslCa={{ murmur_trusted_certificate | to_json }}
+
+; The sslDHParams option allows you to specify a PEM-encoded file with
+; Diffie-Hellman parameters, which will be used as the default Diffie-
+; Hellman parameters for all virtual servers.
+;
+; Instead of pointing sslDHParams to a file, you can also use the option
+; to specify a named set of Diffie-Hellman parameters for Murmur to use.
+; Murmur comes bundled with the Diffie-Hellman parameters from RFC 7919.
+; These parameters are available by using the following names:
+;
+; @ffdhe2048, @ffdhe3072, @ffdhe4096, @ffdhe6144, @ffdhe8192
+;
+; By default, Murmur uses @ffdhe2048.
+sslDHParams={{ murmur_dhparam | to_json }}
+
+; The sslCiphers option chooses the cipher suites to make available for use
+; in SSL/TLS. This option is server-wide, and cannot be set on a
+; per-virtual-server basis.
+;
+; This option is specified using OpenSSL cipher list notation (see
+; https://www.openssl.org/docs/apps/ciphers.html#CIPHER-LIST-FORMAT).
+;
+; It is recommended that you try your cipher string using 'openssl ciphers <string>'
+; before setting it here, to get a feel for which cipher suites you will get.
+;
+; After setting this option, it is recommend that you inspect your Murmur log
+; to ensure that Murmur is using the cipher suites that you expected it to.
+;
+; Note: Changing this option may impact the backwards compatibility of your
+; Murmur server, and can remove the ability for older Mumble clients to be able
+; to connect to it.
+;sslCiphers=EECDH+AESGCM:EDH+aRSA+AESGCM:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA
+
+; If Murmur is started as root, which user should it switch to?
+; This option is ignored if Murmur isn't started with root privileges.
+;uname=
+uname={{ murmur_owner }}
+
+; If this options is enabled, only clients which have a certificate are allowed
+; to connect.
+;certrequired=False
+certrequired={{ murmur_client_certificate_required }}
+
+; If enabled, clients are sent information about the servers version and operating
+; system.
+;sendversion=True
+sendversion={{ murmur_send_server_version }}
+
+; This sets password hash storage to legacy mode (1.2.4 and before)
+; (Note that setting this to true is insecure and should not be used unless absolutely necessary)
+;legacyPasswordHash=false
+
+; By default a strong amount of PBKDF2 iterations are chosen automatically. If >0 this setting
+; overrides the automatic benchmark and forces a specific number of iterations.
+; (Note that you should only change this value if you know what you are doing)
+;kdfIterations=-1
+
+; You can configure any of the configuration options for Ice here. We recommend
+; leave the defaults as they are.
+; Please note that this section has to be last in the configuration file.
+;
+[Ice]
+Ice.Warn.UnknownProperties={{ murmur_ice_warn_unknown_properties }}
+Ice.MessageSizeMax={{ murmur_ice_message_size_max }}
diff --git a/templates/mumble-web.js.j2 b/templates/mumble-web.js.j2
index b18d954..e118056 100644
--- a/templates/mumble-web.js.j2
+++ b/templates/mumble-web.js.j2
@@ -13,7 +13,7 @@ let config = window.mumbleWebConfig // eslint-disable-line no-unused-vars
 config.connectDialog.address = false
 config.connectDialog.port = false
 config.connectDialog.token = false
-config.connectDialog.password = {{ (umurmur_user_password != '') | lower }}
+config.connectDialog.password = {{ (umurmur_server_password != '') | lower }}
 
 // Default values for user settings
 // You can see your current value by typing `localStorage.getItem('mumble.$setting')` in the web console.
diff --git a/templates/umurmur.conf.j2 b/templates/umurmur.conf.j2
index eeb63fa..e44907e 100644
--- a/templates/umurmur.conf.j2
+++ b/templates/umurmur.conf.j2
@@ -1,12 +1,12 @@
 {{ ansible_managed | comment }}
-max_bandwidth = 48000;
+max_bandwidth = {{ umurmur_max_bandwidth }};
 welcometext = {{ umurmur_welcome_text
     if umurmur_welcome_text is string 
     else (umurmur_welcome_text | join('<br />')) 
   | to_json }};
 certificate = {{ umurmur_certificate | to_json }};
 private_key = {{ umurmur_private_key | to_json }};
-password = {{ umurmur_user_password | to_json }};
+password = {{ umurmur_server_password | to_json }};
 {% if umurmur_admin_password is defined %}
 admin_password = {{ umurmur_admin_password | to_json }};   # Set to enable admin functionality.
 {% endif %}

From df227041f3992f4b56c19239e528857760862e34 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 14:07:05 +0200
Subject: [PATCH 02/14] fix undefined var

---
 defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index c9961be..ff4ad9c 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -34,7 +34,7 @@ murmur_host: ""
 murmur_server_password: ""
 murmur_max_bandwidth: 72000
 murmur_max_users: 100
-murmur_opusthreshold: 100
+murmur_opus_threshold: 100
 murmur_channel_nesting_limit: 10
 murmur_channel_count_limit: 1000
 # Regex to validate channel or usernames

From 8ae266b3c5222840f30ffa07684711b32215746e Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 14:07:46 +0200
Subject: [PATCH 03/14] fix undefined var

---
 defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index ff4ad9c..df3a52a 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -41,7 +41,7 @@ murmur_channel_count_limit: 1000
 # murmur_channel_name_regex: ""
 # murmur_username_regex: ""
 murmur_text_message_max_length: 5000
-murmur_image_message_length: 131072
+murmur_image_message_max_length: 131072
 murmur_allow_html: yes
 # Set to 0 to keep logs forever, or -1 to disable logging to the DB.
 murmur_log_days: -1

From 5f25887e6afc3b1402df827d2615dc30e7e0f9e6 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 14:21:50 +0200
Subject: [PATCH 04/14] add ssl-cert group for mumble-server user

---
 defaults/main.yml              |  2 +-
 tasks/murmur.yml               | 10 ++++++++++
 templates/mumble-server.ini.j2 |  2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index df3a52a..266757c 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -20,7 +20,7 @@ murmur_database:
   # port: 3306
   # prefix: "murmur_"
 murmur_ice: "tcp -h 127.0.0.1 -p 6502"
-# murmur_icesecret_read: "somesecret"
+# murmur_ice_secret_read: "somesecret"
 # murmur_ice_secret_write: "anothersecret"
 murmur_autoban_attempts: 10
 murmur_autoban_timeframe: 120
diff --git a/tasks/murmur.yml b/tasks/murmur.yml
index b52b5d2..f2f5a9a 100644
--- a/tasks/murmur.yml
+++ b/tasks/murmur.yml
@@ -4,6 +4,16 @@
     state: present
   register: murmur_installed
 
+- name: Append ssl-cert group to {{ murmur_owner }} user
+  user:
+    name: "{{ murmur_owner }}"
+    state: present
+    groups:
+    - "{{ acme_ssl_group }}"
+    append: yes
+    system: yes
+  notify: restart murmur
+
 - name: Copy Murmur config file
   template:
     src: mumble-server.ini.j2
diff --git a/templates/mumble-server.ini.j2 b/templates/mumble-server.ini.j2
index a4e1063..2d643ce 100644
--- a/templates/mumble-server.ini.j2
+++ b/templates/mumble-server.ini.j2
@@ -94,7 +94,7 @@ icesecretread={{ murmur_ice_secret_read | to_json }}
 {% if murmur_ice_secret_write is defined %}
 icesecretwrite={{ murmur_ice_secret_write | to_json }}
 {% else %}
-icesecretwrite=
+;icesecretwrite=
 {% endif %}
 
 ; If you want to expose Murmur's experimental gRPC API, you

From 98fee2ebac55b23f8d4357c1a6a3321c3544d997 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 16:20:28 +0200
Subject: [PATCH 05/14] setup murmur superuser password

---
 defaults/main.yml |  1 +
 handlers/main.yml |  5 ++++-
 tasks/murmur.yml  | 24 +++++++++---------------
 3 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index 266757c..0c1b194 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -11,6 +11,7 @@ mumble_web_websockify_port: "64737"
 
 murmur_domain: "{{ mumble_web_domain }}"
 murmur_enabled: yes
+# murmur_superuser_password: "supersecret"
 murmur_database:
   path: "/var/lib/mumble-server/mumble-server.sqlite"
   # driver: "QMYSQL"
diff --git a/handlers/main.yml b/handlers/main.yml
index 8725e14..33b3d2b 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -27,4 +27,7 @@
   - not (mumble_web_started.changed | default(false))
 
 - name: reload nginx
-  include_tasks: ../handlers/nginx.yml
\ No newline at end of file
+  include_tasks: ../handlers/nginx.yml
+
+- name: change murmur superuser password
+  command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}"
\ No newline at end of file
diff --git a/tasks/murmur.yml b/tasks/murmur.yml
index f2f5a9a..3d4fa2b 100644
--- a/tasks/murmur.yml
+++ b/tasks/murmur.yml
@@ -29,18 +29,12 @@
     enabled: yes
     state: started
 
-# TODO: Handle superuser password
-
-# - name: Write superuser password to a file
-#   copy:
-#     content: "{{ murmur_superuser_password }}"
-#     dest: /etc/mumble-superuser
-#     owner: root
-#     group: root
-#     mode: "600"
-#   when: murmur_superuser_password is defined
-#   notify: set superuser password
-
-# - name: set superuser password
-#   command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}"
-#   failed_when: False
\ No newline at end of file
+- name: Write superuser password to a file
+  copy:
+    content: "{{ murmur_superuser_password }}"
+    dest: /etc/mumble-server.secret
+    owner: root
+    group: root
+    mode: "600"
+  when: murmur_superuser_password is defined
+  notify: change murmur superuser password

From 40dc40385d97230466515c0a79295ce2bd316b79 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 16:33:50 +0200
Subject: [PATCH 06/14] fix failure when changing superuser password

---
 handlers/main.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/handlers/main.yml b/handlers/main.yml
index 33b3d2b..abde375 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -30,4 +30,7 @@
   include_tasks: ../handlers/nginx.yml
 
 - name: change murmur superuser password
-  command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}"
\ No newline at end of file
+  command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}"
+  # See https://github.com/mumble-voip/mumble/issues/3911
+  # Should be fixed in 1.3.1
+  failed_when: no
\ No newline at end of file

From 7d976f56cf13767f800741c0379eb4431562b0d2 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 19:56:23 +0200
Subject: [PATCH 07/14] create helper script to manage Murmur

---
 .gitignore            |  3 +++
 files/scripts/mice.py | 53 +++++++++++++++++++++++++++++++++++++++++++
 tasks/murmur.yml      | 37 +++++++++++++++++++++++++++++-
 3 files changed, 92 insertions(+), 1 deletion(-)
 create mode 100644 .gitignore
 create mode 100644 files/scripts/mice.py

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..fc3643d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+.venv
+.vscode
+.gitignore
\ No newline at end of file
diff --git a/files/scripts/mice.py b/files/scripts/mice.py
new file mode 100644
index 0000000..30613bf
--- /dev/null
+++ b/files/scripts/mice.py
@@ -0,0 +1,53 @@
+#!/usr/bin/python3
+
+import argparse
+import logging
+import sys
+
+import Ice
+
+import Murmur
+
+
+def init(host, port, timeout):
+    logging.debug("Initializing ICE connection")
+    proxy_str = f"Meta: tcp -h {host} -p {port} -t {timeout}"
+    with Ice.initialize() as communicator:
+        proxy = communicator.stringToProxy(proxy_str)
+        mice = Murmur.MetaPrx.checkedCast(proxy)
+
+        if not mice:
+            raise RuntimeError(f"Invalid Proxy: {proxy_str}")
+
+        servers = mice.getAllServers()
+
+        if len(servers) == 0:
+            raise RuntimeError("No Mumble server found")
+
+        return servers
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Manage Mumble server through ICE connection",
+        formatter_class=argparse.ArgumentDefaultsHelpFormatter
+    )
+    parser.add_argument("--host", "-h", default="127.0.0.1",
+                        help="ICE host or ip")
+    parser.add_argument("--port", "-p", default=6502,
+                        help="ICE port number")
+    parser.add_argument("--timeout", "-t", default=1000,
+                        help="Connection timeout in milliseconds")
+    args = parser.parse_args()
+
+    try:
+        servers = init(args.host, args.port, args.timeout)
+    except RuntimeError as e:
+        logging.error(e, exc_info=e)
+        return 1
+
+    print(servers.getChannels())
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tasks/murmur.yml b/tasks/murmur.yml
index 3d4fa2b..de2f824 100644
--- a/tasks/murmur.yml
+++ b/tasks/murmur.yml
@@ -1,9 +1,16 @@
 - name: Install mumble-server package
   apt:
-    name: mumble-server
+    pkg: mumble-server
     state: present
   register: murmur_installed
 
+- name: Install ICE dependencies for Python
+  apt:
+    pkg:
+    - python3-zeroc-ice
+    - zeroc-ice-compilers
+  state: present
+
 - name: Append ssl-cert group to {{ murmur_owner }} user
   user:
     name: "{{ murmur_owner }}"
@@ -38,3 +45,31 @@
     mode: "600"
   when: murmur_superuser_password is defined
   notify: change murmur superuser password
+
+- name: Create mumble-ice directory
+  file:
+    path: /opt/mice/
+    state: directory
+    owner: root
+    group: root
+    chmod: "755"
+
+- name: Copy mice Python script
+  copy:
+    src: scripts/mice.py
+    dest: /opt/mice/mice.py
+    owner: root
+    group: root
+    chmod: "755"
+  register: _murmur_mice_copied
+
+- name: Compile Murmur.ice slice file
+  command: |-
+    slice2py --checksum \
+      -I/usr/local/share/Ice \
+      -I/usr/share/Ice/slice \
+      -I/usr/share/ice/slice \
+      /usr/share/slice/Murmur.ice
+  args:
+    chdir: /opt/mice/
+  when: _murmur_mice_copied
\ No newline at end of file

From 8c3a74266aeede4df6e8475bc40b9be47d7dd071 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 19:57:31 +0200
Subject: [PATCH 08/14] fix syntax error

---
 tasks/murmur.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tasks/murmur.yml b/tasks/murmur.yml
index de2f824..850e200 100644
--- a/tasks/murmur.yml
+++ b/tasks/murmur.yml
@@ -9,7 +9,7 @@
     pkg:
     - python3-zeroc-ice
     - zeroc-ice-compilers
-  state: present
+    state: present
 
 - name: Append ssl-cert group to {{ murmur_owner }} user
   user:

From 2c6ed181825895ce5f63c55d47f1d44066084efa Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 19:58:32 +0200
Subject: [PATCH 09/14] fix syntax error

---
 tasks/murmur.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tasks/murmur.yml b/tasks/murmur.yml
index 850e200..26684a4 100644
--- a/tasks/murmur.yml
+++ b/tasks/murmur.yml
@@ -52,7 +52,7 @@
     state: directory
     owner: root
     group: root
-    chmod: "755"
+    mode: "755"
 
 - name: Copy mice Python script
   copy:
@@ -60,7 +60,7 @@
     dest: /opt/mice/mice.py
     owner: root
     group: root
-    chmod: "755"
+    mode: "755"
   register: _murmur_mice_copied
 
 - name: Compile Murmur.ice slice file

From d47ce404879e6b227f93ee574af4f22ad4b79dc8 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 19:59:38 +0200
Subject: [PATCH 10/14] fix when condition for Murmur slice compilation

---
 tasks/murmur.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tasks/murmur.yml b/tasks/murmur.yml
index 26684a4..7514ce6 100644
--- a/tasks/murmur.yml
+++ b/tasks/murmur.yml
@@ -72,4 +72,4 @@
       /usr/share/slice/Murmur.ice
   args:
     chdir: /opt/mice/
-  when: _murmur_mice_copied
\ No newline at end of file
+  when: _murmur_mice_copied is changed
\ No newline at end of file

From 816157a9d7acc1196e2551348488dc131dc81ca8 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 20:01:07 +0200
Subject: [PATCH 11/14] fix conflicting parameter

---
 files/scripts/mice.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/scripts/mice.py b/files/scripts/mice.py
index 30613bf..0f72bdf 100644
--- a/files/scripts/mice.py
+++ b/files/scripts/mice.py
@@ -32,7 +32,7 @@ def main():
         description="Manage Mumble server through ICE connection",
         formatter_class=argparse.ArgumentDefaultsHelpFormatter
     )
-    parser.add_argument("--host", "-h", default="127.0.0.1",
+    parser.add_argument("--host", "-H", default="127.0.0.1",
                         help="ICE host or ip")
     parser.add_argument("--port", "-p", default=6502,
                         help="ICE port number")

From 31d3221d05777e48c67aa941dbfd6e6e19674f92 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 14 Jun 2020 20:02:32 +0200
Subject: [PATCH 12/14] print channels for each server

---
 files/scripts/mice.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/files/scripts/mice.py b/files/scripts/mice.py
index 0f72bdf..aff7cca 100644
--- a/files/scripts/mice.py
+++ b/files/scripts/mice.py
@@ -46,7 +46,8 @@ def main():
         logging.error(e, exc_info=e)
         return 1
 
-    print(servers.getChannels())
+    for server in servers:
+        print(server.getChannels())
 
 
 if __name__ == "__main__":

From 6914b83d962b32a3498295b4522f3fd3317c771f Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 6 Dec 2020 14:10:29 +0100
Subject: [PATCH 13/14] manage murmur channels; install mumble-web's
 self-signed cert; add molecule default scenario

---
 defaults/main.yml              |  68 +++++--
 files/murmur/mice.yml          |  42 ++++
 files/murmur/scripts/mice.py   | 345 +++++++++++++++++++++++++++++++++
 files/scripts/mice.py          |  54 ------
 handlers/main.yml              |   9 +-
 meta/main.yml                  |   2 +-
 molecule/default/INSTALL.rst   |  23 +++
 molecule/default/converge.yml  |  12 ++
 molecule/default/molecule.yml  |  57 ++++++
 molecule/default/prepare.yml   |  14 ++
 tasks/dhparam/begin.yml        |  21 ++
 tasks/dhparam/end.yml          |   7 +
 tasks/main.yml                 |  34 +++-
 tasks/mumble_web.yml           |  15 +-
 tasks/murmur.yml               |  44 +++--
 tasks/nginx.yml                |   6 +-
 tasks/self_signed.yml          |  64 ++++++
 tasks/umurmur.yml              |   5 +-
 templates/mumble-server.ini.j2 |   8 +-
 templates/nginx.conf.j2        |   8 +-
 vars/main.yml                  |   2 +
 21 files changed, 739 insertions(+), 101 deletions(-)
 create mode 100644 files/murmur/mice.yml
 create mode 100644 files/murmur/scripts/mice.py
 delete mode 100644 files/scripts/mice.py
 create mode 100644 molecule/default/INSTALL.rst
 create mode 100644 molecule/default/converge.yml
 create mode 100644 molecule/default/molecule.yml
 create mode 100644 molecule/default/prepare.yml
 create mode 100644 tasks/dhparam/begin.yml
 create mode 100644 tasks/dhparam/end.yml
 create mode 100644 tasks/self_signed.yml
 create mode 100644 vars/main.yml

diff --git a/defaults/main.yml b/defaults/main.yml
index 0c1b194..bf819b1 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,17 +1,28 @@
-mumble_web_domain: "mumble.example.com"
+acme_enabled: yes
+acme_domains:
+  - "{{ umurmur_domain }}"
+  - "{{ mumble_web_domain }}"
+
+mumble_web_enabled: yes
+mumble_web_domain: "{{ inventory_hostname }}.local"
 mumble_web_owner: mumble-web
 mumble_web_group: "{{ mumble_web_owner }}"
-mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/fullchain.pem"
+mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/{{ acme_enabled | ternary('fullchain','cert') }}.pem"
 mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem"
 mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.pem"
-mumble_web_dhparam: "/etc/nginx/ssl/dhparam.pem"
 mumble_web_www_dir: /var/www/mumble-web
 mumble_web_version: master
 mumble_web_websockify_port: "64737"
 
-murmur_domain: "{{ mumble_web_domain }}"
+mumble_web_nginx_enabled: yes
+mumble_web_nginx_config_dir: /etc/nginx
+mumble_web_nginx_generate_dhparam: yes
+mumble_web_nginx_dhparam: "{{ mumble_web_nginx_config_dir }}/ssl/dhparam.pem"
+mumble_web_nginx_dhparam_size: 2048
+
 murmur_enabled: yes
-# murmur_superuser_password: "supersecret"
+murmur_domain: "{{ mumble_web_domain }}"
+murmur_superuser_password: supersecret
 murmur_database:
   path: "/var/lib/mumble-server/mumble-server.sqlite"
   # driver: "QMYSQL"
@@ -20,18 +31,23 @@ murmur_database:
   # host: "localhost"
   # port: 3306
   # prefix: "murmur_"
-murmur_ice: "tcp -h 127.0.0.1 -p 6502"
-# murmur_ice_secret_read: "somesecret"
-# murmur_ice_secret_write: "anothersecret"
+murmur_ice_host: "127.0.0.1"
+murmur_ice_port: 6502
+# Give read permission on ICE connection. Empty secret will deny read permission to anybody.
+murmur_ice_secret_read: "{{ lookup('password', '/tmp/murmur-ice-read.secret length=50') }}"
+# Give write permission on ICE connection. Empty secret will deny write permission to anybody.
+murmur_ice_secret_write: "{{ lookup('password', '/tmp/murmur-ice-write.secret length=50') }}"
+
 murmur_autoban_attempts: 10
 murmur_autoban_timeframe: 120
 murmur_autoban_time: 300
 murmur_log_file: "/var/log/mumble-server/mumble-server.log"
 murmur_pid_file: "/var/run/mumble-server/mumble-server.pid"
 murmur_welcome_text: "Welcome on the {{ inventory_hostname }} Mumble server!"
-murmur_port: 64738
 # Leave blank to let Murmur bind to all available addresses
 murmur_host: ""
+murmur_port: 64738
+# Password to join the server
 murmur_server_password: ""
 murmur_max_bandwidth: 72000
 murmur_max_users: 100
@@ -47,14 +63,15 @@ murmur_allow_html: yes
 # Set to 0 to keep logs forever, or -1 to disable logging to the DB.
 murmur_log_days: -1
 # Name for root channel and entry in mumble main server list
-# murmur_register:
-#   name: "MyMumbleServerRegisterName"
-#   password: "password"
-#   url: "https://mymumbleserverurl.org"
-#   hostname: "mymumblehostname.domain.org"
+murmur_register_enabled: no
+murmur_register:
+  name: "MyMumbleServerRegisterName"
+  password: "password"
+  url: "https://mymumbleserverurl.org"
+  hostname: "mymumblehostname.domain.org"
 # Enable Bonjour for dev purpose
 murmur_bonjour_enabled: no
-murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/fullchain.pem"
+murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
 murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/chain.pem"
 murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domain }}.pem"
 murmur_dhparam: "@ffdhe4096"
@@ -62,13 +79,26 @@ murmur_owner: "mumble-server"
 murmur_group: "{{ murmur_owner }}"
 murmur_client_certificate_required: no
 murmur_send_server_version: yes
-murmur_ice_warn_unknown_properties: 1
+murmur_ice_warn_unknown_properties: yes
 murmur_ice_message_size_max: 65536
 
-umurmur_domain: "{{ mumble_web_domain }}"
 umurmur_enabled: yes
+umurmur_domain: "{{ mumble_web_domain }}"
 umurmur_max_bandwidth: 48000
 umurmur_server_password: ""
+umurmur_channels:
+- name: Root
+  description: Root channel. No entry.
+  noenter: yes
+- name: Welcome
+  parent: Root
+  description: Welcome channel
+  position: 0
+- name: Silent
+  parent: Root
+  description: Silent channel
+  silent: yes
+  position: 1
 umurmur_channel_links:
 - source: "{{ umurmur_default_channel }}"
   destinations: >-
@@ -79,8 +109,8 @@ umurmur_channel_links:
       | list
     }}
 umurmur_ssl_group: "{{ acme_ssl_group }}"
-umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/fullchain.pem"
+umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
 umurmur_private_key: "{{ acme_keys_dir }}/{{ umurmur_domain }}.pem"
 umurmur_version: master
 umurmur_ispublic: yes
-umurmur_port: "64738"
+umurmur_port: 64738
diff --git a/files/murmur/mice.yml b/files/murmur/mice.yml
new file mode 100644
index 0000000..5d47323
--- /dev/null
+++ b/files/murmur/mice.yml
@@ -0,0 +1,42 @@
+channels:
+- name: Root
+  description: Root channel. No entry.
+  groups:
+    admin:
+      inherit: true
+      inheritable: true
+  permissions:
+    - group: all
+      deny:
+        - Enter
+      recursive: false
+      enabled: true
+    - group: all
+      allow:
+        - RegisterSelf
+        - MakeTempChannel
+    - group: admin
+      allow:
+        - MuteDeafen
+        - Move
+        - Kick
+        - Ban
+        - Register
+- name: Welcome
+  parent: Root
+  description: Welcome channel
+  position: 0
+  isdefault: true
+- name: Silent
+  parent: Root
+  description: Silent channel
+  position: 1
+  permissions:
+    - group: all
+      deny:
+        - Speak
+        - MakeTempChannel
+      enabled: true
+    - group: admin
+      allow:
+        - MakeTempChannel
\ No newline at end of file
diff --git a/files/murmur/scripts/mice.py b/files/murmur/scripts/mice.py
new file mode 100644
index 0000000..26b5cb9
--- /dev/null
+++ b/files/murmur/scripts/mice.py
@@ -0,0 +1,345 @@
+#!/usr/bin/python3
+
+import argparse
+import logging
+import os
+import sys
+from typing import List, Dict
+
+import Ice
+import yaml
+
+import Murmur
+
+CONFIG_SEARCH_PATH = [".", "/etc"]
+CONFIG_DEFAULT_NAME = "mice.yml"
+
+ICE_DEFAULT_HOST = "127.0.0.1"
+ICE_DEFAULT_PORT = 6502
+ICE_DEFAULT_TIMEOUT = 1000
+
+
+class Mice:
+    def __init__(self, host: str = ICE_DEFAULT_HOST,
+                 port: int = ICE_DEFAULT_PORT, secret: str = None,
+                 timeout: int = ICE_DEFAULT_TIMEOUT):
+        logging.debug("Initializing ICE connection")
+        properties = Ice.createProperties()
+        properties.setProperty("Ice.ImplicitContext", "Shared")
+        init_data = Ice.InitializationData()
+        init_data.properties = properties
+        self._communicator = Ice.initialize(init_data)
+
+        if secret:
+            logging.debug("Providing ICE secret")
+            self._communicator.getImplicitContext().put("secret", secret)
+
+        logging.debug("Creating meta proxy")
+        proxy_str = f"Meta: tcp -h {host} -p {port} -t {timeout}"
+        proxy = self._communicator.stringToProxy(proxy_str)
+        self.meta = Murmur.MetaPrx.checkedCast(proxy)
+
+        if not self.meta:
+            self._communicator.destroy()
+            raise RuntimeError(f"Invalid Proxy: {proxy_str}")
+
+        try:
+            logging.debug("Retrieving the list of Mumble servers")
+            servers = self.meta.getAllServers()
+        except Murmur.InvalidSecretException:
+            self._communicator.destroy()
+            raise RuntimeError(f"Failed to connect to {host} "
+                               f"on port {port}: Invalid secret.") from None
+        self.servers = [MurmurServer(server) for server in servers]
+
+        if len(self.servers) == 0:
+            self._communicator.destroy()
+            raise RuntimeError("No Mumble server found")
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc_value, traceback):
+        self._communicator.destroy()
+
+
+class ChannelGroup:
+    def __init__(self, name: str, inherit: bool = True,
+                 inheritable: bool = True):
+        self.name = name
+        self.inherit = inherit
+        self.inheritable = inheritable
+
+    def get_state(self) -> Murmur.Group:
+        return Murmur.Group(
+            name=self.name,
+            inherit=self.inherit,
+            inheritable=self.inheritable
+        )
+
+    @staticmethod
+    def from_dict(group_dict: Dict[str, object]) -> "ChannelGroup":
+        return ChannelGroup(
+            name=group_dict["name"],
+            inherit=group_dict.get("inherit", True),
+            inheritable=group_dict.get("inheritable", True)
+        )
+
+
+class ChannelPermission:
+    def __init__(self, group: str = "all", userid: int = -1,
+                 allow: int = 0, deny: int = 0,
+                 recursive: bool = True, enabled: bool = True):
+        self.group = group
+        self.userid = userid
+        self.allow = allow
+        self.deny = deny
+        self.recursive = recursive
+        self.enabled = enabled
+
+    def get_acl(self) -> Murmur.ACL:
+        return Murmur.ACL(
+            applyHere=self.enabled,
+            applySubs=self.recursive,
+            userid=self.userid,
+            group=self.group,
+            allow=self.allow,
+            deny=self.deny)
+
+    @staticmethod
+    def from_dict(permission_dict: Dict[str, object]) -> "ChannelPermission":
+        allow = ChannelPermission._parse_rules(
+            permission_dict.get("allow", []))
+        deny = ChannelPermission._parse_rules(
+            permission_dict.get("deny", []))
+
+        return ChannelPermission(
+            group=permission_dict["group"],
+            allow=allow,
+            deny=deny,
+            recursive=permission_dict.get("recursive", True),
+            enabled=permission_dict.get("enabled", True))
+
+    @staticmethod
+    def _parse_rule(rule: str) -> int:
+        return getattr(Murmur, "Permission" + rule)
+
+    @staticmethod
+    def _parse_rules(rules: List[str]) -> int:
+        result = 0
+        for rule in rules:
+            result |= ChannelPermission._parse_rule(rule)
+        return result
+
+
+class Channel:
+    def __init__(self, name: str, description: str = "", position: int = 0,
+                 groups: List[ChannelGroup] = [],
+                 permissions: List[ChannelPermission] = [],
+                 inherit: bool = True, isdefault: bool = False,
+                 parent: "Channel" = None):
+        self.id = -1
+        self.name = name
+        self.description = description
+        self.position = position
+        self.groups = groups
+        self.permissions = permissions
+        self.inherit = inherit
+        self.isdefault = isdefault
+        self.parent = parent
+        self.children = []
+
+    def __str__(self) -> str:
+        return self.name
+
+    def get_state(self) -> Murmur.Channel:
+        if self.parent is None:
+            parent_id = 0
+        else:
+            parent_id = self.parent.id
+
+        return Murmur.Channel(
+            id=self.id,
+            name=self.name,
+            description=self.description,
+            position=self.position,
+            parent=parent_id)
+
+    def add(self, channel: "Channel") -> None:
+        self.children.append(channel)
+        channel.parent = self
+
+    @staticmethod
+    def from_dict(channel_dict: Dict[str, object]) -> "Channel":
+        if "parent" in channel_dict:
+            parent = Channel(channel_dict["parent"])
+        else:
+            parent = None
+
+        groups = []
+        for group_name, group_dict in channel_dict.get("groups", {}).items():
+            group_dict["name"] = group_name
+            group = ChannelGroup.from_dict(group_dict)
+            groups.append(group)
+
+        permissions = []
+        for permission_dict in channel_dict.get("permissions", []):
+            permission = ChannelPermission.from_dict(permission_dict)
+            permissions.append(permission)
+
+        return Channel(
+            name=channel_dict["name"],
+            description=channel_dict.get("description", ''),
+            position=channel_dict.get("position", 0),
+            groups=groups,
+            permissions=permissions,
+            inherit=channel_dict.get("inherit", True),
+            isdefault=channel_dict.get("isdefault", False),
+            parent=parent)
+
+
+class MurmurServer:
+    def __init__(self, server: Murmur.Server):
+        self._server = server
+
+    def clear_acls(self, channel_id=0):
+        _, groups, inherit = self._server.getACL(0)
+        self._server.setACL(channel_id, [], groups, inherit)
+
+    def clear_channels(self) -> None:
+        for channel_state in self._server.getChannels().values():
+            if channel_state.id != 0 and channel_state.parent == 0:
+                self._server.removeChannel(channel_state.id)
+        self.clear_acls()
+
+    def set_channel_acls(self, channel: Channel) -> None:
+        acls = []
+        for permission in channel.permissions:
+            acl = permission.get_acl()
+            acls.append(acl)
+
+        _, current_groups, _ = self._server.getACL(channel.id)
+        current_group_names = {group.name: group for group in current_groups}
+
+        groups = []
+        for group in channel.groups:
+            group_state = group.get_state()
+            if group.name in current_group_names:
+                current_group_state = current_group_names[group.name]
+                group_state.add = current_group_state.add
+                group_state.remove = current_group_state.remove
+                del current_group_names[group.name]
+            groups.append(group_state)
+        groups.extend(current_group_names.values())
+
+        self._server.setACL(channel.id, acls, groups, channel.inherit)
+
+    def create_channels(self, channel: Channel) -> None:
+        if channel.parent is None:
+            channel.id = 0
+        else:
+            channel.id = self._server.addChannel(
+                channel.name,
+                channel.parent.id)
+
+        self._server.setChannelState(channel.get_state())
+        self.set_channel_acls(channel)
+
+        if channel.isdefault:
+            self._server.setConf("defaultchannel", str(channel.id))
+
+        for child in channel.children:
+            self.create_channels(child)
+
+
+class Config:
+    def __init__(self, filename: str = None):
+        self.filename = filename
+        self._data = {}
+
+        self.load(filename)
+
+    def load(self, filename: str = None):
+        if not filename:
+            for config_path in CONFIG_SEARCH_PATH:
+                filename = os.path.join(config_path, CONFIG_DEFAULT_NAME)
+                if os.path.exists(filename) and os.path.isfile(filename):
+                    break
+
+        with open(filename, 'r') as ifd:
+            self._data = yaml.safe_load(ifd)
+
+    def parse_channels(self) -> Channel:
+        channels = []
+        for channel_dict in self._data["channels"]:
+            channel = Channel.from_dict(channel_dict)
+            channels.append(channel)
+
+        channel_names = {channel.name: channel for channel in channels}
+        for channel in channels:
+            if channel.parent is None:
+                continue
+            if channel.parent.name not in channel_names:
+                continue
+            channel_names[channel.parent.name].add(channel)
+
+        root_channels = [channel for channel in channels
+                         if channel.parent is None]
+
+        if len(root_channels) == 0:
+            raise RuntimeError("No root channel found.")
+
+        if len(root_channels) > 1:
+            root_names = root_channels.join(', ')
+            raise RuntimeError(f"Multiple root channels found: {root_names}")
+
+        default_channels = [channel for channel in channels
+                            if channel.isdefault]
+
+        if len(default_channels) > 1:
+            default_names = default_channels.join(', ')
+            raise RuntimeError("Multiple default channels found: "
+                               f"{default_names}")
+
+        return root_channels[0]
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Manage Mumble server through ICE connection",
+        formatter_class=argparse.ArgumentDefaultsHelpFormatter
+    )
+    parser.add_argument("--host", "-H", default=ICE_DEFAULT_HOST,
+                        help="ICE host or ip")
+    parser.add_argument("--port", "-p", default=ICE_DEFAULT_PORT,
+                        help="ICE port number")
+    parser.add_argument("--timeout", "-t", default=ICE_DEFAULT_TIMEOUT,
+                        help="Connection timeout in milliseconds")
+    parser.add_argument("--secret", "-s",
+                        default=os.environ.get("MICE_SECRET"),
+                        help="ICE write secret")
+    parser.add_argument("--server-id", "-i", type=int, default=0,
+                        help="Server ID to manage")
+    parser.add_argument("--config", "-c",
+                        help="Path to the config file.")
+    args = parser.parse_args()
+
+    config = Config(args.config)
+    root_channel = config.parse_channels()
+
+    server_id = args.server_id
+    try:
+        with Mice(args.host, args.port, args.secret, args.timeout) as mice:
+            if not 0 <= server_id < len(mice.servers):
+                raise RuntimeError(f"Cannot find server with ID {server_id}")
+            server = mice.servers[server_id]
+
+            server.clear_channels()
+            server.create_channels(root_channel)
+    except RuntimeError as e:
+        logging.error(e, exc_info=e)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/files/scripts/mice.py b/files/scripts/mice.py
deleted file mode 100644
index aff7cca..0000000
--- a/files/scripts/mice.py
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/python3
-
-import argparse
-import logging
-import sys
-
-import Ice
-
-import Murmur
-
-
-def init(host, port, timeout):
-    logging.debug("Initializing ICE connection")
-    proxy_str = f"Meta: tcp -h {host} -p {port} -t {timeout}"
-    with Ice.initialize() as communicator:
-        proxy = communicator.stringToProxy(proxy_str)
-        mice = Murmur.MetaPrx.checkedCast(proxy)
-
-        if not mice:
-            raise RuntimeError(f"Invalid Proxy: {proxy_str}")
-
-        servers = mice.getAllServers()
-
-        if len(servers) == 0:
-            raise RuntimeError("No Mumble server found")
-
-        return servers
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Manage Mumble server through ICE connection",
-        formatter_class=argparse.ArgumentDefaultsHelpFormatter
-    )
-    parser.add_argument("--host", "-H", default="127.0.0.1",
-                        help="ICE host or ip")
-    parser.add_argument("--port", "-p", default=6502,
-                        help="ICE port number")
-    parser.add_argument("--timeout", "-t", default=1000,
-                        help="Connection timeout in milliseconds")
-    args = parser.parse_args()
-
-    try:
-        servers = init(args.host, args.port, args.timeout)
-    except RuntimeError as e:
-        logging.error(e, exc_info=e)
-        return 1
-
-    for server in servers:
-        print(server.getChannels())
-
-
-if __name__ == "__main__":
-    sys.exit(main())
diff --git a/handlers/main.yml b/handlers/main.yml
index abde375..e2c4a57 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -33,4 +33,11 @@
   command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}"
   # See https://github.com/mumble-voip/mumble/issues/3911
   # Should be fixed in 1.3.1
-  failed_when: no
\ No newline at end of file
+  failed_when: no
+
+- name: create murmur channels
+  command:
+    cmd: ./mice.py -c {{ murmur_ice_config_path | quote }}
+    chdir: "{{ murmur_ice_script_dir }}"
+  environment:
+    MICE_SECRET: "{{ murmur_ice_secret_write }}"
\ No newline at end of file
diff --git a/meta/main.yml b/meta/main.yml
index e2d533c..8ef7244 100644
--- a/meta/main.yml
+++ b/meta/main.yml
@@ -1,7 +1,7 @@
 
 dependencies:
 - role: ppbe.acme
-  tags: [acme]
+  tags: [never]
 - role: geerlingguy.nodejs
   vars:
     nodejs_install_npm_user: root
diff --git a/molecule/default/INSTALL.rst b/molecule/default/INSTALL.rst
new file mode 100644
index 0000000..0c4bf5c
--- /dev/null
+++ b/molecule/default/INSTALL.rst
@@ -0,0 +1,23 @@
+*********************************
+Vagrant driver installation guide
+*********************************
+
+Requirements
+============
+
+* Vagrant
+* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule_vagrant'
diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml
new file mode 100644
index 0000000..4a2ab18
--- /dev/null
+++ b/molecule/default/converge.yml
@@ -0,0 +1,12 @@
+---
+- name: Converge
+  hosts: all
+  become: yes
+
+  vars:
+    murmur_enabled: yes
+    umurmur_enabled: no
+    acme_enabled: no
+
+  roles:
+    - ansible-role-mumble
\ No newline at end of file
diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
new file mode 100644
index 0000000..10db698
--- /dev/null
+++ b/molecule/default/molecule.yml
@@ -0,0 +1,57 @@
+---
+.hardware: &hardware
+  memory: 1024
+  cpu: 2
+
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+  provider:
+    name: virtualbox
+platforms:
+  - name: buster-mumble-molecule
+    box: debian/buster64
+    <<: *hardware
+    interfaces:
+      - network_name: forwarded_port
+        guest: 80
+        host: 8080
+      - network_name: forwarded_port
+        guest: 443
+        host: 8443
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: tcp
+  - name: focal-mumble-molecule
+    box: ubuntu/focal64
+    <<: *hardware
+    interfaces:
+      - network_name: forwarded_port
+        guest: 80
+        host: 9080
+      - network_name: forwarded_port
+        guest: 443
+        host: 9443
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: tcp
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+verifier:
+  name: ansible
\ No newline at end of file
diff --git a/molecule/default/prepare.yml b/molecule/default/prepare.yml
new file mode 100644
index 0000000..3ebb94c
--- /dev/null
+++ b/molecule/default/prepare.yml
@@ -0,0 +1,14 @@
+- name: Prepare
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600
+
+    - name: Install nginx package
+      package:
+        name: nginx-light
+        state: present
\ No newline at end of file
diff --git a/tasks/dhparam/begin.yml b/tasks/dhparam/begin.yml
new file mode 100644
index 0000000..48d7c39
--- /dev/null
+++ b/tasks/dhparam/begin.yml
@@ -0,0 +1,21 @@
+- name: Ensure Diffie-Hellman directory exists
+  file:
+    path: "{{ mumble_web_nginx_dhparam | dirname }}"
+    state: directory
+    owner: root
+    group: www-data
+    mode: "755"
+
+- name: Generate Diffie-Hellman parameters
+  # This can take a long time... So we are doing it in async mode
+  openssl_dhparam:
+      path: "{{ mumble_web_nginx_dhparam }}"
+      state: present
+      owner: root
+      group: www-data
+      mode: "640"
+      size: "{{ mumble_web_nginx_dhparam_size }}"
+  async: 3600
+  poll: 0
+  changed_when: no
+  register: _mumble_web_nginx_dhparam
\ No newline at end of file
diff --git a/tasks/dhparam/end.yml b/tasks/dhparam/end.yml
new file mode 100644
index 0000000..0279618
--- /dev/null
+++ b/tasks/dhparam/end.yml
@@ -0,0 +1,7 @@
+- name: Waiting for Diffie-Hellman task to complete…
+  async_status:
+    jid: "{{ _mumble_web_nginx_dhparam.ansible_job_id }}"
+  register: _mumble_web_nginx_dhparam_job
+  retries: 60
+  delay: 30 # will retry every 30s for 30min (60 retries)
+  until: _mumble_web_nginx_dhparam_job.finished
\ No newline at end of file
diff --git a/tasks/main.yml b/tasks/main.yml
index b8d5753..b9b3bd8 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -1,3 +1,28 @@
+- name: Generate Diffie-Hellman parameters in async mode
+  import_tasks: dhparam/begin.yml
+  when: mumble_web_enabled and mumble_web_nginx_generate_dhparam
+  tags:
+  - certificate
+  - dhparam
+
+- name: Install ACME certificates
+  import_role:
+    name: ppbe.acme
+  when: acme_enabled
+  tags:
+    - certificate
+    - acme
+
+- name: Install Self-Signed certificates
+  include_tasks: self_signed.yml
+  loop: "{{ acme_domains | unique }}"
+  loop_control:
+    loop_var: domain_name
+  when: not acme_enabled
+  tags:
+    - certificate
+    - self_signed
+
 - name: Deploy uMurmur server
   import_tasks: umurmur.yml
   when: umurmur_enabled
@@ -13,7 +38,14 @@
   when: mumble_web_enabled
   tags: mumble_web
 
+- name: Wait for Diffie-Hellman task to complete
+  import_tasks: dhparam/end.yml
+  when: mumble_web_enabled and mumble_web_nginx_generate_dhparam
+  tags:
+  - certificate
+  - dhparam
+
 - name: Configure Nginx for mumble web client
   import_tasks: nginx.yml
-  when: mumble_web_enabled
+  when: mumble_web_enabled and mumble_web_nginx_enabled
   tags: nginx
\ No newline at end of file
diff --git a/tasks/mumble_web.yml b/tasks/mumble_web.yml
index df835a9..229c230 100644
--- a/tasks/mumble_web.yml
+++ b/tasks/mumble_web.yml
@@ -1,5 +1,11 @@
+- name: Install git package
+  package:
+    name: git
+    state: present
+  tags: mumble_web_install
+
 - name: Install websockify
-  apt:
+  package:
     name: websockify
     state: present
   notify: reload mumble-web
@@ -36,13 +42,18 @@
   become_user: "{{ mumble_web_owner }}"
   tags: mumble_web_install
 
+- name: Check if mumble-web dist directory exists
+  stat:
+    path: "{{ mumble_web_www_dir }}/dist"
+  register: _mumble_web_dist
+
 - name: Build mumble-web from sources
   command: npm clean-install
   args:
     chdir: "{{ mumble_web_www_dir }}"
   register: _mumble_web_installed
   become_user: "{{ mumble_web_owner }}"
-  when: mumble_web_cloned is changed
+  when: mumble_web_cloned is changed or not _mumble_web_dist.stat.exists
   tags: [mumble_web_install,mumble_web_build]
 
 - name: Copy mumble-web config file
diff --git a/tasks/murmur.yml b/tasks/murmur.yml
index 7514ce6..81c2b8b 100644
--- a/tasks/murmur.yml
+++ b/tasks/murmur.yml
@@ -1,15 +1,19 @@
 - name: Install mumble-server package
-  apt:
-    pkg: mumble-server
+  package:
+    name: mumble-server
     state: present
   register: murmur_installed
 
 - name: Install ICE dependencies for Python
-  apt:
-    pkg:
-    - python3-zeroc-ice
-    - zeroc-ice-compilers
+  package:
+    name: "{{ package }}"
     state: present
+  loop:
+    - python3-zeroc-ice
+    - python3-yaml
+    - zeroc-ice-compilers
+  loop_control:
+    loop_var: package
 
 - name: Append ssl-cert group to {{ murmur_owner }} user
   user:
@@ -46,9 +50,12 @@
   when: murmur_superuser_password is defined
   notify: change murmur superuser password
 
+- name: Trigger Murmur handlers
+  meta: flush_handlers
+
 - name: Create mumble-ice directory
   file:
-    path: /opt/mice/
+    path: "{{ murmur_ice_script_dir }}"
     state: directory
     owner: root
     group: root
@@ -56,12 +63,13 @@
 
 - name: Copy mice Python script
   copy:
-    src: scripts/mice.py
-    dest: /opt/mice/mice.py
+    src: murmur/scripts/mice.py
+    dest: "{{ murmur_ice_script_dir }}/mice.py"
     owner: root
     group: root
     mode: "755"
-  register: _murmur_mice_copied
+  notify: create murmur channels
+  register: _murmur_mice_script_copied
 
 - name: Compile Murmur.ice slice file
   command: |-
@@ -71,5 +79,17 @@
       -I/usr/share/ice/slice \
       /usr/share/slice/Murmur.ice
   args:
-    chdir: /opt/mice/
-  when: _murmur_mice_copied is changed
\ No newline at end of file
+    chdir: "{{ murmur_ice_script_dir }}"
+  when: _murmur_mice_script_copied is changed
+
+- name: Copy mice config
+  copy:
+    src: murmur/mice.yml
+    dest: "{{ murmur_ice_config_path }}"
+    owner: root
+    group: root
+    mode: "644"
+  notify: create murmur channels
+
+- name: Trigger Mice handlers
+  meta: flush_handlers
\ No newline at end of file
diff --git a/tasks/nginx.yml b/tasks/nginx.yml
index 5e89113..5f9f7aa 100644
--- a/tasks/nginx.yml
+++ b/tasks/nginx.yml
@@ -1,7 +1,7 @@
 - name: Copy Nginx config file
   template:
     src: nginx.conf.j2
-    dest: /etc/nginx/sites-available/mumble.conf
+    dest: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
     owner: root
     group: www-data
     mode: "755"
@@ -9,8 +9,8 @@
 
 - name: Enable Nginx config file
   file:
-    src: /etc/nginx/sites-available/mumble.conf
-    path: /etc/nginx/sites-enabled/mumble.conf
+    src: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
+    path: "{{ mumble_web_nginx_config_dir }}/sites-enabled/mumble.conf"
     state: link
   notify: reload nginx
 
diff --git a/tasks/self_signed.yml b/tasks/self_signed.yml
new file mode 100644
index 0000000..c3b38df
--- /dev/null
+++ b/tasks/self_signed.yml
@@ -0,0 +1,64 @@
+- name: Install SSL dependencies
+  package:
+    name: "{{ package }}"
+    state: present
+  loop:
+    - ssl-cert
+    - python3-openssl
+  loop_control:
+    loop_var: package
+  tags: selfsigned_install
+
+- name: Create SSL config directories
+  file:
+    path: "{{ config_dir }}"
+    state: directory
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "711"
+  loop:
+  - "{{ acme_config_dir }}"
+  - "{{ acme_keys_dir }}"
+  - "{{ acme_accounts_dir }}"
+  - "{{ acme_csr_dir }}"
+  loop_control:
+    loop_var: config_dir
+  tags: selfsigned_install
+
+- name: Create {{ domain_name }} certificates directory
+  file:
+    path: "{{ acme_certs_dir }}/{{ domain_name }}.d"
+    state: directory
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "755"
+  tags: selfsigned_install
+
+- name: Generate private key for {{ domain_name }} certificate
+  openssl_privatekey:
+    path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "640"
+    type: RSA
+    size: 4096
+
+- name: Generate CSR for {{ domain_name }} certificate
+  openssl_csr:
+    path: "{{ acme_csr_dir }}/{{ domain_name }}.csr"
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "644"
+    privatekey_path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
+    common_name: "{{ domain_name }}"
+
+- name: Generate self-signed certificate
+  openssl_certificate:
+    path: "{{ acme_certs_dir }}/{{ domain_name }}.d/cert.pem" 
+    csr_path: "{{ acme_csr_dir }}/{{ domain_name }}.csr"
+    privatekey_path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
+    provider: selfsigned 
+    state: present
+    owner: root 
+    group: "{{ acme_ssl_group }}" 
+    mode: "644"
\ No newline at end of file
diff --git a/tasks/umurmur.yml b/tasks/umurmur.yml
index 2996b35..e54119d 100644
--- a/tasks/umurmur.yml
+++ b/tasks/umurmur.yml
@@ -1,6 +1,7 @@
 - name: Install umurmur build dependencies
-  apt:
+  package:
     name: "{{ package }}"
+    state: present
   loop:
   - git
   - build-essential
@@ -87,5 +88,5 @@
 - name: Open umurmur port with UFW
   ufw:
     rule: allow
-    port: "{{ umurmur_port }}"
+    port: "{{ umurmur_port | str }}"
   when: umurmur_ispublic | bool
\ No newline at end of file
diff --git a/templates/mumble-server.ini.j2 b/templates/mumble-server.ini.j2
index 2d643ce..7218af8 100644
--- a/templates/mumble-server.ini.j2
+++ b/templates/mumble-server.ini.j2
@@ -72,7 +72,7 @@ dbOpts={{ murmur_database.opts | default('') | to_json }}
 ; with ICE, you should only use it if you trust all the users who have
 ; shell access to your machine.
 ; Please see the ICE documentation on how to specify endpoints.
-ice="{{ murmur_ice }}"
+ice="tcp -h {{ murmur_ice_host | quote }} -p {{ murmur_ice_port | int }}"
 
 ; Ice primarily uses local sockets. This means anyone who has a
 ; user account on your machine can connect to the Ice services.
@@ -227,7 +227,7 @@ allowhtml={{ murmur_allow_html }}
 ;logdays=31
 logdays={{ murmur_log_days }}
 
-{% if murmur_register.name is defined %}
+{% if murmur_register_enabled %}
 ; To enable public server registration, the serverpassword must be blank, and
 ; this must all be filled out.
 ; The password here is used to create a registry for the server name; subsequent
@@ -256,7 +256,9 @@ bonjour={{ murmur_bonjour_enabled }}
 ;sslKey=
 sslCert={{ murmur_certificate | to_json }}
 sslKey={{ murmur_private_key | to_json }}
+{% if acme_enabled %}
 sslCa={{ murmur_trusted_certificate | to_json }}
+{% endif %}
 
 ; The sslDHParams option allows you to specify a PEM-encoded file with
 ; Diffie-Hellman parameters, which will be used as the default Diffie-
@@ -319,5 +321,5 @@ sendversion={{ murmur_send_server_version }}
 ; Please note that this section has to be last in the configuration file.
 ;
 [Ice]
-Ice.Warn.UnknownProperties={{ murmur_ice_warn_unknown_properties }}
+Ice.Warn.UnknownProperties={{ murmur_ice_warn_unknown_properties | int }}
 Ice.MessageSizeMax={{ murmur_ice_message_size_max }}
diff --git a/templates/nginx.conf.j2 b/templates/nginx.conf.j2
index 976abe9..b82c172 100644
--- a/templates/nginx.conf.j2
+++ b/templates/nginx.conf.j2
@@ -8,7 +8,7 @@ server {
     return 301 https://$host$request_uri;
   }
   
-{% if acme_challenge_dir is defined %}
+{% if acme_enabled and acme_challenge_dir is defined %}
   location ^~ /.well-known/acme-challenge/ {
 		allow all;
 		root {{ acme_challenge_dir }};
@@ -30,8 +30,8 @@ server {
   ssl_session_cache shared:AnsibleSSL:10m;  # about 40000 sessions
   ssl_session_tickets off;
 
-{% if mumble_web_dhparam is defined and mumble_web_dhparam != '' %}
-  ssl_dhparam {{ mumble_web_dhparam }};
+{% if mumble_web_nginx_dhparam %}
+  ssl_dhparam {{ mumble_web_nginx_dhparam }};
 {% endif %}
 
   ssl_protocols TLSv1.2 TLSv1.3;
@@ -44,8 +44,10 @@ server {
   ssl_stapling on;
   ssl_stapling_verify on;
 
+{% if acme_enabled %}
   # Verify chain of trust of OCSP response using Root CA and Intermediate certs
   ssl_trusted_certificate {{ mumble_web_trusted_certificate }};
+{% endif %}
 
   location / {
     root /var/www/mumble-web/dist/;
diff --git a/vars/main.yml b/vars/main.yml
new file mode 100644
index 0000000..3dcd39e
--- /dev/null
+++ b/vars/main.yml
@@ -0,0 +1,2 @@
+murmur_ice_script_dir: /opt/mice
+murmur_ice_config_path: /etc/mice.yml
\ No newline at end of file

From 0f070764aaddb0acd97914bd86e6805af24b5d44 Mon Sep 17 00:00:00 2001
From: HgO <hgo@batato.be>
Date: Sun, 6 Dec 2020 19:37:02 +0100
Subject: [PATCH 14/14] fix umurmur deployment and remove ispublic flag

---
 defaults/main.yml                |  4 ++-
 meta/main.yml                    |  2 +-
 molecule/default/converge.yml    |  4 ++-
 molecule/default/molecule.yml    | 22 +++++++++++++++
 molecule/mumble-web/INSTALL.rst  | 23 ++++++++++++++++
 molecule/mumble-web/converge.yml | 13 +++++++++
 molecule/mumble-web/molecule.yml | 43 +++++++++++++++++++++++++++++
 molecule/mumble-web/prepare.yml  | 14 ++++++++++
 molecule/murmur/INSTALL.rst      | 23 ++++++++++++++++
 molecule/murmur/converge.yml     | 14 ++++++++++
 molecule/murmur/molecule.yml     | 47 ++++++++++++++++++++++++++++++++
 molecule/murmur/prepare.yml      |  9 ++++++
 molecule/umurmur/INSTALL.rst     | 23 ++++++++++++++++
 molecule/umurmur/converge.yml    | 13 +++++++++
 molecule/umurmur/molecule.yml    | 47 ++++++++++++++++++++++++++++++++
 molecule/umurmur/prepare.yml     |  9 ++++++
 tasks/mumble_web.yml             |  5 ++++
 tasks/umurmur.yml                |  8 +-----
 templates/umurmur.conf.j2        |  9 +++---
 19 files changed, 318 insertions(+), 14 deletions(-)
 create mode 100644 molecule/mumble-web/INSTALL.rst
 create mode 100644 molecule/mumble-web/converge.yml
 create mode 100644 molecule/mumble-web/molecule.yml
 create mode 100644 molecule/mumble-web/prepare.yml
 create mode 100644 molecule/murmur/INSTALL.rst
 create mode 100644 molecule/murmur/converge.yml
 create mode 100644 molecule/murmur/molecule.yml
 create mode 100644 molecule/murmur/prepare.yml
 create mode 100644 molecule/umurmur/INSTALL.rst
 create mode 100644 molecule/umurmur/converge.yml
 create mode 100644 molecule/umurmur/molecule.yml
 create mode 100644 molecule/umurmur/prepare.yml

diff --git a/defaults/main.yml b/defaults/main.yml
index bf819b1..00c280a 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -85,6 +85,7 @@ murmur_ice_message_size_max: 65536
 umurmur_enabled: yes
 umurmur_domain: "{{ mumble_web_domain }}"
 umurmur_max_bandwidth: 48000
+umurmur_max_users: 100
 umurmur_server_password: ""
 umurmur_channels:
 - name: Root
@@ -99,6 +100,8 @@ umurmur_channels:
   description: Silent channel
   silent: yes
   position: 1
+umurmur_default_channel: Welcome
+umurmur_welcome_text: "Welcome on the {{ inventory_hostname }} Mumble server!"
 umurmur_channel_links:
 - source: "{{ umurmur_default_channel }}"
   destinations: >-
@@ -112,5 +115,4 @@ umurmur_ssl_group: "{{ acme_ssl_group }}"
 umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
 umurmur_private_key: "{{ acme_keys_dir }}/{{ umurmur_domain }}.pem"
 umurmur_version: master
-umurmur_ispublic: yes
 umurmur_port: 64738
diff --git a/meta/main.yml b/meta/main.yml
index 8ef7244..2c1a29d 100644
--- a/meta/main.yml
+++ b/meta/main.yml
@@ -5,7 +5,7 @@ dependencies:
 - role: geerlingguy.nodejs
   vars:
     nodejs_install_npm_user: root
-  tags: [nodejs,mumble_web]
+  tags: [never]
 
 galaxy_info:
   role_name: mumble
diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml
index 4a2ab18..16fe642 100644
--- a/molecule/default/converge.yml
+++ b/molecule/default/converge.yml
@@ -4,8 +4,10 @@
   become: yes
 
   vars:
+    mumble_web_enabled: yes
     murmur_enabled: yes
-    umurmur_enabled: no
+    umurmur_enabled: yes
+    umurmur_port: 64739
     acme_enabled: no
 
   roles:
diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
index 10db698..a7c6836 100644
--- a/molecule/default/molecule.yml
+++ b/molecule/default/molecule.yml
@@ -14,12 +14,14 @@ platforms:
     box: debian/buster64
     <<: *hardware
     interfaces:
+      # Mumble web client
       - network_name: forwarded_port
         guest: 80
         host: 8080
       - network_name: forwarded_port
         guest: 443
         host: 8443
+      # Murmur server
       - network_name: forwarded_port
         guest: 64738
         host: 14738
@@ -28,16 +30,27 @@ platforms:
         guest: 64738
         host: 14738
         protocol: tcp
+      # Umurmur server
+      - network_name: forwarded_port
+        guest: 64739
+        host: 14739
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64739
+        host: 14739
+        protocol: tcp
   - name: focal-mumble-molecule
     box: ubuntu/focal64
     <<: *hardware
     interfaces:
+      # Mumble web client
       - network_name: forwarded_port
         guest: 80
         host: 9080
       - network_name: forwarded_port
         guest: 443
         host: 9443
+      # Murmur server
       - network_name: forwarded_port
         guest: 64738
         host: 24738
@@ -46,6 +59,15 @@ platforms:
         guest: 64738
         host: 24738
         protocol: tcp
+      # Umurmur server
+      - network_name: forwarded_port
+        guest: 64739
+        host: 24739
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64739
+        host: 24739
+        protocol: tcp
 provisioner:
   name: ansible
   config_options:
diff --git a/molecule/mumble-web/INSTALL.rst b/molecule/mumble-web/INSTALL.rst
new file mode 100644
index 0000000..0c4bf5c
--- /dev/null
+++ b/molecule/mumble-web/INSTALL.rst
@@ -0,0 +1,23 @@
+*********************************
+Vagrant driver installation guide
+*********************************
+
+Requirements
+============
+
+* Vagrant
+* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule_vagrant'
diff --git a/molecule/mumble-web/converge.yml b/molecule/mumble-web/converge.yml
new file mode 100644
index 0000000..2f3911c
--- /dev/null
+++ b/molecule/mumble-web/converge.yml
@@ -0,0 +1,13 @@
+---
+- name: Converge
+  hosts: all
+  become: yes
+
+  vars:
+    mumble_web_enabled: yes
+    murmur_enabled: yes
+    umurmur_enabled: no
+    acme_enabled: no
+
+  roles:
+    - ansible-role-mumble
\ No newline at end of file
diff --git a/molecule/mumble-web/molecule.yml b/molecule/mumble-web/molecule.yml
new file mode 100644
index 0000000..e20127c
--- /dev/null
+++ b/molecule/mumble-web/molecule.yml
@@ -0,0 +1,43 @@
+---
+.hardware: &hardware
+  memory: 1024
+  cpu: 2
+
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+  provider:
+    name: virtualbox
+platforms:
+  - name: buster-mumble-molecule
+    box: debian/buster64
+    <<: *hardware
+    interfaces:
+      # Mumble web client
+      - network_name: forwarded_port
+        guest: 80
+        host: 8080
+      - network_name: forwarded_port
+        guest: 443
+        host: 8443
+  - name: focal-mumble-molecule
+    box: ubuntu/focal64
+    <<: *hardware
+    interfaces:
+      # Mumble web client
+      - network_name: forwarded_port
+        guest: 80
+        host: 9080
+      - network_name: forwarded_port
+        guest: 443
+        host: 9443
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+verifier:
+  name: ansible
\ No newline at end of file
diff --git a/molecule/mumble-web/prepare.yml b/molecule/mumble-web/prepare.yml
new file mode 100644
index 0000000..3ebb94c
--- /dev/null
+++ b/molecule/mumble-web/prepare.yml
@@ -0,0 +1,14 @@
+- name: Prepare
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600
+
+    - name: Install nginx package
+      package:
+        name: nginx-light
+        state: present
\ No newline at end of file
diff --git a/molecule/murmur/INSTALL.rst b/molecule/murmur/INSTALL.rst
new file mode 100644
index 0000000..0c4bf5c
--- /dev/null
+++ b/molecule/murmur/INSTALL.rst
@@ -0,0 +1,23 @@
+*********************************
+Vagrant driver installation guide
+*********************************
+
+Requirements
+============
+
+* Vagrant
+* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule_vagrant'
diff --git a/molecule/murmur/converge.yml b/molecule/murmur/converge.yml
new file mode 100644
index 0000000..da7913e
--- /dev/null
+++ b/molecule/murmur/converge.yml
@@ -0,0 +1,14 @@
+---
+- name: Converge
+  hosts: all
+  become: yes
+
+  vars:
+    mumble_web_enabled: no
+    murmur_enabled: yes
+    umurmur_enabled: no
+    umurmur_port: 64739
+    acme_enabled: no
+
+  roles:
+    - ansible-role-mumble
\ No newline at end of file
diff --git a/molecule/murmur/molecule.yml b/molecule/murmur/molecule.yml
new file mode 100644
index 0000000..811c299
--- /dev/null
+++ b/molecule/murmur/molecule.yml
@@ -0,0 +1,47 @@
+---
+.hardware: &hardware
+  memory: 1024
+  cpu: 2
+
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+  provider:
+    name: virtualbox
+platforms:
+  - name: buster-mumble-molecule
+    box: debian/buster64
+    <<: *hardware
+    interfaces:
+      # Murmur server
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: tcp
+  - name: focal-mumble-molecule
+    box: ubuntu/focal64
+    <<: *hardware
+    interfaces:
+      # Murmur server
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: tcp
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+verifier:
+  name: ansible
\ No newline at end of file
diff --git a/molecule/murmur/prepare.yml b/molecule/murmur/prepare.yml
new file mode 100644
index 0000000..bc3a569
--- /dev/null
+++ b/molecule/murmur/prepare.yml
@@ -0,0 +1,9 @@
+- name: Prepare
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600
\ No newline at end of file
diff --git a/molecule/umurmur/INSTALL.rst b/molecule/umurmur/INSTALL.rst
new file mode 100644
index 0000000..0c4bf5c
--- /dev/null
+++ b/molecule/umurmur/INSTALL.rst
@@ -0,0 +1,23 @@
+*********************************
+Vagrant driver installation guide
+*********************************
+
+Requirements
+============
+
+* Vagrant
+* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule_vagrant'
diff --git a/molecule/umurmur/converge.yml b/molecule/umurmur/converge.yml
new file mode 100644
index 0000000..cd7c341
--- /dev/null
+++ b/molecule/umurmur/converge.yml
@@ -0,0 +1,13 @@
+---
+- name: Converge
+  hosts: all
+  become: yes
+
+  vars:
+    mumble_web_enabled: no
+    murmur_enabled: no
+    umurmur_enabled: yes
+    acme_enabled: no
+
+  roles:
+    - ansible-role-mumble
\ No newline at end of file
diff --git a/molecule/umurmur/molecule.yml b/molecule/umurmur/molecule.yml
new file mode 100644
index 0000000..651da13
--- /dev/null
+++ b/molecule/umurmur/molecule.yml
@@ -0,0 +1,47 @@
+---
+.hardware: &hardware
+  memory: 1024
+  cpu: 2
+
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+  provider:
+    name: virtualbox
+platforms:
+  - name: buster-mumble-molecule
+    box: debian/buster64
+    <<: *hardware
+    interfaces:
+      # Umurmur server
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: tcp
+  - name: focal-mumble-molecule
+    box: ubuntu/focal64
+    <<: *hardware
+    interfaces:
+      # Umurmur server
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: tcp
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+verifier:
+  name: ansible
\ No newline at end of file
diff --git a/molecule/umurmur/prepare.yml b/molecule/umurmur/prepare.yml
new file mode 100644
index 0000000..bc3a569
--- /dev/null
+++ b/molecule/umurmur/prepare.yml
@@ -0,0 +1,9 @@
+- name: Prepare
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600
\ No newline at end of file
diff --git a/tasks/mumble_web.yml b/tasks/mumble_web.yml
index 229c230..764af2d 100644
--- a/tasks/mumble_web.yml
+++ b/tasks/mumble_web.yml
@@ -1,3 +1,8 @@
+- name: Install NodeJS
+  import_role:
+    name: geerlingguy.nodejs
+  tags: nodejs
+
 - name: Install git package
   package:
     name: git
diff --git a/tasks/umurmur.yml b/tasks/umurmur.yml
index e54119d..d42af55 100644
--- a/tasks/umurmur.yml
+++ b/tasks/umurmur.yml
@@ -83,10 +83,4 @@
   register: umurmur_started
 
 - name: Trigger umurmur handlers
-  meta: flush_handlers
-
-- name: Open umurmur port with UFW
-  ufw:
-    rule: allow
-    port: "{{ umurmur_port | str }}"
-  when: umurmur_ispublic | bool
\ No newline at end of file
+  meta: flush_handlers
\ No newline at end of file
diff --git a/templates/umurmur.conf.j2 b/templates/umurmur.conf.j2
index e44907e..50c67f8 100644
--- a/templates/umurmur.conf.j2
+++ b/templates/umurmur.conf.j2
@@ -1,9 +1,10 @@
 {{ ansible_managed | comment }}
 max_bandwidth = {{ umurmur_max_bandwidth }};
-welcometext = {{ umurmur_welcome_text
-    if umurmur_welcome_text is string 
-    else (umurmur_welcome_text | join('<br />')) 
-  | to_json }};
+{% if umurmur_welcome_text is string %}
+welcometext = {{ umurmur_welcome_text | to_json }};
+{% else %}
+welcometext = {{ umurmur_welcome_text | join('<br />') | to_json  }};
+{% endif %}
 certificate = {{ umurmur_certificate | to_json }};
 private_key = {{ umurmur_private_key | to_json }};
 password = {{ umurmur_server_password | to_json }};