manage murmur channels; install mumble-web's self-signed cert; add molecule default scenario

defaults/main.yml

@@ -1,17 +1,28 @@
-mumble_web_domain: "mumble.example.com"
+acme_enabled: yes
+acme_domains:
+  - "{{ umurmur_domain }}"
+  - "{{ mumble_web_domain }}"
+
+mumble_web_enabled: yes
+mumble_web_domain: "{{ inventory_hostname }}.local"
 mumble_web_owner: mumble-web
 mumble_web_group: "{{ mumble_web_owner }}"
-mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/fullchain.pem"
+mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/{{ acme_enabled | ternary('fullchain','cert') }}.pem"
 mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem"
 mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.pem"
-mumble_web_dhparam: "/etc/nginx/ssl/dhparam.pem"
 mumble_web_www_dir: /var/www/mumble-web
 mumble_web_version: master
 mumble_web_websockify_port: "64737"
 
-murmur_domain: "{{ mumble_web_domain }}"
+mumble_web_nginx_enabled: yes
+mumble_web_nginx_config_dir: /etc/nginx
+mumble_web_nginx_generate_dhparam: yes
+mumble_web_nginx_dhparam: "{{ mumble_web_nginx_config_dir }}/ssl/dhparam.pem"
+mumble_web_nginx_dhparam_size: 2048
+
 murmur_enabled: yes
-# murmur_superuser_password: "supersecret"
+murmur_domain: "{{ mumble_web_domain }}"
+murmur_superuser_password: supersecret
 murmur_database:
   path: "/var/lib/mumble-server/mumble-server.sqlite"
   # driver: "QMYSQL"
@@ -20,18 +31,23 @@ murmur_database:
   # host: "localhost"
   # port: 3306
   # prefix: "murmur_"
-murmur_ice: "tcp -h 127.0.0.1 -p 6502"
-# murmur_ice_secret_read: "somesecret"
-# murmur_ice_secret_write: "anothersecret"
+murmur_ice_host: "127.0.0.1"
+murmur_ice_port: 6502
+# Give read permission on ICE connection. Empty secret will deny read permission to anybody.
+murmur_ice_secret_read: "{{ lookup('password', '/tmp/murmur-ice-read.secret length=50') }}"
+# Give write permission on ICE connection. Empty secret will deny write permission to anybody.
+murmur_ice_secret_write: "{{ lookup('password', '/tmp/murmur-ice-write.secret length=50') }}"
+
 murmur_autoban_attempts: 10
 murmur_autoban_timeframe: 120
 murmur_autoban_time: 300
 murmur_log_file: "/var/log/mumble-server/mumble-server.log"
 murmur_pid_file: "/var/run/mumble-server/mumble-server.pid"
 murmur_welcome_text: "Welcome on the {{ inventory_hostname }} Mumble server!"
-murmur_port: 64738
 # Leave blank to let Murmur bind to all available addresses
 murmur_host: ""
+murmur_port: 64738
+# Password to join the server
 murmur_server_password: ""
 murmur_max_bandwidth: 72000
 murmur_max_users: 100
@@ -47,14 +63,15 @@ murmur_allow_html: yes
 # Set to 0 to keep logs forever, or -1 to disable logging to the DB.
 murmur_log_days: -1
 # Name for root channel and entry in mumble main server list
-# murmur_register:
-#   name: "MyMumbleServerRegisterName"
-#   password: "password"
-#   url: "https://mymumbleserverurl.org"
-#   hostname: "mymumblehostname.domain.org"
+murmur_register_enabled: no
+murmur_register:
+  name: "MyMumbleServerRegisterName"
+  password: "password"
+  url: "https://mymumbleserverurl.org"
+  hostname: "mymumblehostname.domain.org"
 # Enable Bonjour for dev purpose
 murmur_bonjour_enabled: no
-murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/fullchain.pem"
+murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
 murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/chain.pem"
 murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domain }}.pem"
 murmur_dhparam: "@ffdhe4096"
@@ -62,13 +79,26 @@ murmur_owner: "mumble-server"
 murmur_group: "{{ murmur_owner }}"
 murmur_client_certificate_required: no
 murmur_send_server_version: yes
-murmur_ice_warn_unknown_properties: 1
+murmur_ice_warn_unknown_properties: yes
 murmur_ice_message_size_max: 65536
 
-umurmur_domain: "{{ mumble_web_domain }}"
 umurmur_enabled: yes
+umurmur_domain: "{{ mumble_web_domain }}"
 umurmur_max_bandwidth: 48000
 umurmur_server_password: ""
+umurmur_channels:
+- name: Root
+  description: Root channel. No entry.
+  noenter: yes
+- name: Welcome
+  parent: Root
+  description: Welcome channel
+  position: 0
+- name: Silent
+  parent: Root
+  description: Silent channel
+  silent: yes
+  position: 1
 umurmur_channel_links:
 - source: "{{ umurmur_default_channel }}"
   destinations: >-
@@ -79,8 +109,8 @@ umurmur_channel_links:
       | list
     }}
 umurmur_ssl_group: "{{ acme_ssl_group }}"
-umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/fullchain.pem"
+umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
 umurmur_private_key: "{{ acme_keys_dir }}/{{ umurmur_domain }}.pem"
 umurmur_version: master
 umurmur_ispublic: yes
-umurmur_port: "64738"
+umurmur_port: 64738