manage murmur channels; install mumble-web's self-signed cert; add molecule default scenario

tasks/dhparam/begin.yml

@@ -0,0 +1,21 @@
+- name: Ensure Diffie-Hellman directory exists
+  file:
+    path: "{{ mumble_web_nginx_dhparam | dirname }}"
+    state: directory
+    owner: root
+    group: www-data
+    mode: "755"
+
+- name: Generate Diffie-Hellman parameters
+  # This can take a long time... So we are doing it in async mode
+  openssl_dhparam:
+      path: "{{ mumble_web_nginx_dhparam }}"
+      state: present
+      owner: root
+      group: www-data
+      mode: "640"
+      size: "{{ mumble_web_nginx_dhparam_size }}"
+  async: 3600
+  poll: 0
+  changed_when: no
+  register: _mumble_web_nginx_dhparam

tasks/dhparam/end.yml

@@ -0,0 +1,7 @@
+- name: Waiting for Diffie-Hellman task to complete…
+  async_status:
+    jid: "{{ _mumble_web_nginx_dhparam.ansible_job_id }}"
+  register: _mumble_web_nginx_dhparam_job
+  retries: 60
+  delay: 30 # will retry every 30s for 30min (60 retries)
+  until: _mumble_web_nginx_dhparam_job.finished

tasks/main.yml

@@ -1,3 +1,28 @@
+- name: Generate Diffie-Hellman parameters in async mode
+  import_tasks: dhparam/begin.yml
+  when: mumble_web_enabled and mumble_web_nginx_generate_dhparam
+  tags:
+  - certificate
+  - dhparam
+
+- name: Install ACME certificates
+  import_role:
+    name: ppbe.acme
+  when: acme_enabled
+  tags:
+    - certificate
+    - acme
+
+- name: Install Self-Signed certificates
+  include_tasks: self_signed.yml
+  loop: "{{ acme_domains | unique }}"
+  loop_control:
+    loop_var: domain_name
+  when: not acme_enabled
+  tags:
+    - certificate
+    - self_signed
+
 - name: Deploy uMurmur server
   import_tasks: umurmur.yml
   when: umurmur_enabled
@@ -13,7 +38,14 @@
   when: mumble_web_enabled
   tags: mumble_web
 
+- name: Wait for Diffie-Hellman task to complete
+  import_tasks: dhparam/end.yml
+  when: mumble_web_enabled and mumble_web_nginx_generate_dhparam
+  tags:
+  - certificate
+  - dhparam
+
 - name: Configure Nginx for mumble web client
   import_tasks: nginx.yml
-  when: mumble_web_enabled
+  when: mumble_web_enabled and mumble_web_nginx_enabled
   tags: nginx

tasks/mumble_web.yml

@@ -1,5 +1,11 @@
+- name: Install git package
+  package:
+    name: git
+    state: present
+  tags: mumble_web_install
+
 - name: Install websockify
-  apt:
+  package:
     name: websockify
     state: present
   notify: reload mumble-web
@@ -36,13 +42,18 @@
   become_user: "{{ mumble_web_owner }}"
   tags: mumble_web_install
 
+- name: Check if mumble-web dist directory exists
+  stat:
+    path: "{{ mumble_web_www_dir }}/dist"
+  register: _mumble_web_dist
+
 - name: Build mumble-web from sources
   command: npm clean-install
   args:
     chdir: "{{ mumble_web_www_dir }}"
   register: _mumble_web_installed
   become_user: "{{ mumble_web_owner }}"
-  when: mumble_web_cloned is changed
+  when: mumble_web_cloned is changed or not _mumble_web_dist.stat.exists
   tags: [mumble_web_install,mumble_web_build]
 
 - name: Copy mumble-web config file

tasks/murmur.yml

@@ -1,15 +1,19 @@
 - name: Install mumble-server package
-  apt:
-    pkg: mumble-server
+  package:
+    name: mumble-server
     state: present
   register: murmur_installed
 
 - name: Install ICE dependencies for Python
-  apt:
-    pkg:
-    - python3-zeroc-ice
-    - zeroc-ice-compilers
+  package:
+    name: "{{ package }}"
     state: present
+  loop:
+    - python3-zeroc-ice
+    - python3-yaml
+    - zeroc-ice-compilers
+  loop_control:
+    loop_var: package
 
 - name: Append ssl-cert group to {{ murmur_owner }} user
   user:
@@ -46,9 +50,12 @@
   when: murmur_superuser_password is defined
   notify: change murmur superuser password
 
+- name: Trigger Murmur handlers
+  meta: flush_handlers
+
 - name: Create mumble-ice directory
   file:
-    path: /opt/mice/
+    path: "{{ murmur_ice_script_dir }}"
     state: directory
     owner: root
     group: root
@@ -56,12 +63,13 @@
 
 - name: Copy mice Python script
   copy:
-    src: scripts/mice.py
-    dest: /opt/mice/mice.py
+    src: murmur/scripts/mice.py
+    dest: "{{ murmur_ice_script_dir }}/mice.py"
     owner: root
     group: root
     mode: "755"
-  register: _murmur_mice_copied
+  notify: create murmur channels
+  register: _murmur_mice_script_copied
 
 - name: Compile Murmur.ice slice file
   command: |-
@@ -71,5 +79,17 @@
       -I/usr/share/ice/slice \
       /usr/share/slice/Murmur.ice
   args:
-    chdir: /opt/mice/
-  when: _murmur_mice_copied is changed
+    chdir: "{{ murmur_ice_script_dir }}"
+  when: _murmur_mice_script_copied is changed
+
+- name: Copy mice config
+  copy:
+    src: murmur/mice.yml
+    dest: "{{ murmur_ice_config_path }}"
+    owner: root
+    group: root
+    mode: "644"
+  notify: create murmur channels
+
+- name: Trigger Mice handlers
+  meta: flush_handlers

tasks/nginx.yml

@@ -1,7 +1,7 @@
 - name: Copy Nginx config file
   template:
     src: nginx.conf.j2
-    dest: /etc/nginx/sites-available/mumble.conf
+    dest: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
     owner: root
     group: www-data
     mode: "755"
@@ -9,8 +9,8 @@
 
 - name: Enable Nginx config file
   file:
-    src: /etc/nginx/sites-available/mumble.conf
-    path: /etc/nginx/sites-enabled/mumble.conf
+    src: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
+    path: "{{ mumble_web_nginx_config_dir }}/sites-enabled/mumble.conf"
     state: link
   notify: reload nginx
 

tasks/self_signed.yml

@@ -0,0 +1,64 @@
+- name: Install SSL dependencies
+  package:
+    name: "{{ package }}"
+    state: present
+  loop:
+    - ssl-cert
+    - python3-openssl
+  loop_control:
+    loop_var: package
+  tags: selfsigned_install
+
+- name: Create SSL config directories
+  file:
+    path: "{{ config_dir }}"
+    state: directory
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "711"
+  loop:
+  - "{{ acme_config_dir }}"
+  - "{{ acme_keys_dir }}"
+  - "{{ acme_accounts_dir }}"
+  - "{{ acme_csr_dir }}"
+  loop_control:
+    loop_var: config_dir
+  tags: selfsigned_install
+
+- name: Create {{ domain_name }} certificates directory
+  file:
+    path: "{{ acme_certs_dir }}/{{ domain_name }}.d"
+    state: directory
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "755"
+  tags: selfsigned_install
+
+- name: Generate private key for {{ domain_name }} certificate
+  openssl_privatekey:
+    path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "640"
+    type: RSA
+    size: 4096
+
+- name: Generate CSR for {{ domain_name }} certificate
+  openssl_csr:
+    path: "{{ acme_csr_dir }}/{{ domain_name }}.csr"
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "644"
+    privatekey_path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
+    common_name: "{{ domain_name }}"
+
+- name: Generate self-signed certificate
+  openssl_certificate:
+    path: "{{ acme_certs_dir }}/{{ domain_name }}.d/cert.pem" 
+    csr_path: "{{ acme_csr_dir }}/{{ domain_name }}.csr"
+    privatekey_path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
+    provider: selfsigned 
+    state: present
+    owner: root 
+    group: "{{ acme_ssl_group }}" 
+    mode: "644"

tasks/umurmur.yml

@@ -1,6 +1,7 @@
 - name: Install umurmur build dependencies
-  apt:
+  package:
     name: "{{ package }}"
+    state: present
   loop:
   - git
   - build-essential
@@ -87,5 +88,5 @@
 - name: Open umurmur port with UFW
   ufw:
     rule: allow
-    port: "{{ umurmur_port }}"
+    port: "{{ umurmur_port | str }}"
   when: umurmur_ispublic | bool