move templates into subdirs

templates/mumble-web/config.js.j2

@@ -0,0 +1,23 @@
+{{ ansible_managed | comment('c') }}
+// You can overwrite the default configuration values set in [config.js] here.
+// There should never be any required changes to this file and you can always
+// simply copy it over when updating to a new version.
+
+let config = window.mumbleWebConfig // eslint-disable-line no-unused-vars
+
+// E.g. changing default address and theme:
+// config.defaults.address = 'voice.example.com'
+// config.defaults.theme = 'MetroMumbleDark
+
+// Which fields to show on the Connect to Server dialog
+config.connectDialog.address = false
+config.connectDialog.port = false
+config.connectDialog.token = false
+config.connectDialog.password = {{ (umurmur_server_password != '') | lower }}
+
+// Default values for user settings
+// You can see your current value by typing `localStorage.getItem('mumble.$setting')` in the web console.
+config.settings.pttKey = 'shift'
+
+// Default values (can be changed by passing a query parameter of the same name)
+config.defaults.address = "{{ mumble_web_domain }}/mumble"

templates/mumble-web/mumble-web.service.j2

@@ -0,0 +1,16 @@
+[Unit]
+Description=Mumble web client using websockets
+After=network.target umurmur.service
+Wants=umurmur.service
+
+[Service]
+Type=simple
+User=nobody
+Group=nogroup
+Restart=always
+RestartSec=3
+ExecStart=/usr/bin/websockify --ssl-target {{ mumble_web_websockify_port }} localhost:{{ umurmur_port }}
+ExecReload=/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target

templates/mumble-web/nginx.conf.j2

@@ -0,0 +1,73 @@
+{{ ansible_managed | comment }}
+server {
+  listen 80;
+  listen [::]:80;
+  server_name {{ mumble_web_nginx_domains | join(' ') }};
+
+  location / {
+    return 301 https://$host$request_uri;
+  }
+  
+{% if acme_enabled %}
+  location ^~ /.well-known/acme-challenge/ {
+		allow all;
+		root {{ acme_root_dir }};
+		try_files $uri =404;
+	}
+{% endif %}
+
+  access_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-access.log;
+  error_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-error.log;
+}
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+
+  server_name {{ mumble_web_nginx_domains | join(' ') }};
+
+  ssl_certificate {{ mumble_web_certificate }};
+  ssl_certificate_key {{ mumble_web_private_key }};
+
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:AnsibleSSL:10m;  # about 40000 sessions
+  ssl_session_tickets off;
+
+{% if mumble_web_nginx_dhparam %}
+  ssl_dhparam {{ mumble_web_nginx_dhparam }};
+{% endif %}
+
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+  ssl_prefer_server_ciphers off;
+
+  add_header Strict-Transport-Security "max-age=63072000" always;
+
+  # OCSP stapling
+  ssl_stapling on;
+  ssl_stapling_verify on;
+
+{% if acme_enabled %}
+  # Verify chain of trust of OCSP response using Root CA and Intermediate certs
+  ssl_trusted_certificate {{ mumble_web_trusted_certificate }};
+{% endif %}
+
+  location / {
+    root {{ mumble_web_dist_dir }};
+  }
+
+  location /mumble {
+    proxy_pass http://localhost:{{ mumble_web_websockify_port }};
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+  }
+
+  access_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-access.log;
+  error_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-error.log;
+}
+
+map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+}